INFO: task syz.6.484:9835 blocked for more than 143 seconds. Not tainted 6.14.0-rc6-syzkaller-00022-gb7f94fcf5546 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.6.484 state:D stack:26016 pid:9835 tgid:9798 ppid:8781 task_flags:0x400140 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x18bc/0x4c40 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 inode_lock include/linux/fs.h:877 [inline] process_measurement+0x439/0x1fb0 security/integrity/ima/ima_main.c:250 ima_file_check+0xd9/0x120 security/integrity/ima/ima_main.c:603 security_file_post_open+0xb9/0x280 security/security.c:3130 do_open fs/namei.c:3832 [inline] path_openat+0x2cca/0x3590 fs/namei.c:3989 do_filp_open+0x27f/0x4e0 fs/namei.c:4016 do_sys_openat2+0x13e/0x1d0 fs/open.c:1428 do_sys_open fs/open.c:1443 [inline] __do_sys_open fs/open.c:1451 [inline] __se_sys_open fs/open.c:1447 [inline] __x64_sys_open+0x225/0x270 fs/open.c:1447 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faa6378d169 RSP: 002b:00007faa64548038 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 00007faa639a6080 RCX: 00007faa6378d169 RDX: 0000000000000000 RSI: 000000000014927e RDI: 0000400000000180 RBP: 00007faa6380e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007faa639a6080 R15: 00007ffcce59cd38 Showing all locks held in the system: 3 locks held by kworker/u8:0/12: #0: ffff88801b089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801b089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc90000117c60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90000117c60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 #2: ffffffff8fec4508 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:285 1 lock held by khungtaskd/31: #0: ffffffff8eb393e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8eb393e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8eb393e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6746 3 locks held by kworker/u8:2/36: #0: ffff888147aa0948 ((wq_completion)cfg80211){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff888147aa0948 ((wq_completion)cfg80211){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc90000ac7c60 ((work_completion)(&(&rdev->dfs_update_channels_wk)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90000ac7c60 ((work_completion)(&(&rdev->dfs_update_channels_wk)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 #2: ffffffff8fec4508 (rtnl_mutex){+.+.}-{4:4}, at: cfg80211_dfs_channels_update_work+0xbf/0x610 net/wireless/mlme.c:1022 6 locks held by kworker/u8:3/53: #0: ffff88801bef3948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801bef3948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc90000bd7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90000bd7c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 #2: ffffffff8feb7cd0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x17a/0xd60 net/core/net_namespace.c:606 #3: ffffffff8fec4508 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x55/0x2c0 net/mac80211/main.c:1674 #4: ffff8880699a0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline] #4: ffff8880699a0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x129/0x700 net/mac80211/iface.c:2281 #5: ffffffff8eb3e8b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:302 [inline] #5: ffffffff8eb3e8b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x381/0x820 kernel/rcu/tree_exp.h:996 5 locks held by kworker/u8:6/1138: 3 locks held by kworker/u8:9/3451: #0: ffff8880317d8148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff8880317d8148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc9000cb17c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000cb17c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 #2: ffffffff8fec4508 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline] #2: ffffffff8fec4508 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x10e/0x16a0 net/ipv6/addrconf.c:4190 3 locks held by kworker/u8:10/3503: 2 locks held by getty/5576: #0: ffff8880322730a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/9588: #0: ffff8880b863e7d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598 2 locks held by syz.6.484/9799: #0: ffff88802a62e420 (sb_writers#22){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:3035 [inline] #0: ffff88802a62e420 (sb_writers#22){.+.+}-{0:0}, at: vfs_fallocate+0x59d/0x7a0 fs/open.c:337 #1: ffff888058723670 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: inode_lock include/linux/fs.h:877 [inline] #1: ffff888058723670 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: bch2_fallocate_dispatch+0x1e2/0x540 fs/bcachefs/fs-io.c:801 2 locks held by syz.6.484/9835: #0: ffff88802a62e420 (sb_writers#22){.+.