INFO: task syz.0.352:7153 blocked for more than 143 seconds. Not tainted 6.14.0-rc4-syzkaller-00199-g76544811c850 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.352 state:D stack:24656 pid:7153 tgid:7149 ppid:5829 task_flags:0x400140 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0x18bc/0x4c40 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6857 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914 __mutex_lock_common kernel/locking/mutex.c:662 [inline] __mutex_lock+0x817/0x1010 kernel/locking/mutex.c:730 bdev_open+0xf0/0xc50 block/bdev.c:903 bdev_file_open_by_dev+0x1b0/0x220 block/bdev.c:1017 bdev_file_open_by_path+0x1f9/0x480 block/bdev.c:1040 btrfs_scan_one_device+0x45e/0xec0 fs/btrfs/volumes.c:1543 btrfs_get_tree_super fs/btrfs/super.c:1847 [inline] btrfs_get_tree+0x33b/0x1a30 fs/btrfs/super.c:2093 vfs_get_tree+0x90/0x2b0 fs/super.c:1814 fc_mount+0x1b/0xb0 fs/namespace.c:1271 btrfs_get_tree_subvol fs/btrfs/super.c:2051 [inline] btrfs_get_tree+0x6b1/0x1a30 fs/btrfs/super.c:2094 vfs_get_tree+0x90/0x2b0 fs/super.c:1814 do_new_mount+0x2be/0xb40 fs/namespace.c:3560 do_mount fs/namespace.c:3900 [inline] __do_sys_mount fs/namespace.c:4111 [inline] __se_sys_mount+0x2d6/0x3c0 fs/namespace.c:4088 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5a03b8d169 RSP: 002b:00007f5a049e0038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f5a03da6080 RCX: 00007f5a03b8d169 RDX: 0000400000000000 RSI: 0000400000000100 RDI: 0000400000000140 RBP: 00007f5a03c0e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f5a03da6080 R15: 00007ffea5bcbf68 Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6746 2 locks held by kworker/u8:2/35: #0: ffff88801eb3a948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801eb3a948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc90000ab7c60 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90000ab7c60 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 2 locks held by kworker/u8:3/51: 2 locks held by getty/5575: #0: ffff8880357320a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000331b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211 5 locks held by kworker/1:7/5896: #0: ffff88802228f948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88802228f948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc900043ffc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc900043ffc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 #2: ffff888028bc7190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline] #2: ffff888028bc7190 (&dev->mutex){....}-{4:4}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5861 #3: ffff8880602e4190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline] #3: ffff8880602e4190 (&dev->mutex){....}-{4:4}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 #4: ffff8880602e1160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline] #4: ffff8880602e1160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x8e/0x520 drivers/base/dd.c:1005 5 locks held by kworker/0:5/5905: #0: ffff88802228f948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88802228f948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc9000441fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000441fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 #2: ffff888145f0d190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline] #2: ffff888145f0d190 (&dev->mutex){....}-{4:4}, at: hub_event+0x1fe/0x5150 drivers/usb/core/hub.c:5861 #3: ffff888029c88510 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3220 [inline] #3: ffff888029c88510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5430 [inline] #3: ffff888029c88510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] #3: ffff888029c88510 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5833 [inline] #3: ffff888029c88510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x25b9/0x5150 drivers/usb/core/hub.c:5915 #4: ffff8880283c9668 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5431 [inline] #4: ffff8880283c9668 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5673 [inline] #4: ffff8880283c9668 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5833 [inline] #4: ffff8880283c9668 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x25f7/0x5150 drivers/usb/core/hub.c:5915 2 locks held by kworker/u8:9/6001: #0: ffff88801eb3a948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801eb3a948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319 #1: ffffc9000447fc60 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000447fc60 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319 1 lock held by udevd/6791: #0: ffff8881433764c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903 1 lock held by udevd/6793: #0: ffff888025bad4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903 1 lock held by udevd/6797: #0: ffff888025bab4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903 2 locks held by syz.0.352/7153: #0: ffffffff8f0c9508 (uuid_mutex){+.