ci starts bisection 2025-03-16 10:58:49.24232944 +0000 UTC m=+222206.200806801
bisecting fixing commit since 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd
building syzkaller on 402f1df054ddb07ed5bb299d08c781354eb06607
ensuring issue is reproducible on original commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: ebb42f9102104f9de5616a3381010df1e31b1181075a58310a76f2f064408a6f
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_wp
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_wp
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_wp
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_fault
run #10: crashed: INFO: task hung in hugetlb_wp
run #11: crashed: INFO: task hung in remove_inode_hugepages
run #12: crashed: INFO: task hung in remove_inode_hugepages
run #13: crashed: INFO: task hung in hugetlb_fault
run #14: crashed: INFO: task hung in hugetlb_fault
run #15: crashed: INFO: task hung in remove_inode_hugepages
run #16: crashed: INFO: task hung in hugetlb_fault
run #17: crashed: INFO: task hung in hugetlb_fault
run #18: crashed: INFO: task hung in hugetlb_wp
run #19: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
check whether we can drop unnecessary instrumentation
disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 73add09c6d47a2f4ea807679b8c85369c614544014860edcc57733248826b4c1
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in remove_inode_hugepages
run #3: crashed: INFO: task hung in hugetlb_wp
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the bug reproduces without the instrumentation
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
kconfig minimization: base=4064 full=8192 leaves diff=2119
split chunks (needed=false): <2119>
split chunk #0 of len 2119 into 5 parts
testing without sub-chunk 1/5
disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 464e69c7e06deedf87600b246d44da5f8290a9d75d48c791bcd5f10f2e0f131e
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in remove_inode_hugepages
run #7: crashed: INFO: task hung in hugetlb_wp
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in remove_inode_hugepages
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: df36b623d8ebad6cb03a0671e46e86fe4b278159eb090a258d8949974adaa65c
run #0: ignore: lost connection to test machine
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in remove_inode_hugepages
run #9: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [LEAK UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: beddc0130da3fd8dd2d9ec4df42702d56aeb43f928e855e6abf35e85cc812100
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_wp
run #7: crashed: INFO: task hung in remove_inode_hugepages
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [UBSAN BUG KASAN LOCKDEP ATOMIC_SLEEP LEAK], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 672c127587243e7b12f5e4d6a652059ca876ef15421fd1fa27053e65c3061880
all runs: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [ATOMIC_SLEEP LEAK UBSAN BUG KASAN LOCKDEP], they are not needed
testing commit 87d6aab2389e5ce0197d8257d5f8ee965a67c4cd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 93f25150cd9ce8ad48ffec748770facc4c0afc9ed088990965b6d353ae43c47e
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in hugetlb_fault
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in hugetlb_fault
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in remove_inode_hugepages
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
the chunk can be dropped
disabling configs for [ATOMIC_SLEEP LEAK UBSAN BUG KASAN LOCKDEP], they are not needed
testing current HEAD cb82ca153949c6204af793de24b18a04236e79fd
testing commit cb82ca153949c6204af793de24b18a04236e79fd gcc
compiler: gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
kernel signature: 8f120f706b2dbb35ae723958b23b47021d7bee14fd54020248b020ab4bbd4ef0
run #0: crashed: INFO: task hung in hugetlb_fault
run #1: crashed: INFO: task hung in hugetlb_fault
run #2: crashed: INFO: task hung in hugetlb_fault
run #3: crashed: INFO: task hung in hugetlb_fault
run #4: crashed: INFO: task hung in remove_inode_hugepages
run #5: crashed: INFO: task hung in hugetlb_fault
run #6: crashed: INFO: task hung in hugetlb_fault
run #7: crashed: INFO: task hung in remove_inode_hugepages
run #8: crashed: INFO: task hung in hugetlb_fault
run #9: crashed: INFO: task hung in hugetlb_fault
representative crash: INFO: task hung in hugetlb_fault, types: [HANG]
crash still not fixed/happens on the oldest tested release
revisions tested: 8, total time: 1h47m4.359683994s (build: 49m18.463253613s, test: 51m10.863332797s)
crash still not fixed or there were kernel test errors
commit msg: Merge tag 'usb-6.14-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb
crash: INFO: task hung in hugetlb_fault
INFO: task syz.0.200:5103 blocked for more than 143 seconds.
