INFO: task syz.3.11214:29994 blocked for more than 143 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.11214 state:D stack:28776 pid:29994 tgid:29993 ppid:5617 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x125c/0x6730 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0xdd/0x2c0 kernel/sched/core.c:7326 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0xccc/0x1bd0 kernel/locking/mutex.c:821 write_versions+0x9d/0xba0 fs/nfsd/nfsctl.c:701 nfsctl_transaction_write+0x106/0x1a0 fs/nfsd/nfsctl.c:112 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3c4bd9e019 RSP: 002b:00007f3c4cb9d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f3c4c025fa0 RCX: 00007f3c4bd9e019 RDX: 0000000000000009 RSI: 0000200000000180 RDI: 0000000000000003 RBP: 00007f3c4be3500c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3c4c026038 R14: 00007f3c4c025fa0 R15: 00007ffcaa7ff118 Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 3 locks held by kworker/0:3/4990: #0: ffff88801bc0f140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc900050cfd08 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 #2: ffffffff8ebf3ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343 2 locks held by getty/5365: #0: ffff888035de70a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211 2 locks held by kworker/0:6/5726: #0: ffff88801bc0f140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297 #1: ffffc90004637d08 ((work_completion)(&m->mpeg_thread)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298 1 lock held by syz.0.6606/19772: #0: ffff88805e6f8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:497 2 locks held by dhcpcd/21476: #0: ffff88802449d2c0 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #0: ffff88802449d2c0 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:709 #1: ffffffff8ebf3ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343 1 lock held by syz.5.10090/27484: #0: ffff8880525d8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:497 3 locks held by syz.1.11124/29799: #0: ffff88807afa9970 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259 #1: ffff88802eb02450 (sb_writers#24){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739 #2: ffffffff8f072880 (nfsd_mutex){+.+.}-{4:4}, at: write_threads+0x278/0x570 fs/nfsd/nfsctl.c:432 3 locks held by syz.3.11214/29994: #0: ffff88807de0d270 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259 #1: ffff88807afec450 (sb_writers#24){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739 #2: ffffffff8f072880 (nfsd_mutex){+.+.}-{4:4}, at: write_versions+0x9d/0xba0 fs/nfsd/nfsctl.c:701 3 locks held by syz.2.11506/30764: #0: ffff88807b481270 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259 #1: ffff888053f10450 (sb_writers#24){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739 #2: ffffffff8f072880 (nfsd_mutex){+.+.}-{4:4}, at: nfsd4_write_time fs/nfsd/nfsctl.c:963 [inline] #2: ffffffff8f072880 (nfsd_mutex){+.+.}-{4:4}, at: write_gracetime+0xa3/0x110 fs/nfsd/nfsctl.c:1009 3 locks held by syz.6.11561/30887: #0: ffff88807e46b0b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259 #1: ffff88802ab4e450 (sb_writers#24){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739 #2: ffffffff8f072880 (nfsd_mutex){+.+.}-{4:4}, at: write_maxblksize+0x252/0x600 fs/nfsd/nfsctl.c:908 1 lock held by syz-executor/31233: #0: ffff88807d85cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:497 1 lock held by syz.8.12216/32719: #0: ffff888033ffcea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:497 1 lock held by syz.4.12222/32741: #0: ffff88803bcc4ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:497