INFO: task syz-executor.3:7212 blocked for more than 144 seconds. Not tainted 6.8.0-rc2-next-20240202-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:20408 pid:7212 tgid:7212 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5400 [inline] __schedule+0x17df/0x4a40 kernel/sched/core.c:6727 __schedule_loop kernel/sched/core.c:6804 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6819 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2159 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 __flush_workqueue+0x730/0x1630 kernel/workqueue.c:3617 drain_workqueue+0xc9/0x390 kernel/workqueue.c:3730 hci_dev_close_sync+0x47b/0xff0 net/bluetooth/hci_sync.c:4944 hci_dev_do_close net/bluetooth/hci_core.c:554 [inline] hci_unregister_dev+0x1e3/0x4e0 net/bluetooth/hci_core.c:2773 vhci_release+0x83/0xd0 drivers/bluetooth/hci_vhci.c:674 __fput+0x429/0x8a0 fs/file_table.c:376 task_work_run+0x24f/0x310 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa1b/0x27e0 kernel/exit.c:878 do_group_exit+0x207/0x2c0 kernel/exit.c:1027 get_signal+0x176e/0x1850 kernel/signal.c:2896 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:105 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:212 do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f083067a7d7 RSP: 002b:00007ffde2b31550 EFLAGS: 00000293 ORIG_RAX: 000000000000003d RAX: 0000000000000360 RBX: 0000000000000360 RCX: 00007f083067a7d7 RDX: 0000000040000000 RSI: 00007ffde2b315dc RDI: 00000000ffffffff RBP: 00007ffde2b315dc R08: 0000000000000000 R09: 00007ffde2bf60b0 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 000000000009c8a5 R15: 0000000000000002 Showing all locks held in the system: 1 lock held by rcu_exp_gp_kthr/18: 1 lock held by khungtaskd/29: #0: ffffffff8e130d60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:298 [inline] #0: ffffffff8e130d60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:750 [inline] #0: ffffffff8e130d60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614 3 locks held by kworker/u4:2/34: #0: ffff888015acd948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3024 [inline] #0: ffff888015acd948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x825/0x14f0 kernel/workqueue.c:3125 #1: ffffc90000aa7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3024 [inline] #1: ffffc90000aa7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x825/0x14f0 kernel/workqueue.c:3125 #2: ffffffff8f36da50 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf5/0xb90 net/core/net_namespace.c:580 2 locks held by kworker/u4:4/64: 2 locks held by getty/4826: #0: ffff88802a4e40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f162f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2201 1 lock held by syz-executor.3/7212: #0: ffff88804bf15060 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:552 [inline] #0: ffff88804bf15060 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1db/0x4e0 net/bluetooth/hci_core.c:2773 1 lock held by syz-executor.3/12579: #0: ffff88802c45c1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_release+0x81/0x12c0 drivers/tty/tty_io.c:1742 2 locks held by syz-executor.3/12584: #0: ffff88802c45c1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: __tty_hangup+0xcc/0x6c0 drivers/tty/tty_io.c:590 #1: ffff88802c45c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: __tty_ldisc_lock drivers/tty/tty_ldisc.c:289 [inline] #1: ffff88802c45c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_lock+0x6c/0xc0 drivers/tty/tty_ldisc.c:313 1 lock held by syz-executor.1/12605: #0: ffff88805a0ba1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_release+0x81/0x12c0 drivers/tty/tty_io.c:1742 2 locks held by syz-executor.1/12606: #0: ffff88805a0ba1c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: __tty_hangup+0xcc/0x6c0 drivers/tty/tty_io.c:590 #1: ffff88805a0ba0a0 (&tty->ldisc_sem){++++}-{0:0}, at: __tty_ldisc_lock drivers/tty/tty_ldisc.c:289 [inline] #1: ffff88805a0ba0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_lock+0x6c/0xc0 drivers/tty/tty_ldisc.c:313 2 locks held by syz-executor.0/13529: #0: ffffffff8f3dd970 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1216 #1: ffffffff8f379fc8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 net/wireless/nl80211.c:16461 2 locks held