Not tainted 6.14.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.200 state:D stack:13360 pid:5103 tgid:5103 ppid:2413 task_flags:0x400040 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5378 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6765
__schedule_loop kernel/sched/core.c:6842 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6857
io_schedule+0x41/0x60 kernel/sched/core.c:7690
folio_wait_bit_common+0x136/0x380 mm/filemap.c:1317
__folio_lock mm/filemap.c:1664 [inline]
folio_lock include/linux/pagemap.h:1163 [inline]
folio_lock include/linux/pagemap.h:1159 [inline]
__filemap_get_folio+0x1be/0x340 mm/filemap.c:1917
filemap_lock_folio include/linux/pagemap.h:800 [inline]
filemap_lock_hugetlb_folio include/linux/hugetlb.h:791 [inline]
hugetlb_fault+0x7e0/0xc10 mm/hugetlb.c:6459
handle_mm_fault+0x351/0x360 mm/memory.c:6198
do_user_addr_fault arch/x86/mm/fault.c:1337 [inline]
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x256/0x6e0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7fe0bef87208
RSP: 002b:00007ffe788332f8 EFLAGS: 00010246
RAX: 0000000020000640 RBX: 0000000000000004 RCX: 006b6e696c766564
RDX: 0000000000000008 RSI: 006b6e696c766564 RDI: 0000000020000640
RBP: 00007fe0bf177a80 R08: 00007fe0bee3a000 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000009 R12: 000000000000e664
R13: 00007ffe78833400 R14: 0000000000000032 R15: fffffffffffffffe
INFO: task syz.0.200:5105 blocked for more than 143 seconds.
Not tainted 6.14.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.200 state:D stack:13784 pid:5105 tgid:5103 ppid:2413 task_flags:0x400140 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:5378 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6765
__schedule_loop kernel/sched/core.c:6842 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6857
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
__mutex_lock_common kernel/locking/mutex.c:662 [inline]
__mutex_lock+0x5e3/0xa90 kernel/locking/mutex.c:730
hugetlb_wp+0x85a/0xcf0 mm/hugetlb.c:5944
hugetlb_fault+0xa98/0xc10 mm/hugetlb.c:6507
handle_mm_fault+0x351/0x360 mm/memory.c:6198
do_user_addr_fault arch/x86/mm/fault.c:1388 [inline]
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x161/0x6e0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58
Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb
RSP: 0018:ffffc9000266bde0 EFLAGS: 00050246
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008
RDX: 000000002002def0 RSI: ffffc9000266be10 RDI: 000000002002dee8
RBP: 000000002002dee8 R08: 0000000000080000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffc9000266be10
R13: 0000000000018ff8 R14: 0000000020019680 R15: 0000000000000000
copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
_inline_copy_to_user include/linux/uaccess.h:197 [inline]
_copy_to_user+0x56/0x70 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
msr_read+0x68/0xe0 arch/x86/kernel/msr.c:69
vfs_read+0xe0/0x380 fs/read_write.c:563
ksys_read+0x6f/0xf0 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe0befbdff9
RSP: 002b:00007fe0bea39038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fe0bf175f80 RCX: 00007fe0befbdff9
RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000003
RBP: 00007fe0bf030296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe0bf175f80 R15: 00007ffe78833198
INFO: task syz.3.207:5139 blocked for more than 143 seconds.
