INFO: task syz.0.309:5318 blocked for more than 430 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.309 state:D stack:0 pid:5318 tgid:5316 ppid:3223 task_flags:0x400140 flags:0x00000002 Call Trace: [] context_switch kernel/sched/core.c:5510 [inline] [] __schedule+0x1de4/0x4ff4 kernel/sched/core.c:7234 [] __schedule_loop kernel/sched/core.c:7311 [inline] [] schedule+0xae/0x260 kernel/sched/core.c:7326 [] do_uevent+0x432/0x5d4 fs/dlm/lockspace.c:206 [] new_lockspace fs/dlm/lockspace.c:583 [inline] [] __dlm_new_lockspace+0x157c/0x1f9e fs/dlm/lockspace.c:638 [] dlm_new_user_lockspace+0x62/0x8c fs/dlm/lockspace.c:671 [] device_create_lockspace fs/dlm/user.c:414 [inline] [] device_write+0x868/0x1a40 fs/dlm/user.c:606 [] vfs_write+0x308/0x1020 fs/read_write.c:685 [] ksys_write+0x126/0x244 fs/read_write.c:739 [] __do_sys_write fs/read_write.c:750 [inline] [] __se_sys_write fs/read_write.c:747 [inline] [] __riscv_sys_write+0x6e/0xa0 fs/read_write.c:747 [] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 [] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345 [] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237 INFO: task syz.0.309:5321 blocked for more than 430 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.309 state:D stack:0 pid:5321 tgid:5316 ppid:3223 task_flags:0x400140 flags:0x00000002 Call Trace: [] context_switch kernel/sched/core.c:5510 [inline] [] __schedule+0x1de4/0x4ff4 kernel/sched/core.c:7234 [] __schedule_loop kernel/sched/core.c:7311 [inline] [] schedule+0xae/0x260 kernel/sched/core.c:7326 [] schedule_preempt_disabled+0x16/0x28 kernel/sched/core.c:7383 [] __mutex_lock_common kernel/locking/mutex.c:726 [inline] [] __mutex_lock+0xb92/0x192e kernel/locking/mutex.c:821 [] mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:874 [] dlm_release_lockspace+0x118/0xdce fs/dlm/lockspace.c:808 [] device_remove_lockspace fs/dlm/user.c:461 [inline] [] device_write+0x94a/0x1a40 fs/dlm/user.c:614 [] vfs_write+0x308/0x1020 fs/read_write.c:685 [] ksys_write+0x126/0x244 fs/read_write.c:739 [] __do_sys_write fs/read_write.c:750 [inline] [] __se_sys_write fs/read_write.c:747 [inline] [] __riscv_sys_write+0x6e/0xa0 fs/read_write.c:747 [] syscall_handler+0x92/0x114 arch/riscv/include/asm/syscall.h:112 [] do_trap_ecall_u+0x3e4/0x636 arch/riscv/kernel/traps.c:345 [] handle_exception+0x168/0x174 arch/riscv/kernel/entry.S:237 Showing all locks held in the system: 1 lock held by khungtaskd/32: #0: ffffffff889f4020 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff889f4020 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3e/0x1a0 kernel/locking/lockdep.c:6775 2 locks held by kworker/u8:8/990: #0: ffffaf801211c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1068/0x20a0 kernel/workqueue.c:3297 #1: ffff8f8002107b50 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x826/0x20a0 kernel/workqueue.c:3298 1 lock held by klogd/3035: 2 locks held by getty/3188: #0: ffffaf8012fac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3a/0x46 drivers/tty/tty_ldsem.c:340 #1: ffff8f800008e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x3be/0x12fc drivers/tty/n_tty.c:2211 2 locks held by syz-executor/3216: 2 locks held by kworker/0:3/3219: 4 locks held by kworker/1:6/3933: 4 locks held by kworker/u8:5/4665: #0: ffffaf80126c8940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1068/0x20a0 kernel/workqueue.c:3297 #1: ffff8f800bf27b50 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x826/0x20a0 kernel/workqueue.c:3298 #2: ffffffff8a041860 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x22/0x2a net/core/rtnetlink.c:80 #3: ffffaf803403c530 (&idev->mc_lock){+.+.}-{4:4}, at: __ipv6_dev_mc_inc+0x4c/0xdae net/ipv6/mcast.c:943 1 lock held by syz.0.309/5318: #0: ffffffff916f0bc0 (&ls_lock){+.+.}-{4:4}, at: __dlm_new_lockspace+0xbe/0x1f9e fs/dlm/lockspace.c:632 1 lock held by syz.0.309/5321: #0: ffffffff916f0bc0 (&ls_lock){+.