INFO: task syz.3.18:5101 blocked for more than 143 seconds. Not tainted 6.1.135-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.18 state:D stack:28528 pid:5101 ppid:4980 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 rwsem_down_write_slowpath+0xbed/0x1090 kernel/locking/rwsem.c:1189 inode_lock include/linux/fs.h:758 [inline] open_last_lookups fs/namei.c:3547 [inline] path_openat+0x7c2/0x2e70 fs/namei.c:3780 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810 do_sys_openat2+0x142/0x490 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f99b977fed9 RSP: 002b:00007f99ba638058 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f99b9946080 RCX: 00007f99b977fed9 RDX: 000000000000275a RSI: 0000000020000040 RDI: ffffffffffffff9c RBP: 00007f99b97f3cc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f99b9946080 R15: 00007fffe475f2c8 INFO: task syz.4.19:5132 blocked for more than 145 seconds. Not tainted 6.1.135-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.19 state:D stack:28672 pid:5132 ppid:4981 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 rwsem_down_write_slowpath+0xbed/0x1090 kernel/locking/rwsem.c:1189 inode_lock include/linux/fs.h:758 [inline] open_last_lookups fs/namei.c:3547 [inline] path_openat+0x7c2/0x2e70 fs/namei.c:3780 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810 do_sys_openat2+0x142/0x490 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7efe9e57fed9 RSP: 002b:00007efe9e3de058 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007efe9e746080 RCX: 00007efe9e57fed9 RDX: 000000000000275a RSI: 0000000020000040 RDI: ffffffffffffff9c RBP: 00007efe9e5f3cc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007efe9e746080 R15: 00007ffe0d9a5718 INFO: task syz.2.17:5197 blocked for more than 147 seconds. Not tainted 6.1.135-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.17 state:D stack:28576 pid:5197 ppid:4977 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 rwsem_down_write_slowpath+0xbed/0x1090 kernel/locking/rwsem.c:1189 inode_lock include/linux/fs.h:758 [inline] open_last_lookups fs/namei.c:3547 [inline] path_openat+0x7c2/0x2e70 fs/namei.c:3780 do_filp_open+0x1c1/0x3c0 fs/namei.c:3810 do_sys_openat2+0x142/0x490 fs/open.c:1318 do_sys_open fs/open.c:1334 [inline] __do_sys_openat fs/open.c:1350 [inline] __se_sys_openat fs/open.c:1345 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1345 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f8049d7fed9 RSP: 002b:00007f804aa9e058 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f8049f46080 RCX: 00007f8049d7fed9 RDX: 000000000000275a RSI: 0000000020000040 RDI: ffffffffffffff9c RBP: 00007f8049df3cc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f8049f46080 R15: 00007ffff0503ca8 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8c927f30 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8c928750 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by khungtaskd/28: #0: ffffffff8c9275a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8c9275a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8c9275a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513 2 locks held by kworker/u4:2/36: 5 locks held by kworker/u4:3/46: #0: ffff888017216938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #1: ffffc90000b77d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dae6450 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x132/0xb80 net/core/net_namespace.c:594 #3: ffffffff8daf29e8 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xe5/0x9f0 net/core/dev.c:11477 #4: ffffffff8c92d238 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #4: ffffffff8c92d238 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x455/0x830 kernel/rcu/tree_exp.h:962 1 lock held by kswapd0/83: 3 locks held by kworker/1:2/127: #0: ffff88814cca4538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #1: ffffc90002e27d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #2: ffffffff8daf29e8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4675 2 locks held by getty/4007: #0: ffff88823bcfc898 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000325e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x5ca/0x1a60 drivers/tty/n_tty.c:2198 2 locks held by kworker/0:4/4271: #0: ffff888017072138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #1: ffffc90003e47d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 3 locks held by kworker/1:11/4323: #0: ffff888017070938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #1: ffffc90003267d00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #2: ffffffff8daf29e8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104 3 locks held by kworker/u4:5/4347: #0: ffff888017079138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #1: ffffc900032f7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x78e/0x1160 kernel/workqueue.c:2267 #2: ffffffff8daf29e8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263 1 lock held by syz.3.18/5098: 1 lock held by syz.3.18/5101: #0: ffff88806bacc188 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bacc188 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bacc188 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 1 lock held by syz.4.19/5129: 1 lock held by syz.4.19/5132: #0: ffff88806bb88188 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bb88188 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bb88188 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 1 lock held by syz.2.17/5196: 1 lock held by syz.2.17/5197: #0: ffff88806bacc6d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bacc6d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bacc6d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 1 lock held by syz.0.15/5215: 1 lock held by syz.0.15/5218: #0: ffff88806baccc18 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806baccc18 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806baccc18 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 2 locks held by syz.1.16/5220: 1 lock held by syz.1.16/5224: #0: ffff88806bb886d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bb886d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bb886d0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 1 lock held by syz.5.20/5405: 1 lock held by syz.5.20/5411: #0: ffff88806bb88c18 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bb88c18 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bb88c18 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 1 lock held by syz.6.21/5431: 1 lock held by syz.6.21/5432: #0: ffff88806bb89160 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bb89160 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bb89160 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 1 lock held by syz.7.22/5532: 1 lock held by syz.7.22/5534: #0: ffff88806bb896a8 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bb896a8 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bb896a8 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 2 locks held by syz.9.24/5551: 1 lock held by syz.9.24/5554: #0: ffff88806bb89bf0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bb89bf0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bb89bf0 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 2 locks held by syz.8.23/5557: 1 lock held by syz.8.23/5560: #0: ffff88806bb8a138 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88806bb8a138 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: open_last_lookups fs/namei.c:3547 [inline] #0: ffff88806bb8a138 (&type->i_mutex_dir_key#8){+.+.}-{3:3}, at: path_openat+0x7c2/0x2e70 fs/namei.c:3780 3 locks held by syz-executor/5635: #0: ffff8880b903aa58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537 #1: ffff8880b9027848 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x398/0x6d0 kernel/sched/psi.c:999 #2: ffffffff8c9275a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #2: ffffffff8c9275a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #2: ffffffff8c9275a0 (rcu_read_lock){....}-{1:2}, at: folio_memcg_lock+0x85/0x2e0 mm/memcontrol.c:2103 7 locks held by syz-executor/6427: #0: ffff88807eb76460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x256/0x960 fs/read_write.c:580 #1: ffff88807cfb3088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e5/0x4c0 fs/kernfs/file.c:325