Not tainted 6.14.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.207 state:D stack:14304 pid:5139 tgid:5138 ppid:2423 task_flags:0x400140 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5378 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6765
__schedule_loop kernel/sched/core.c:6842 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6857
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
__mutex_lock_common kernel/locking/mutex.c:662 [inline]
__mutex_lock+0x5e3/0xa90 kernel/locking/mutex.c:730
hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6375
handle_mm_fault+0x351/0x360 mm/memory.c:6198
do_user_addr_fault arch/x86/mm/fault.c:1388 [inline]
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x161/0x6e0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_movs_alternative+0x33/0x70 arch/x86/lib/copy_user_64.S:58
Code: 40 83 f9 08 73 21 85 c9 74 0f 8a 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 48 8b 06 <48> 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 df 83 f9 08 73 e8 eb
RSP: 0018:ffffc9000257fde0 EFLAGS: 00050246
RAX: 0000000000000000 RBX: 0000000000000008 RCX: 0000000000000008
RDX: 00000000200225d0 RSI: ffffc9000257fe10 RDI: 00000000200225c8
RBP: 00000000200225c8 R08: 0000000000080000 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffffc9000257fe10
R13: 0000000000018ff8 R14: 0000000020019680 R15: 0000000000000000
copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
_inline_copy_to_user include/linux/uaccess.h:197 [inline]
_copy_to_user+0x56/0x70 lib/usercopy.c:26
copy_to_user include/linux/uaccess.h:225 [inline]
msr_read+0x68/0xe0 arch/x86/kernel/msr.c:69
vfs_read+0xe0/0x380 fs/read_write.c:563
ksys_read+0x6f/0xf0 fs/read_write.c:708
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8cb113dff9
RSP: 002b:00007f8cb0bbf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f8cb12f5f80 RCX: 00007f8cb113dff9
RDX: 0000000000018ff8 RSI: 0000000020019680 RDI: 0000000000000003
RBP: 00007f8cb11b0296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f8cb12f5f80 R15: 00007ffdc13700f8
INFO: task syz.3.207:5145 blocked for more than 144 seconds.
Not tainted 6.14.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.207 state:D stack:13520 pid:5145 tgid:5138 ppid:2423 task_flags:0x400040 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5378 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6765
__schedule_loop kernel/sched/core.c:6842 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6857
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
__mutex_lock_common kernel/locking/mutex.c:662 [inline]
__mutex_lock+0x5e3/0xa90 kernel/locking/mutex.c:730
hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
vfs_fallocate+0x121/0x3b0 fs/open.c:338
ksys_fallocate fs/open.c:362 [inline]
__do_sys_fallocate fs/open.c:367 [inline]
__se_sys_fallocate fs/open.c:365 [inline]
__x64_sys_fallocate+0x3e/0x80 fs/open.c:365
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8cb113dff9
RSP: 002b:00007f8cb0b9e038 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007f8cb12f6058 RCX: 00007f8cb113dff9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f8cb11b0296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000400 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f8cb12f6058 R15: 00007ffdc13700f8
INFO: task syz.4.232:5252 blocked for more than 144 seconds.
Not tainted 6.14.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.232 state:D stack:13336 pid:5252 tgid:5246 ppid:1937 task_flags:0x400040 flags:0x00000004
Call Trace:
context_switch kernel/sched/core.c:5378 [inline]
__schedule+0x525/0xb40 kernel/sched/core.c:6765
__schedule_loop kernel/sched/core.c:6842 [inline]
schedule+0x25/0x110 kernel/sched/core.c:6857
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
__mutex_lock_common kernel/locking/mutex.c:662 [inline]
__mutex_lock+0x5e3/0xa90 kernel/locking/mutex.c:730
hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
vfs_fallocate+0x121/0x3b0 fs/open.c:338
ksys_fallocate fs/open.c:362 [inline]
__do_sys_fallocate fs/open.c:367 [inline]
__se_sys_fallocate fs/open.c:365 [inline]
__x64_sys_fallocate+0x3e/0x80 fs/open.c:365
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff2627adff9
RSP: 002b:00007ff262208038 EFLAGS: 00000246 ORIG_RAX: 000000000000011d
RAX: ffffffffffffffda RBX: 00007ff262966058 RCX: 00007ff2627adff9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007ff262820296 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000400 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff262966058 R15: 00007ffc42e12b68
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8277c700 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff8277c700 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8277c700 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x36/0x120 kernel/locking/lockdep.c:6746
2 locks held by getty/841:
#0: ffff8881056ff8a0 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x23/0x60 drivers/tty/tty_ldisc.c:243
#1: ffffc90001c6f2f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x54b/0x6a0 drivers/tty/n_tty.c:2211
3 locks held by syz.0.200/5103:
#0: ffff8881097d3368 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline]
#0: ffff8881097d3368 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6366
