INFO: task syz.0.2255:11469 blocked for more than 430 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.2255 state:D stack:0 pid:11469 tgid:11469 ppid:3201 task_flags:0x400040 flags:0x00000003 Call Trace: [] context_switch kernel/sched/core.c:5325 [inline] [] __schedule+0x1042/0x4114 kernel/sched/core.c:6929 [] __schedule_loop kernel/sched/core.c:7011 [inline] [] schedule+0xc4/0x35e kernel/sched/core.c:7026 [] request_wait_answer+0x472/0x670 fs/fuse/dev.c:585 [] __fuse_request_send fs/fuse/dev.c:599 [inline] [] __fuse_simple_request+0x480/0xcea fs/fuse/dev.c:693 [] fuse_simple_request fs/fuse/fuse_i.h:1250 [inline] [] fuse_flush+0x454/0x5e4 fs/fuse/file.c:482 [] filp_flush+0xfe/0x19a fs/open.c:1549 [] filp_close+0x20/0x36 fs/open.c:1562 [] __range_close fs/file.c:767 [inline] [] __do_sys_close_range fs/file.c:826 [inline] [] __se_sys_close_range fs/file.c:790 [inline] [] __riscv_sys_close_range+0x3bc/0x77c fs/file.c:790 [] syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112 [] do_trap_ecall_u+0x39e/0x53a arch/riscv/kernel/traps.c:343 [] handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232 Showing all locks held in the system: 1 lock held by khungtaskd/33: #0: ffffffff885df920 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2a/0x1a0 kernel/locking/lockdep.c:6771 1 lock held by syslogd/3009: 2 locks held by getty/3156: #0: ffffaf801c0900a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3a/0x46 drivers/tty/tty_ldsem.c:340 #1: ffff8f800008e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x3e4/0x12b6 drivers/tty/n_tty.c:2222 2 locks held by syz-executor/3189: 3 locks held by kworker/u8:6/10195: 2 locks held by kworker/u8:4/10634: #0: ffffaf806ecec198 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:638 [inline] #0: ffffaf806ecec198 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1547 [inline] #0: ffffaf806ecec198 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1869 [inline] #0: ffffaf806ecec198 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x310/0x4114 kernel/sched/core.c:6833 #1: ffffaf806ecd6610 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:220 [inline] #1: ffffaf806ecd6610 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1408/0x4114 kernel/sched/core.c:6923 3 locks held by kworker/u8:9/11058: 3 locks held by kworker/1:4/11840: 2 locks held by kworker/0:6/11929: 2 locks held by syz.4.2265/11930: 1 lock held by syz.3.2308/11933: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:149 [] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:155 [] __dump_stack lib/dump_stack.c:94 [inline] [] dump_stack_lvl+0x12a/0x1a2 lib/dump_stack.c:120 [] dump_stack+0x1c/0x24 lib/dump_stack.c:129 [] nmi_cpu_backtrace+0x3b0/0x3b2 lib/nmi_backtrace.c:113 [] nmi_trigger_cpumask_backtrace+0x2b6/0x45a lib/nmi_backtrace.c:62 [] arch_trigger_cpumask_backtrace+0x2c/0x3e arch/riscv/kernel/smp.c:350 [] trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline] [] watchdog+0xf58/0x11ac kernel/hung_task.c:495 [] kthread+0x39c/0x7d6 kernel/kthread.c:463 [] ret_from_fork_kernel+0x2a/0xbc6 arch/riscv/kernel/process.c:228 [] ret_from_fork_kernel_asm+0x16/0x18 arch/riscv/kernel/entry.S:363 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 11930 Comm: syz.4.2265 Not tainted syzkaller #0 PREEMPT Hardware name: riscv-virtio,qemu (DT) epc : __sanitizer_cov_trace_const_cmp1+0x14/0x1c kernel/kcov.c:302 ra : __sanitizer_cov_trace_const_cmp1+0x14/0x1c kernel/kcov.c:300 epc : ffffffff80504a90 ra : ffffffff80504a90 sp : ffff8f8001fe7420 gp : ffffffff89ede020 tp : ffffaf8018de9a80 t0 : ffff8f8001fe7790 t1 : 0000000000000001 t2 : 0000000026b45c5f s0 : ffff8f8001fe7430 s1 : ffff8d8000a66fc0 a0 : 0000000000000001 a1 : 0000000000000000 a2 : 0000000000000000 a3 : ffffffff80bfdfe0 a4 : 0000000000000000 a5 : ffffaf8018deaa80 a6 : 0000000000000003 a7 : ffffffff80bfee80 s2 : ffffaf8000000000 s3 : 0000000000000000 s4 : 0000020000000000 s5 : ffffffff88030378 s6 : 0000000000000000 s7 : ffffffffdfffffff s8 : ffffffff88030340 s9 : 1ffffffff13fe954 s10: ffffffff89ff4aa0 s11: ffff8f8001fe7b20 t3 : 02a17aca00000000 t4 : 0000000000001fff t5 : 00000000000000c8 t6 : 0000000000000002 ssp : 0000000000000000 status: 0000000200000120 badaddr: 0000000000000000 cause: 8000000000000001 [] __sanitizer_cov_trace_const_cmp1+0x14/0x1c kernel/kcov.c:300 [] lookup_page_ext+0x82/0x294 mm/page_ext.c:250 [] page_ext_lookup+0x11a/0x154 mm/page_ext.c:509 [] page_ext_iter_begin include/linux/page_ext.h:132 [inline] [] page_table_check_clear+0x5e6/0xe60 mm/page_table_check.c:78 [] __page_table_check_pte_clear+0x114/0x16c mm/page_table_check.c:154 [] page_table_check_pte_clear include/linux/page_table_check.h:51 [inline] [] ptep_get_and_clear arch/riscv/include/asm/pgtable.h:610 [inline] [] ptep_get_and_clear_full include/linux/pgtable.h:696 [inline] [] get_and_clear_full_ptes include/linux/pgtable.h:725 [inline] [] zap_present_folio_ptes mm/memory.c:1627 [inline] [] zap_present_ptes mm/memory.c:1709 [inline] [] do_zap_pte_range mm/memory.c:1810 [inline] [] zap_pte_range mm/memory.c:1854 [inline] [] zap_pmd_range mm/memory.c:1946 [inline] [] zap_pud_range mm/memory.c:1975 [inline] [] zap_p4d_range mm/memory.c:1996 [inline] [] unmap_page_range+0x1a2a/0x374a mm/memory.c:2017 [] unmap_single_vma.constprop.0+0x13c/0x232 mm/memory.c:2060 [] unmap_vmas+0x1e8/0x40a mm/memory.c:2104 [] exit_mmap+0x18c/0xd00 mm/mmap.c:1280 [] __mmput+0x108/0x3c0 kernel/fork.c:1133 [] mmput+0x74/0x88 kernel/fork.c:1156 [] exit_mm kernel/exit.c:582 [inline] [] do_exit+0x7ba/0x28e4 kernel/exit.c:954 [] do_group_exit+0xd4/0x26c kernel/exit.c:1107 [] __do_sys_exit_group kernel/exit.c:1118 [inline] [] __se_sys_exit_group kernel/exit.c:1116 [inline] [] __riscv_sys_exit_group+0x4a/0x54 kernel/exit.c:1116 [] syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112 [] do_trap_ecall_u+0x39e/0x53a arch/riscv/kernel/traps.c:343 [] handle_exception+0x15e/0x16a arch/riscv/kernel/entry.S:232