+}-{0:0}, at: mnt_want_write+0x3f/0x90 fs/namespace.c:547 #1: ffff888058723670 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: inode_lock include/linux/fs.h:877 [inline] #1: ffff888058723670 (&sb->s_type->i_mutex_key#28){++++}-{4:4}, at: process_measurement+0x439/0x1fb0 security/integrity/ima/ima_main.c:250 2 locks held by syz-executor/12861: #0: ffffffff903c18e0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff903c18e0 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff903c18e0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x22/0x250 net/core/rtnetlink.c:564 #1: ffffffff8fec4508 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #1: ffffffff8fec4508 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:335 [inline] #1: ffffffff8fec4508 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc55/0x1d30 net/core/rtnetlink.c:4021 1 lock held by udevadm/12987: 5 locks held by rm/13006: #0: ffff8880b863e7d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598 #1: ffff8880b8628948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x41d/0x7a0 kernel/sched/psi.c:987 #2: ffff888030cf57f8 (&sig->wait_chldexit){....}-{3:3}, at: __wake_up_common_lock+0x25/0x1e0 kernel/sched/wait.c:105 #3: ffff888030d72828 (&p->pi_lock){-.-.}-{2:2}, at: class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] #3: ffff888030d72828 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4214 #4: ffff8880b8628948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_change+0xed/0x270 kernel/sched/psi.c:912 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-rc6-syzkaller-00022-gb7f94fcf5546 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline] watchdog+0x1058/0x10a0 kernel/hung_task.c:399 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 9695 Comm: syz-executor Not tainted 6.14.0-rc6-syzkaller-00022-gb7f94fcf5546 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:__kasan_check_write+0x0/0x20 mm/kasan/shadow.c:36 Code: 48 8b 0c 24 31 d2 e9 ef e6 ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 89 f6 48 8b 0c 24 ba 01 00 00 00 e9 bc e6 ff ff 66 2e RSP: 0018:ffffc90000a28ac0 EFLAGS: 00000082 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff888026913c00 RDX: 0000000000000100 RSI: 0000000000000008 RDI: ffff88806013d7e0 RBP: ffff88803157f007 R08: ffffffff818a6b76 R09: 1ffff1100c027afc R10: dffffc0000000000 R11: ffffed100c027afd R12: 0000000000000002 R13: ffff88806013d7e0 R14: 1ffff1100c027afc R15: ffff88803157f068 FS: 000055558a9b1500(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d101766b91 CR3: 000000007124c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: instrument_atomic_write include/linux/instrumented.h:82 [inline] atomic_long_set include/linux/atomic/atomic-instrumented.h:3223 [inline] set_work_data kernel/workqueue.c:789 [inline] set_work_pwq kernel/workqueue.c:795 [inline] insert_work+0xbd/0x330 kernel/workqueue.c:2186 __queue_work+0xc62/0x1090 kernel/workqueue.c:2345 call_timer_fn+0x187/0x650 kernel/time/timer.c:1789 expire_timers kernel/time/timer.c:1835 [inline] __run_timers kernel/time/timer.c:2414 [inline] __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2426 run_timer_base kernel/time/timer.c:2435 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2445 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2061 [inline] RIP: 0010:vprintk_emit+0x700/0xa10 kernel/printk/printk.c:2431 Code: 00 e8 44 31 21 00 4c 8d bc 24 a0 00 00 00 4d 85 e4 75 07 e8 32 31 21 00 eb 06 e8 2b 31 21 00 fb 49 bc 00 00 00 00 00 fc ff df <48> c7 c7 a0 4f a1 8e 31 f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00 RSP: 0018:ffffc90003f2f960 EFLAGS: 00000293 RAX: ffffffff81a0ad85 RBX: 0000000000000000 RCX: ffff888026913c00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003f2fa70 R08: ffffffff81a0ad5e R09: 1ffffffff28a2f2e R10: dffffc0000000000 R11: fffffbfff28a2f2f R12: dffffc0000000000 R13: 1ffff920007e5f30 R14: ffffffff81a0abc0 R15: ffffc90003f2fa00 _printk+0xd5/0x120 kernel/printk/printk.c:2457 lmLogSync+0x7b7/0xae0 fs/jfs/jfs_logmgr.c:985 jfs_syncpt+0x7d/0xa0 fs/jfs/jfs_logmgr.c:1041 jfs_sync_fs+0x8a/0xa0 fs/jfs/super.c:650 sync_filesystem+0xed/0x230 fs/sync.c:56 generic_shutdown_super+0x72/0x2d0 fs/super.c:621 kill_block_super+0x44/0x90 fs/super.c:1710 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1413 task_work_run+0x24f/0x310 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f373a38e497 Code: a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 0f 1f 44 00 00 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 RSP: 002b:00007fff468f7d58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007f373a40e08c RCX: 00007f373a38e497 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff468f7e10 RBP: 00007fff468f7e10 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff468f8ea0 R13: 00007f373a40e08c R14: 00000000000755d2 R15: 00007fff468f8ee0