INFO: task syz.0.55:5108 blocked for more than 144 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.55 state:D stack:0 pid:5108 tgid:5108 ppid:4714 task_flags:0x400040 flags:0x00800401 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5533 [inline] __schedule+0x135c/0x2b00 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7376 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x5d4/0x1078 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 device_lock include/linux/device.h:1104 [inline] usbdev_release+0x74/0x38c drivers/usb/core/devio.c:1099 __fput+0x338/0x74c fs/file_table.c:512 ____fput+0x20/0x30 fs/file_table.c:540 task_work_run+0x1cc/0x25c kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:146 [inline] el0_svc+0x12c/0x1d8 arch/arm64/kernel/entry-common.c:797 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 Showing all locks held in the system: locks held by ksoftirqd/0/15: 7, last CPU#0: #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x4ec/0x14e0 net/core/dev.c:6727 #1: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: ip6_input+0x40/0x29c net/ipv6/ip6_input.c:544 #2: ffff0000cc711da8 (slock-AF_INET6){+.-.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #2: ffff0000cc711da8 (slock-AF_INET6){+.-.}-{3:3}, at: sctp_rcv+0xc94/0x13cc net/sctp/input.c:218 #3: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: sctp_v6_xmit+0x514/0x1030 net/sctp/ipv6.c:247 #4: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #4: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #4: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: ip6_xmit+0x254/0x16c8 net/ipv6/ip6_output.c:307 #5: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #5: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #5: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x114/0x528 net/ipv6/ip6_output.c:236 #6: ffff800088c419c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #6: ffff800088c419c0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:905 [inline] #6: ffff800088c419c0 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x220/0x2a9c net/core/dev.c:4844 locks held by kworker/1:0/24: 5, on CPU#1: #0: ffff0000c2408140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline] #0: ffff0000c2408140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3479 #1: ffff80008ec97c20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline] #1: ffff80008ec97c20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3479 #2: ffff0000c60a21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #2: ffff0000c60a21d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x128/0x39fc drivers/usb/core/hub.c:5912 #3: ffff0000c60a6578 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3265 [inline] #3: ffff0000c60a6578 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5477 [inline] #3: ffff0000c60a6578 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] #3: ffff0000c60a6578 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5884 [inline] #3: ffff0000c60a6578 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x191c/0x39fc drivers/usb/core/hub.c:5966 #4: ffff0000ca64a460 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5478 [inline] #4: ffff0000ca64a460 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] #4: ffff0000ca64a460 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5884 [inline] #4: ffff0000ca64a460 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x1948/0x39fc drivers/usb/core/hub.c:5966 locks held by khungtaskd/31: 1, last CPU#1: #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x4c/0x188 kernel/locking/lockdep.c:6871 locks held by udevd/4341: 1, last CPU#1: #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: sock_def_readable+0xdc/0x5d0 net/core/sock.c:3665 locks held by getty/4490: 2, on CPU#0: #0: ffff0000ce0000a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff80009243b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x348/0xf78 drivers/tty/n_tty.c:2211 locks held by udevd/4929: 2, last CPU#1: #0: ffff0000cfba6460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x44/0x9c fs/namespace.c:494 #1: ffff0000db8714a0 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #1: ffff0000db8714a0 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: lookup_open+0x1cc/0x1180 fs/namei.c:4458 locks held by syz.0.55/5108: 1, on CPU#1: #0: ffff0000c60a21d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #0: ffff0000c60a21d8 (&dev->mutex){....}-{4:4}, at: usbdev_release+0x74/0x38c drivers/usb/core/devio.c:1099 locks held by kworker/u8:23/6603: 3, last CPU#1: #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline] #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3479 #1: ffff80009ac47c20 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline] #1: ffff80009ac47c20 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3479 #2: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffff800088c41960 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x210/0x144c net/netfilter/nf_conntrack_core.c:1532 locks held by kworker/u8:28/6808: 2, last CPU#1: #0: ffff0000c004c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline] #0: ffff0000c004c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3479 #1: ffff800098317c20 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3371 [inline] #1: ffff800098317c20 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3479 locks held by syz.7.1096/10290: 1, last CPU#1: #0: ffff0000ca245078 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline] #0: ffff0000ca245078 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x228/0x9bc mm/mmap.c:1323 locks held by syz.2.1101/10312: 1, on CPU#1: #0: ffff800088c46eb8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x58/0x4ec kernel/rcu/tree.c:3904 locks held by syz.0.1103/10325: 1, on CPU#1: #0: ffff0000d05862b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x100/0x144 fs/file.c:1259 locks held by syz.0.1103/10326: 4, last CPU#1: #0: ffff0000d05862b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x100/0x144 fs/file.c:1259 #1: ffff0000cf746460 (sb_writers#19){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline] #1: ffff0000cf746460 (sb_writers#19){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #2: ffff0000ee6b0920 (&sb->s_type->i_mutex_key#29){++++}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #2: ffff0000ee6b0920 (&sb->s_type->i_mutex_key#29){++++}-{4:4}, at: generic_file_write_iter+0x84/0x2c0 mm/filemap.c:4514 #3: ffff800088d4a2e0 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline] #3: ffff800088d4a2e0 (fs_reclaim){+.+.}-{0:0}, at: prepare_alloc_pages+0x13c/0x484 mm/page_alloc.c:5113 locks held by dhcpcd-run-hook/10333: 2, last CPU#1: #0: ffff0000cc7e85e8 (&sig->cred_guard_mutex){+.+.}-{4:4}, at: prepare_bprm_creds fs/exec.c:1423 [inline] #0: ffff0000cc7e85e8 (&sig->cred_guard_mutex){+.+.}-{4:4}, at: bprm_execve+0xac/0x11e8 fs/exec.c:1846 #1: ffff800088f90db8 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #1: ffff800088f90db8 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #1: ffff800088f90db8 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1112 [inline] #1: ffff800088f90db8 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_bprm_check_security+0xfc/0x170 security/tomoyo/tomoyo.c:101 =============================================