by syz-executor.0/13530: #0: ffffffff8f3dd970 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1216 #1: ffffffff8f379fc8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 net/wireless/nl80211.c:16461 4 locks held by syz-executor.3/13526: #0: ffffffff8f3dd970 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1216 #1: ffffffff8f379fc8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 net/wireless/nl80211.c:16461 #2: ffff888061420768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5928 [inline] #2: ffff888061420768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: nl80211_pre_doit+0x59f/0x8b0 net/wireless/nl80211.c:16534 #3: ffffffff8e1360f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #3: ffffffff8e1360f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x39a/0x820 kernel/rcu/tree_exp.h:939 2 locks held by syz-executor.1/13539: #0: ffffffff8f3dd970 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1216 #1: ffffffff8f379fc8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 net/wireless/nl80211.c:16461 2 locks held by syz-executor.1/13541: #0: ffffffff8f3dd970 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1216 #1: ffffffff8f379fc8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 net/wireless/nl80211.c:16461 2 locks held by syz-executor.4/13537: #0: ffffffff8f3dd970 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1216 #1: ffffffff8f379fc8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 net/wireless/nl80211.c:16461 2 locks held by syz-executor.4/13540: #0: ffffffff8f3dd970 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1216 #1: ffffffff8f379fc8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5f/0x8b0 net/wireless/nl80211.c:16461 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 29 Comm: khungtaskd Not tainted 6.8.0-rc2-next-20240202-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xfb0/0xff0 kernel/hung_task.c:379 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:242 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 4520 Comm: udevd Not tainted 6.8.0-rc2-next-20240202-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 RIP: 0010:unwind_next_frame+0x748/0x2a00 arch/x86/kernel/unwind_orc.c:512 Code: 58 34 48 89 d8 48 c1 e8 03 42 0f b6 04 28 84 c0 48 8b 54 24 10 0f 85 25 1b 00 00 c6 03 01 49 c7 c7 20 39 a8 8b 4c 89 7c 24 18 <49> 8d 6f 04 49 8d 5f 05 48 89 e8 48 c1 e8 03 48 89 44 24 38 42 0f RSP: 0018:ffffc9000e3ff008 EFLAGS: 00000293 RAX: ffffffff8140765f RBX: 0000000000000002 RCX: ffff88806cbbda00 RDX: ffffc9000e3ff115 RSI: ffffffff8dfa03e0 RDI: 0000000000000002 RBP: ffffffff9013e936 R08: 0000000000000003 R09: ffffffff81407632 R10: 0000000000000002 R11: ffff88806cbbda00 R12: ffffffff8f9e5e98 R13: dffffc0000000000 R14: 1ffff92001c7fe1c R15: ffffffff9013e932 FS: 00007f3ce5d89c80(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200bd038 CR3: 000000007cbc4000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0x151/0x1b0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:586 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2122 [inline] slab_free mm/slub.c:4296 [inline] kfree+0x14a/0x380 mm/slub.c:4406 tomoyo_realpath_from_path+0x5a9/0x5e0 security/tomoyo/realpath.c:286 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771 security_file_open+0x69/0x570 security/security.c:2932 do_dentry_open+0x327/0x15a0 fs/open.c:940 do_open fs/namei.c:3639 [inline] path_openat+0x2860/0x3240 fs/namei.c:3796 do_filp_open+0x235/0x490 fs/namei.c:3823 do_sys_openat2+0x13e/0x1d0 fs/open.c:1404 do_sys_open fs/open.c:1419 [inline] __do_sys_openat fs/open.c:1435 [inline] __se_sys_openat fs/open.c:1430 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1430 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f3ce59169a4 Code: 24 20 48 8d 44 24 30 48 89 44 24 28 64 8b 04 25 18 00 00 00 85 c0 75 2c 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 60 48 8b 15 55 a4 0d 00 f7 d8 64 89 02 48 83 RSP: 002b:00007ffe26b916e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3ce59169a4 RDX: 00000000000a0800 RSI: 0000560402b80300 RDI: 00000000ffffff9c RBP: 0000560402b80300 R08: 0000000000000008 R09: 8749a0e110c2809b R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000a0800 R13: 0000000200000001 R14: 0000560401f7ffee R15: 0000000000000000