#1: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6375
#2: ffff8881013a00e8 (&resv_map->rw_sema){....}-{3:3}, at: hugetlb_fault+0xca/0xc10 mm/hugetlb.c:6382
2 locks held by syz.0.200/5105:
#0: ffff88810bb90b20 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:209 [inline]
#0: ffff88810bb90b20 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6237 [inline]
#0: ffff88810bb90b20 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x270 mm/memory.c:6297
#1: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_wp+0x85a/0xcf0 mm/hugetlb.c:5944
2 locks held by syz.3.207/5139:
#0: ffff8881013ab020 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:209 [inline]
#0: ffff8881013ab020 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6237 [inline]
#0: ffff8881013ab020 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x270 mm/memory.c:6297
#1: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6375
3 locks held by syz.3.207/5145:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810a7557c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810a7557c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.4.232/5252:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810a755c48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810a755c48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.3.940/9688:
#0: ffff8881102bf9f0 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline]
#0: ffff8881102bf9f0 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6366
#1: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6375
#2: ffff88810d3b8ce8 (&resv_map->rw_sema){....}-{3:3}, at: hugetlb_fault+0xca/0xc10 mm/hugetlb.c:6382
2 locks held by syz.3.940/9689:
#0: ffff88810faa3020 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:209 [inline]
#0: ffff88810faa3020 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6237 [inline]
#0: ffff88810faa3020 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x270 mm/memory.c:6297
#1: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_wp+0x85a/0xcf0 mm/hugetlb.c:5944
3 locks held by syz.0.980/9857:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810dbddc48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810dbddc48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.4.983/9868:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810dbde9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810dbde9c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.1.1499/13388:
#0: ffff8881102bf6f8 (&vma->vm_lock->lock){....}-{3:3}, at: vma_start_read include/linux/mm.h:717 [inline]
#0: ffff8881102bf6f8 (&vma->vm_lock->lock){....}-{3:3}, at: lock_vma_under_rcu+0x86/0x1d0 mm/memory.c:6366
#1: ffff888101acc8d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6375
#2: ffff8881037fe6e8 (&resv_map->rw_sema){....}-{3:3}, at: hugetlb_fault+0xca/0xc10 mm/hugetlb.c:6382
2 locks held by syz.1.1499/13389:
#0: ffff888108bf5e60 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:209 [inline]
#0: ffff888108bf5e60 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6237 [inline]
#0: ffff888108bf5e60 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x26/0x270 mm/memory.c:6297
#1: ffff888101acc8d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_wp+0x85a/0xcf0 mm/hugetlb.c:5944
3 locks held by syz.4.1501/13397:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff888102abfbc8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff888102abfbc8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc8d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.1.2365/18301:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810e7f0148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810e7f0148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.3.2364/18314:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810e7f0a48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810e7f0a48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.4.2367/18319:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810e7f0ec8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810e7f0ec8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc8d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
2 locks held by syz.2.2401/18458:
#0: ffff88810bb926e0 (&mm->mmap_lock){....}-{3:3}, at: mmap_read_lock_killable include/linux/mmap_lock.h:199 [inline]
#0: ffff88810bb926e0 (&mm->mmap_lock){....}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:6246 [inline]
#0: ffff88810bb926e0 (&mm->mmap_lock){....}-{3:3}, at: lock_mm_and_find_vma+0x98/0x270 mm/memory.c:6297
#1: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlb_fault+0xc2/0xc10 mm/hugetlb.c:6375