+.}-{4:4}, at: dlm_release_lockspace+0x118/0xdce fs/dlm/lockspace.c:808 1 lock held by dlm_recoverd/5322: #0: ffffaf8032008a18 (&ls->ls_in_recovery){+.+.}-{4:4}, at: dlm_recoverd+0xc6/0x24a8 fs/dlm/recoverd.c:400 2 locks held by syz-executor/5356: 3 locks held by kworker/u8:3/5388: 3 locks held by kworker/u8:6/5402: 4 locks held by kworker/u8:0/5831: 1 lock held by cmp/5842: 3 locks held by modprobe/5843: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:149 [] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:155 [] __dump_stack lib/dump_stack.c:94 [inline] [] dump_stack_lvl+0x114/0x1aa lib/dump_stack.c:120 [] dump_stack+0x1c/0x24 lib/dump_stack.c:129 [] nmi_cpu_backtrace+0x25e/0x3ae lib/nmi_backtrace.c:122 [] nmi_trigger_cpumask_backtrace+0x2ac/0x4ee lib/nmi_backtrace.c:65 [] arch_trigger_cpumask_backtrace+0x2c/0x3e arch/riscv/kernel/smp.c:349 [] trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] [] __sys_info lib/sys_info.c:157 [inline] [] sys_info+0x20c/0x252 lib/sys_info.c:165 [] check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] [] watchdog+0xa26/0x1282 kernel/hung_task.c:561 [] kthread+0x312/0x438 kernel/kthread.c:436 [] ret_from_fork_kernel+0x94/0xef6 arch/riscv/kernel/process.c:230 [] ret_from_fork_kernel_asm+0x16/0x18 arch/riscv/kernel/entry.S:368 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5315 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT Hardware name: riscv-virtio,qemu (DT) Workqueue: events_unbound nsim_dev_trap_report_work epc : __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline] epc : _raw_spin_unlock_irqrestore+0x36/0xc0 kernel/locking/spinlock.c:198 ra : __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline] ra : _raw_spin_unlock_irqrestore+0x7c/0xc0 kernel/locking/spinlock.c:198 epc : ffffffff86547c4e ra : ffffffff86547c94 sp : ffff8f80031d75c0 gp : ffffffff8a4a7c60 tp : ffffaf801d1b0000 t0 : ffff8f80031d77e0 t1 : ffffffff8007bc8e t2 : 0000000000000edc s0 : ffff8f80031d75e0 s1 : 0000000000000002 a0 : 0000000000000001 a1 : ffffffff88216318 a2 : 0000000000000006 a3 : 0000000000000001 a4 : 0000000000001000 a5 : 0000000000000000 a6 : 0000000000000003 a7 : 0000000041b58ab3 s2 : ffffffff9175d580 s3 : 0000000000000000 s4 : 0000000000000003 s5 : dead000000000100 s6 : dfffffff00000000 s7 : ffffaf803aa78000 s8 : ffffaf803aa78000 s9 : ffffaf803aa78000 s10: 0000000000000000 s11: ffffaf803aa79000 t3 : ffffffff8809bec8 t4 : fffffffef22ebab0 t5 : fffffffef22ebab1 t6 : 0000000000000002 ssp : 0000000000000000 status: 0000000200000120 badaddr: 0000000000000000 cause: 8000000000000001 [] arch_local_irq_restore arch/riscv/include/asm/irqflags.h:51 [inline] [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline] [] _raw_spin_unlock_irqrestore+0x36/0xc0 kernel/locking/spinlock.c:198 [] __debug_check_no_obj_freed lib/debugobjects.c:1180 [inline] [] debug_check_no_obj_freed+0x276/0x578 lib/debugobjects.c:1201 [] slab_free_hook mm/slub.c:2608 [inline] [] slab_free mm/slub.c:6377 [inline] [] kfree+0x486/0x76c mm/slub.c:6692 [] skb_kfree_head net/core/skbuff.c:1083 [inline] [] skb_free_head+0x1cc/0x234 net/core/skbuff.c:1095 [] skb_release_data+0x5d4/0x786 net/core/skbuff.c:1122 [] skb_release_all net/core/skbuff.c:1197 [inline] [] __kfree_skb net/core/skbuff.c:1211 [inline] [] consume_skb net/core/skbuff.c:1445 [inline] [] consume_skb+0xca/0x126 net/core/skbuff.c:1439 [] nsim_dev_trap_report drivers/net/netdevsim/dev.c:892 [inline] [] nsim_dev_trap_report_work+0x7d4/0xbe8 drivers/net/netdevsim/dev.c:922 [] process_one_work+0x90a/0x20a0 kernel/workqueue.c:3322 [] process_scheduled_works kernel/workqueue.c:3405 [inline] [] worker_thread+0x532/0xcaa kernel/workqueue.c:3486 [] kthread+0x312/0x438 kernel/kthread.c:436 [] ret_from_fork_kernel+0x94/0xef6 arch/riscv/kernel/process.c:230 [] ret_from_fork_kernel_asm+0x16/0x18 arch/riscv/kernel/entry.S:368