Hello, We found the following issue using syzkaller on Linux v6.10. In `tty_release_struct` the task hung when trying to acquire the lock `tty_mutex` Although Syzbot has found a similar bug (https://syzkaller.appspot.com/bug?id=032fedbb29b936d9b3f5b03409cee10ad9caee9b) , the bug we discovered can be triggered on Linux v6.10. Meanwhile, Syzbot failed to trigger the crash for 617 days. Thus, it looks like this is a new bug. Unfortunately, the syzkaller failed to generate a reproducer. But at least we have the report: INFO: task syz.0.5537:72598 blocked for more than 143 seconds. Not tainted 6.10.0 #13 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.5537 state:D stack:24680 pid:72598 tgid:72598 ppid:66970 flags:0x00004004 Call Trace: <TASK> context_switch kernel/sched/core.c:5407 [inline] __schedule+0xf4a/0x15e0 kernel/sched/core.c:6748 __schedule_loop kernel/sched/core.c:6825 [inline] schedule+0x143/0x310 kernel/sched/core.c:6840 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6897 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x69a/0xd50 kernel/locking/mutex.c:752 tty_release_struct+0xad/0xd0 drivers/tty/tty_io.c:1706 tty_release+0xb66/0xd70 drivers/tty/tty_io.c:1867 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x239/0x2f0 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x12d/0x280 kernel/entry/common.c:218 do_syscall_64+0x8a/0x150 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7fd9a67809b9 RSP: 002b:00007ffecb0e3b18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fd9a6947a80 RCX: 00007fd9a67809b9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fd9a6947a80 R08: 0000000000000006 R09: 00007ffecb0e3dff R10: 00000000003ffcb0 R11: 0000000000000246 R12: 00000000002241f4 R13: 00007ffecb0e3c10 R14: 00007ffecb0e3c30 R15: ffffffffffffffff </TASK> INFO: task syz.0.5537:72599 blocked for more than 143 seconds. Not tainted 6.10.0 #13 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.5537 state:D stack:26536 pid:72599 tgid:72598 ppid:66970 flags:0x00004006 Call Trace: <TASK> context_switch kernel/sched/core.c:5407 [inline] __schedule+0xf4a/0x15e0 kernel/sched/core.c:6748 __schedule_loop kernel/sched/core.c:6825 [inline] schedule+0x143/0x310 kernel/sched/core.c:6840 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6897 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x69a/0xd50 kernel/locking/mutex.c:752 tty_release_struct+0xad/0xd0 drivers/tty/tty_io.c:1706 tty_release+0xb66/0xd70 drivers/tty/tty_io.c:1867 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x239/0x2f0 kernel/task_work.c:180 get_signal+0x15d5/0x1730 kernel/signal.c:2681 arch_do_signal_or_restart+0x92/0x7f0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x95/0x280 kernel/entry/common.c:218 do_syscall_64+0x8a/0x150 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7fd9a67809b9 RSP: 002b:00007fd9a7605038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: 000000000017c800 RBX: 00007fd9a6945f80 RCX: 00007fd9a67809b9 RDX: 00000000fffffde3 RSI: 0000000020000000 RDI: 0000000000000003 RBP: 00007fd9a67f4f70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd9a6945f80 R15: 00007ffecb0e39b8 </TASK> Showing all locks held in the system: 1 lock held by khungtaskd/25: #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:329 [inline] #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:781 [inline] #0: ffffffff8db32fe0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x54/0x2d0 kernel/locking/lockdep.c:6614 1 lock held by in:imklog/7643: 2 locks held by agetty/38872: #0: ffff88801b0ac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:243 #1: ffff88801b0ac130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: tty_write_lock drivers/tty/tty_io.c:954 [inline] #1: ffff88801b0ac130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: iterate_tty_write drivers/tty/tty_io.c:973 [inline] #1: ffff88801b0ac130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: file_tty_write+0x1e8/0xa00 drivers/tty/tty_io.c:1096 2 locks held by kworker/u4:22/60168: 2 locks held by kworker/u4:23/60169: #0: ffff888018d66948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3223 [inline] #0: ffff888018d66948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x8fb/0x1410 kernel/workqueue.c:3329 #1: ffffc9000971fd20 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3224 [inline] #1: ffffc9000971fd20 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x922/0x1410 kernel/workqueue.c:3329 2 locks held by kworker/u4:25/60173: #0: ffff888018d66948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3223 [inline] #0: ffff888018d66948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x8fb/0x1410 kernel/workqueue.c:3329 #1: ffffc9000973fd20 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3224 [inline] #1: ffffc9000973fd20 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x922/0x1410 kernel/workqueue.c:3329 1 lock held by syz.0.4591/61848: 1 lock held by syz.1.4603/61926: 2 locks held by agetty/63190: #0: ffff88803c8260a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90007a8b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x712/0x1e80 drivers/tty/n_tty.c:2211 1 lock held by syz.1.4836/64293: 1 lock held by syz.1.5065/66967: 3 locks held by kworker/0:4/67207: #0: ffff88801307a948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3223 [inline] #0: ffff88801307a948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x8fb/0x1410 kernel/workqueue.c:3329 #1: ffffc90004b8fd20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3224 [inline] #1: ffffc90004b8fd20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x922/0x1410 kernel/workqueue.c:3329 #2: ffff88802f4a0240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x2de/0x4050 drivers/net/netdevsim/fib.c:1489 2 locks held by syz.1.5398/70778: 2 locks held by syz.1.5488/71784: 1 lock held by syz.0.5537/72598: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_release_struct+0xad/0xd0 drivers/tty/tty_io.c:1706 1 lock held by syz.0.5537/72599: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_release_struct+0xad/0xd0 drivers/tty/tty_io.c:1706 4 locks held by syz.1.5536/72606: 1 lock held by syz.0.5541/73119: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.1.5542/73125: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.0.5543/73605: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xc7/0x2c0 drivers/tty/pty.c:823 1 lock held by syz.1.5544/73619: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.0.5545/74100: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xc7/0x2c0 drivers/tty/pty.c:823 1 lock held by syz.1.5547/74121: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xc7/0x2c0 drivers/tty/pty.c:823 1 lock held by syz.1.5547/74122: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.1.5547/74123: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.1.5547/74124: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.0.5551/74612: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.0.5551/74617: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.0.5551/74621: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.0.5551/74625: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.0.5551/74626: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2052 [inline] #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x232/0xe20 drivers/tty/tty_io.c:2135 1 lock held by syz.0.5553/75389: #0: ffffffff8e2aa648 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xc7/0x2c0 drivers/tty/pty.c:823 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 25 Comm: khungtaskd Not tainted 6.10.0 #13 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x23d/0x360 lib/dump_stack.c:114 nmi_cpu_backtrace+0x451/0x480 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x181/0x2d0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xdbd/0xe00 kernel/hung_task.c:379 kthread+0x2eb/0x380 kernel/kthread.c:389 ret_from_fork+0x49/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:244 </TASK>