3 locks held by syz.2.2401/18464:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810e7f2548 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810e7f2548 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.4.2824/21597:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810d3bc148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810d3bc148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.1.2827/21616:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810d3bc5c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810d3bc5c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.0.2829/21624:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810d3bd7c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810d3bd7c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.3.2833/21658:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810d3bdc48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810d3bdc48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.4.3408/25431:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810bf70148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810bf70148 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc8d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.3.3411/25429:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810bf705c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810bf705c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.2.3414/25448:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810bf71348 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810bf71348 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc8d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.1.3417/25456:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810bf720c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810bf720c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.0.3503/25724:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810bf732c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810bf732c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.3.3625/28422:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810fb64a48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810fb64a48 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc458 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.2.3636/28461:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88810fb669c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88810fb669c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc8d8 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
3 locks held by syz.4.5426/3993:
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: ksys_fallocate fs/open.c:362 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __do_sys_fallocate fs/open.c:367 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __se_sys_fallocate fs/open.c:365 [inline]
#0: ffff8881026ba3f8 (sb_writers#14){....}-{0:0}, at: __x64_sys_fallocate+0x3e/0x80 fs/open.c:365
#1: ffff88811ec1c5c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: inode_lock include/linux/fs.h:877 [inline]
#1: ffff88811ec1c5c8 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: hugetlbfs_fallocate+0xb9/0x680 fs/hugetlbfs/inode.c:755
#2: ffff888101acc848 (&hugetlb_fault_mutex_table[i]){....}-{3:3}, at: hugetlbfs_fallocate+0x205/0x680 fs/hugetlbfs/inode.c:799
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x5a/0x90 lib/dump_stack.c:120
nmi_cpu_backtrace+0xd4/0x110 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0xd5/0x140 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline]
watchdog+0x645/0x680 kernel/hung_task.c:399
kthread+0xf7/0x200 kernel/kthread.c:464
ret_from_fork+0x2c/0x50 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 25767 Comm: udevd Not tainted 6.14.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:87 [inline]
RIP: 0010:check_preemption_disabled+0x2c/0xe0 lib/smp_processor_id.c:19
Code: 55 53 48 83 ec 08 65 8b 1d 7d 1a 19 7e 65 f7 05 6e 1a 19 7e ff ff ff 7f 74 0f 48 83 c4 08 89 d8 5b 5d 41 5c c3 cc cc cc cc 9c <58> f6 c4 02 74 ea 65 4c 8b 25 46 1a 19 7e 48 89 fd 41 f6 44 24 2f
RSP: 0018:ffffc900047fbc20 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000001 RSI: ffffffff8252e958 RDI: ffffffff824f54e2
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: ffff888110440618 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000046
FS: 00007f7b4a36c280(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555558c604a8 CR3: 000000010d326000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lockdep_recursion_inc kernel/locking/lockdep.c:464 [inline]
lock_acquire kernel/locking/lockdep.c:5850 [inline]
lock_acquire+0x79/0x190 kernel/locking/lockdep.c:5816
seqcount_lockdep_reader_access include/linux/seqlock.h:72 [inline]
__follow_mount_rcu fs/namei.c:1597 [inline]
handle_mounts fs/namei.c:1622 [inline]
step_into+0x3ba/0x7b0 fs/namei.c:1952
link_path_walk.part.0.constprop.0+0x218/0x390 fs/namei.c:2479
link_path_walk fs/namei.c:2629 [inline]
path_lookupat+0x39/0x1a0 fs/namei.c:2635
filename_lookup+0xf4/0x200 fs/namei.c:2665
do_readlinkat+0x75/0x180 fs/stat.c:564
__do_sys_readlink fs/stat.c:601 [inline]
__se_sys_readlink fs/stat.c:598 [inline]
__x64_sys_readlink+0x19/0x20 fs/stat.c:598
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x6d/0x170 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b4a495d47
Code: 73 01 c3 48 8b 0d e1 90 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 59 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b1 90 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd7d37f428 EFLAGS: 00000246 ORIG_RAX: 0000000000000059
RAX: ffffffffffffffda RBX: 00007ffd7d37f4c8 RCX: 00007f7b4a495d47
RDX: 0000000000000400 RSI: 00007ffd7d37f8c8 RDI: 00007ffd7d37fde8
RBP: 00007ffd7d37fde8 R08: 0000000000000000 R09: 00007ffd7d37f6a8
R10: 0000000000000100 R11: 0000000000000246 R12: 00007ffd7d37f8c8
R13: 000055ffc273b440 R14: 000055ffc2760db0 R15: 00007ffd7d37fdf6