INFO: task syz-executor.0:3588 blocked for more than 430 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:0 pid:3588 tgid:3588 ppid:1 task_flags:0x400140 flags:0x00000005 Call trace: [<81a3d27c>] (__schedule) from [<81a3e210>] (__schedule_loop kernel/sched/core.c:7043 [inline]) [<81a3d27c>] (__schedule) from [<81a3e210>] (schedule+0x2c/0x130 kernel/sched/core.c:7058) r10:dfa61bfc r9:00000002 r8:60000013 r7:850f6230 r6:dfa61c04 r5:838b9800 r4:838b9800 [<81a3e1e4>] (schedule) from [<81a3e5f8>] (schedule_preempt_disabled+0x18/0x24 kernel/sched/core.c:7115) r5:838b9800 r4:850f622c [<81a3e5e0>] (schedule_preempt_disabled) from [<81a411a8>] (__mutex_lock_common kernel/locking/mutex.c:676 [inline]) [<81a3e5e0>] (schedule_preempt_disabled) from [<81a411a8>] (__mutex_lock.constprop.0+0x350/0xa24 kernel/locking/mutex.c:760) [<81a40e58>] (__mutex_lock.constprop.0) from [<81a41950>] (__mutex_lock_slowpath+0x14/0x18 kernel/locking/mutex.c:1049) r10:833b2014 r9:80808080 r8:00000001 r7:00000000 r6:83754c38 r5:850f6000 r4:83754c38 [<81a4193c>] (__mutex_lock_slowpath) from [<81a41990>] (mutex_lock+0x3c/0x40 kernel/locking/mutex.c:274) [<81a41954>] (mutex_lock) from [<80741f20>] (fuse_lock_inode+0x34/0x3c fs/fuse/inode.c:589) [<80741eec>] (fuse_lock_inode) from [<807369a8>] (fuse_lookup+0x64/0x174 fs/fuse/dir.c:427) [<80736944>] (fuse_lookup) from [<80562e2c>] (__lookup_slow+0x8c/0x140 fs/namei.c:1808) r9:80808080 r8:dfa61e60 r7:850f6000 r6:00000403 r5:83763908 r4:83754c38 [<80562da0>] (__lookup_slow) from [<80566e18>] (lookup_slow fs/namei.c:1825 [inline]) [<80562da0>] (__lookup_slow) from [<80566e18>] (walk_component+0x104/0x170 fs/namei.c:2129) r9:80808080 r8:00000403 r7:00000002 r6:dfa61e58 r5:850f6080 r4:83763908 [<80566d14>] (walk_component) from [<805670a4>] (link_path_walk+0x220/0x3dc fs/namei.c:2497) r9:80808080 r8:2f2f2f2f r7:d0d0d0d0 r6:dfa61e58 r5:fefefeff r4:833b2015 [<80566e84>] (link_path_walk) from [<80568760>] (path_openat+0x7c/0x1150 fs/namei.c:4042) r10:854169c0 r9:833b2000 r8:dfa61e58 r7:dfa61e58 r6:dfa61f20 r5:833b2010 r4:ffffff9c [<805686e4>] (path_openat) from [<805698e0>] (do_filp_open+0xac/0x148 fs/namei.c:4073) r10:00000142 r9:833b2000 r8:00000003 r7:dfa61e58 r6:dfa61f20 r5:838b9800 r4:ffffff9c [<80569834>] (do_filp_open) from [<80550464>] (do_sys_openat2+0x90/0xe0 fs/open.c:1435) r9:838b9800 r8:8020029c r7:ffffff9c r6:dfa61f58 r5:833b2000 r4:00000003 [<805503d4>] (do_sys_openat2) from [<8055088c>] (do_sys_open fs/open.c:1450 [inline]) [<805503d4>] (do_sys_openat2) from [<8055088c>] (__do_sys_openat fs/open.c:1466 [inline]) [<805503d4>] (do_sys_openat2) from [<8055088c>] (sys_openat+0x98/0xd4 fs/open.c:1461) r7:00000142 r6:00000000 r5:00093608 r4:ffffff9c [<805507f4>] (sys_openat) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdfa61fa8 to 0xdfa61ff0) 1fa0: 00000002 7e83061c ffffff9c 00093608 000a4800 00000000 1fc0: 00000002 7e83061c 00000000 00000142 00140000 00000000 7e830670 7e830630 1fe0: 0011c000 7e830580 0004b8d4 000502b8 r5:7e83061c r4:00000002 INFO: task syz-executor.0:3588 is blocked on a mutex likely owned by task