+.}-{4:4}, at: btrfs_get_tree_super fs/btrfs/super.c:1841 [inline] #0: ffffffff8f0c9508 (uuid_mutex){+.+.}-{4:4}, at: btrfs_get_tree+0x309/0x1a30 fs/btrfs/super.c:2093 #1: ffff8881433764c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903 1 lock held by syz.3.471/7571: #0: ffffffff8f0c9508 (uuid_mutex){+.+.}-{4:4}, at: btrfs_get_tree_super fs/btrfs/super.c:1841 [inline] #0: ffffffff8f0c9508 (uuid_mutex){+.+.}-{4:4}, at: btrfs_get_tree+0x309/0x1a30 fs/btrfs/super.c:2093 2 locks held by syz.1.482/7621: #0: ffff888033731470 (&fc->uapi_mutex){+.+.}-{4:4}, at: __do_sys_fsconfig fs/fsopen.c:465 [inline] #0: ffff888033731470 (&fc->uapi_mutex){+.+.}-{4:4}, at: __se_sys_fsconfig+0x9b2/0xf60 fs/fsopen.c:344 #1: ffffffff8f0c9508 (uuid_mutex){+.+.}-{4:4}, at: btrfs_get_tree_super fs/btrfs/super.c:1841 [inline] #1: ffffffff8f0c9508 (uuid_mutex){+.+.}-{4:4}, at: btrfs_get_tree+0x309/0x1a30 fs/btrfs/super.c:2093 1 lock held by syz.5.497/7668: #0: ffff888025bab4c8 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x1ae/0x340 block/bdev.c:1246 1 lock held by syz.5.497/7669: #0: ffff888025bab4c8 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x1ae/0x340 block/bdev.c:1246 5 locks held by syz.6.737/8612: #0: ffffffff8ff27190 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8ff27048 (genl_mutex){+.+.}-{4:4}, at: genl_lock net/netlink/genetlink.c:35 [inline] #1: ffffffff8ff27048 (genl_mutex){+.+.}-{4:4}, at: genl_op_lock net/netlink/genetlink.c:60 [inline] #1: ffffffff8ff27048 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x122/0xec0 net/netlink/genetlink.c:1209 #2: ffff888025d0d998 (&nbd->config_lock){+.+.}-{4:4}, at: nbd_genl_connect+0xc26/0x1c80 drivers/block/nbd.c:2111 #3: ffff88814336b7c8 (&q->q_usage_counter(io)#55){+.+.}-{0:0}, at: blk_mq_freeze_queue include/linux/blk-mq.h:920 [inline] #3: ffff88814336b7c8 (&q->q_usage_counter(io)#55){+.+.}-{0:0}, at: nbd_add_socket+0x1fa/0xad0 drivers/block/nbd.c:1251 #4: ffff88814336b800 (&q->q_usage_counter(queue)#39){+.+.}-{0:0}, at: blk_mq_freeze_queue include/linux/blk-mq.h:920 [inline] #4: ffff88814336b800 (&q->q_usage_counter(queue)#39){+.+.}-{0:0}, at: nbd_add_socket+0x1fa/0xad0 drivers/block/nbd.c:1251 4 locks held by syz.6.737/8620: #0: ffffffff8f7a51b0 (minor_rwsem#2){++++}-{4:4}, at: usb_open+0x30/0x1d0 drivers/usb/core/file.c:38 #1: ffff8880617c7878 (&hiddev->existancelock){+.+.}-{4:4}, at: hiddev_open+0xa4/0x5c0 drivers/hid/usbhid/hiddev.c:301 #2: ffff88803353de20 (&hdev->ll_open_lock){+.+.}-{4:4}, at: hid_hw_open+0x28/0x170 drivers/hid/hid-core.c:2387 #3: ffffffff8e815708 (rename_lock.seqcount){+.+.}-{0:0}, at: read_seqbegin include/linux/seqlock.h:836 [inline] #3: ffffffff8e815708 (rename_lock.seqcount){+.+.}-{0:0}, at: read_seqbegin_or_lock include/linux/seqlock.h:1130 [inline] #3: ffffffff8e815708 (rename_lock.seqcount){+.+.}-{0:0}, at: prepend_path+0x2c2/0xd00 fs/d_path.c:171 3 locks held by syz.4.738/8613: #0: ffff88805f482008 (&sb->s_type->i_mutex_key#9){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:877 [inline] #0: ffff88805f482008 (&sb->s_type->i_mutex_key#9){+.+.}-{4:4}, at: __sock_release net/socket.c:646 [inline] #0: ffff88805f482008 (&sb->s_type->i_mutex_key#9){+.+.}-{4:4}, at: sock_close+0x90/0x240 net/socket.c:1398 #1: ffff88802a774258 (sk_lock-AF_CAIF){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1624 [inline] #1: ffff88802a774258 (sk_lock-AF_CAIF){+.+.}-{0:0}, at: caif_release+0x104/0x370 net/caif/caif_socket.c:914 #2: ffffffff8eb3e478 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:334 [inline] #2: ffffffff8eb3e478 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x451/0x820 kernel/rcu/tree_exp.h:996 1 lock held by syz.4.738/8614: #0: ffffffff8fec63c8 (bpf_dispatcher_xdp.mutex){+.+.}-{4:4}, at: bpf_dispatcher_change_prog+0xa0/0xf20 kernel/bpf/dispatcher.c:146 2 locks held by syz.4.738/8615: #0: ffff888033714258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1624 [inline] #0: ffff888033714258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_setsockopt+0x76d/0x1870 net/packet/af_packet.c:3872 #1: ffffffff8eb3e478 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:334 [inline] #1: ffffffff8eb3e478 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x451/0x820 kernel/rcu/tree_exp.h:996 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.14.0-rc4-syzkaller-00199-g76544811c850 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline] watchdog+0x1058/0x10a0 kernel/hung_task.c:399 kthread+0x7a9/0x920 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:48 [inline] NMI backtrace for cpu 0 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:106 [inline] NMI backtrace for cpu 0 skipped: idling at acpi_safe_halt+0x21/0x30 drivers/acpi/processor_idle.c:111