Hello, We found the following issue using syzkaller on Linux v6.10. In function `gsm_cleanup_mux`, the kernel hangs when waiting for `dlci->state` to become `DLCI_CLOSED`. It seems that `gsm_dlci_begin_close` failed to close the dlci. The full report including the Syzkaller reproducer: https://gist.github.com/TomAPU/38bb00292b33d52a6dd2d1b629247146 The brief report is below: INFO: task syz.1.466:13387 blocked for more than 143 seconds. Not tainted 6.10.0 #13 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.466 state:D stack:27400 pid:13387 tgid:13304 ppid:8048 flags:0x00004004 Call Trace: <TASK> context_switch kernel/sched/core.c:5407 [inline] __schedule+0xf4a/0x15e0 kernel/sched/core.c:6748 __schedule_loop kernel/sched/core.c:6825 [inline] schedule+0x143/0x310 kernel/sched/core.c:6840 gsm_cleanup_mux+0x344/0x930 drivers/tty/n_gsm.c:3136 gsm_config drivers/tty/n_gsm.c:3408 [inline] gsmld_ioctl+0x13c4/0x2540 drivers/tty/n_gsm.c:3839 tty_ioctl+0x98f/0xdb0 drivers/tty/tty_io.c:2812 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfe/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x7e/0x150 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7fafaef809b9 RSP: 002b:00007fafafe0a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fafaf146130 RCX: 00007fafaef809b9 RDX: 0000000020000100 RSI: 00000000404c4701 RDI: 0000000000000004 RBP: 00007fafaeff4f70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007fafaf146130 R15: 00007ffd1b6e06a8 </TASK> Showing all locks held in the system: 1 lock held by khungtaskd/25: #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x54/0x2d0 kernel/locking/lockdep.c:6614 1 lock held by systemd-journal/4495: 1 lock held by systemd-udevd/4507: 1 lock held by in:imklog/7662: 2 locks held by agetty/7949: #0: ffff88802e7850a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900040dc2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x712/0x1e80 drivers/tty/n_tty.c:2211 2 locks held by syz-executor/8032: 2 locks held by syz.1.466/13387: #0: ffff8880285170a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:243 #1: ffff8880193520b0 (&gsm->mutex){+.+.}-{3:3}, at: gsm_cleanup_mux+0xb7/0x930 drivers/tty/n_gsm.c:3130 1 lock held by syz.1.796/18097: 2 locks held by syz-executor/18310: 1 lock held by systemd-sysctl/18525: 1 lock held by syz.0.834/18561: #0: ffff888020337398 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable+0x18/0x60 include/linux/mmap_lock.h:153 2 locks held by syz.0.834/18562: #0: ffff888020337398 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:122 [inline] #0: ffff888020337398 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x173/0x3a0 mm/util.c:571 #1: ffffffff8db383f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #1: ffffffff8db383f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x37c/0x810 kernel/rcu/tree_exp.h:939