syz-executor.0:3992. task:syz-executor.0 state:D stack:0 pid:3992 tgid:3986 ppid:3588 task_flags:0x400140 flags:0x00000005 Call trace: [<81a3d27c>] (__schedule) from [<81a3e210>] (__schedule_loop kernel/sched/core.c:7043 [inline]) [<81a3d27c>] (__schedule) from [<81a3e210>] (schedule+0x2c/0x130 kernel/sched/core.c:7058) r10:00000000 r9:df9ddc8c r8:84bcf058 r7:84bcf058 r6:df9ddb58 r5:df9ddbf0 r4:84cf6000 [<81a3e1e4>] (schedule) from [<80731340>] (request_wait_answer fs/fuse/dev.c:565 [inline]) [<81a3e1e4>] (schedule) from [<80731340>] (__fuse_request_send fs/fuse/dev.c:579 [inline]) [<81a3e1e4>] (schedule) from [<80731340>] (__fuse_simple_request+0x348/0x498 fs/fuse/dev.c:673) r5:df9ddbf0 r4:84bcf000 [<80730ff8>] (__fuse_simple_request) from [<80736784>] (fuse_simple_request fs/fuse/fuse_i.h:1230 [inline]) [<80730ff8>] (__fuse_simple_request) from [<80736784>] (fuse_lookup_name+0xc0/0x280 fs/fuse/dir.c:381) r8:8498bbc0 r7:84d90800 r6:83763cd8 r5:00000001 r4:df9ddc90 [<807366c4>] (fuse_lookup_name) from [<807369d4>] (fuse_lookup+0x90/0x174 fs/fuse/dir.c:428) r10:832e0014 r9:00000001 r8:00000001 r7:00000000 r6:83763cc0 r5:850f6000 r4:83763cc0 [<80736944>] (fuse_lookup) from [<80562e2c>] (__lookup_slow+0x8c/0x140 fs/namei.c:1808) r9:80808080 r8:df9dde60 r7:850f6000 r6:00000401 r5:83763908 r4:83763cc0 [<80562da0>] (__lookup_slow) from [<80566e18>] (lookup_slow fs/namei.c:1825 [inline]) [<80562da0>] (__lookup_slow) from [<80566e18>] (walk_component+0x104/0x170 fs/namei.c:2129) r9:80808080 r8:00000401 r7:00000002 r6:df9dde58 r5:850f6080 r4:83763908 [<80566d14>] (walk_component) from [<805670a4>] (link_path_walk+0x220/0x3dc fs/namei.c:2497) r9:80808080 r8:2f2f2f2f r7:d0d0d0d0 r6:df9dde58 r5:fefefeff r4:832e0015 [<80566e84>] (link_path_walk) from [<80568760>] (path_openat+0x7c/0x1150 fs/namei.c:4042) r10:84c07240 r9:832e0000 r8:df9dde58 r7:df9dde58 r6:df9ddf20 r5:832e0010 r4:ffffff9c [<805686e4>] (path_openat) from [<805698e0>] (do_filp_open+0xac/0x148 fs/namei.c:4073) r10:00000142 r9:832e0000 r8:00000001 r7:df9dde58 r6:df9ddf20 r5:84cf6000 r4:ffffff9c [<80569834>] (do_filp_open) from [<80550464>] (do_sys_openat2+0x90/0xe0 fs/open.c:1435) r9:84cf6000 r8:8020029c r7:ffffff9c r6:df9ddf58 r5:832e0000 r4:00000005 [<805503d4>] (do_sys_openat2) from [<8055088c>] (do_sys_open fs/open.c:1450 [inline]) [<805503d4>] (do_sys_openat2) from [<8055088c>] (__do_sys_openat fs/open.c:1466 [inline]) [<805503d4>] (do_sys_openat2) from [<8055088c>] (sys_openat+0x98/0xd4 fs/open.c:1461) r7:00000142 r6:00000000 r5:76af5da0 r4:ffffff9c [<805507f4>] (sys_openat) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdf9ddfa8 to 0xdf9ddff0) dfa0: 00000002 76af5da0 ffffff9c 76af5da0 00000002 00000000 dfc0: 00000002 76af5da0 00000000 00000142 00000000 6e6d6000 20000240 20000a40 dfe0: 0000005c 76af5d10 00091144 0004ee98 r5:76af5da0 r4:00000002 INFO: task syz-executor.0:3992 blocked for more than 430 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:0 pid:3992 tgid:3986 ppid:3588 task_flags:0x400140 flags:0x00000005 Call trace: [<81a3d27c>] (__schedule) from [<81a3e210>] (__schedule_loop kernel/sched/core.c:7043 [inline]) [<81a3d27c>] (__schedule) from [<81a3e210>] (schedule+0x2c/0x130 kernel/sched/core.c:7058) r10:00000000 r9:df9ddc8c r8:84bcf058 r7:84bcf058 r6:df9ddb58 r5:df9ddbf0 r4:84cf6000 [<81a3e1e4>] (schedule) from [<80731340>] (request_wait_answer fs/fuse/dev.c:565 [inline]) [<81a3e1e4>] (schedule) from [<80731340>] (__fuse_request_send fs/fuse/dev.c:579 [inline]) [<81a3e1e4>] (schedule) from [<80731340>] (__fuse_simple_request+0x348/0x498 fs/fuse/dev.c:673) r5:df9ddbf0 r4:84bcf000 [<80730ff8>] (__fuse_simple_request) from [<80736784>] (fuse_simple_request fs/fuse/fuse_i.h:1230 [inline]) [<80730ff8>] (__fuse_simple_request) from [<80736784>] (fuse_lookup_name+0xc0/0x280 fs/fuse/dir.c:381) r8:8498bbc0 r7:84d90800 r6:83763cd8 r5:00000001 r4:df9ddc90 [<807366c4>] (fuse_lookup_name) from [<807369d4>] (fuse_lookup+0x90/0x174 fs/fuse/dir.c:428) r10:832e0014 r9:00000001 r8:00000001 r7:00000000 r6:83763cc0 r5:850f6000 r4:83763cc0 [<80736944>] (fuse_lookup) from [<80562e2c>] (__lookup_slow+0x8c/0x140 fs/namei.c:1808) r9:80808080 r8:df9dde60 r7:850f6000 r6:00000401 r5:83763908 r4:83763cc0 [<80562da0>] (__lookup_slow) from [<80566e18>] (lookup_slow fs/namei.c:1825 [inline]) [<80562da0>] (__lookup_slow) from [<80566e18>] (walk_component+0x104/0x170 fs/namei.c:2129) r9:80808080 r8:00000401 r7:00000002 r6:df9dde58 r5:850f6080 r4:83763908 [<80566d14>] (walk_component) from [<805670a4>] (link_path_walk+0x220/0x3dc fs/namei.c:2497) r9:80808080 r8:2f2f2f2f r7:d0d0d0d0 r6:df9dde58 r5:fefefeff r4:832e0015 [<80566e84>] (link_path_walk) from [<80568760>] (path_openat+0x7c/0x1150 fs/namei.c:4042) r10:84c07240 r9:832e0000 r8:df9dde58 r7:df9dde58 r6:df9ddf20 r5:832e0010 r4:ffffff9c [<805686e4>] (path_openat) from [<805698e0>] (do_filp_open+0xac/0x148 fs/namei.c:4073) r10:00000142 r9:832e0000 r8:00000001 r7:df9dde58 r6:df9ddf20 r5:84cf6000 r4:ffffff9c [<80569834>] (do_filp_open) from [<80550464>] (do_sys_openat2+0x90/0xe0 fs/open.c:1435) r9:84cf6000 r8:8020029c r7:ffffff9c r6:df9ddf58 r5:832e0000 r4:00000005 [<805503d4>] (do_sys_openat2) from [<8055088c>] (do_sys_open fs/open.c:1450 [inline]) [<805503d4>] (do_sys_openat2) from [<8055088c>] (__do_sys_openat fs/open.c:1466 [inline]) [<805503d4>] (do_sys_openat2) from [<8055088c>] (sys_openat+0x98/0xd4 fs/open.c:1461) r7:00000142 r6:00000000 r5:76af5da0 r4:ffffff9c [<805507f4>] (sys_openat) from [<80200060>] (ret_fast_syscall+0x0/0x1c arch/arm/mm/proc-v7.S:67) Exception stack(0xdf9ddfa8 to 0xdf9ddff0) dfa0: 00000002 76af5da0 ffffff9c 76af5da0 00000002 00000000 dfc0: 00000002 76af5da0 00000000 00000142 00000000 6e6d6000 20000240 20000a40 dfe0: 0000005c 76af5d10 00091144 0004ee98 r5:76af5da0 r4:00000002 NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Call trace: [<80201a24>] (dump_backtrace) from [<80201b20>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:00000000 r6:00000013 r5:60000093 r4:82260afc [<80201b08>] (show_stack) from [<8021fc00>] (__dump_stack lib/dump_stack.c:94 [inline]) [<80201b08>] (show_stack) from [<8021fc00>] (dump_stack_lvl+0x70/0x7c lib/dump_stack.c:120) [<8021fb90>] (dump_stack_lvl) from [<8021fc24>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r5:00000001 r4:00000001 [<8021fc0c>] (dump_stack) from [<81a26e90>] (nmi_cpu_backtrace+0x160/0x17c lib/nmi_backtrace.c:113) [<81a26d30>] (nmi_cpu_backtrace) from [<81a26fdc>] (nmi_trigger_cpumask_backtrace+0x130/0x1d8 lib/nmi_backtrace.c:62) r7:00000001 r6:8280c690 r5:8281ac94 r4:ffffffff [<81a26eac>] (nmi_trigger_cpumask_backtrace) from [<802304fc>] (arch_trigger_cpumask_backtrace+0x18/0x1c arch/arm/kernel/smp.c:852) r9:82abd564 r8:82804d40 r7:00008d80 r6:00007f4f r5:8281b248 r4:83ee850c [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d978>] (trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]) [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d978>] (check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]) [<802304e4>] (arch_trigger_cpumask_backtrace) from [<8037d978>] (watchdog+0x4d4/0x81c kernel/hung_task.c:491) [<8037d4a4>] (watchdog) from [<80281fcc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:00000000 r8:8037d4a4 r7:8334a700 r6:8334a700 r5:83391800 r4:00000001 [<80281ea0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf8e1fb0 to 0xdf8e1ff8) 1fa0: 00000000 00000000 00000000 00000000 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281ea0 r4:8334ba40 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 2842 Comm: pr/ttyAMA-1 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] PC is at _raw_spin_unlock_irqrestore+0x28/0x54 kernel/locking/spinlock.c:194 LR is at spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] LR is at __uart_port_unlock_irqrestore include/linux/serial_core.h:616 [inline] LR is at pl011_console_device_unlock+0x20/0x24 drivers/tty/serial/amba-pl011.c:2603 pc : [<81a47244>] lr : [<80a79c20>] psr: 600e0113 sp : eb831eb0 ip : eb831ec0 fp : eb831ebc r10: 82959194 r9 : 00000000 r8 : 00000000 r7 : 00000117 r6 : 829590f8 r5 : 00000000 r4 : 00000001 r3 : 00000582 r2 : 00000000 r1 : 600e0113 r0 : 849f3c40 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 848e2080 DAC: fffffffd Call trace: [<81a4721c>] (_raw_spin_unlock_irqrestore) from [<80a79c20>] (spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]) [<81a4721c>] (_raw_spin_unlock_irqrestore) from [<80a79c20>] (__uart_port_unlock_irqrestore include/linux/serial_core.h:616 [inline]) [<81a4721c>] (_raw_spin_unlock_irqrestore) from [<80a79c20>] (pl011_console_device_unlock+0x20/0x24 drivers/tty/serial/amba-pl011.c:2603) [<80a79c00>] (pl011_console_device_unlock) from [<802e455c>] (nbcon_emit_one+0x88/0x100 kernel/printk/nbcon.c:1142) [<802e44d4>] (nbcon_emit_one) from [<802e477c>] (nbcon_kthread_func+0x1a8/0x2a4 kernel/printk/nbcon.c:1229) r6:8280c690 r5:84ac1800 r4:829590f8 [<802e45d4>] (nbcon_kthread_func) from [<80281fcc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:829590f8 r8:802e45d4 r7:84860a00 r6:84860a00 r5:84ac1800 r4:00000001 [<80281ea0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xeb831fb0 to 0xeb831ff8) 1fa0: 00000000 00000000 00000000 00000000 1fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 1fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:80281ea0 r4:840ffc00