INFO: task syz.2.623:11029 blocked for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.623       state:D stack:26536 pid:11029 tgid:11028 ppid:10713  task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x17d9/0x56c0
 schedule+0x164/0x2b0
 schedule_timeout+0xc0/0x2c0
 __down_common+0x3b7/0x850
 down+0x80/0xd0
 console_lock+0x58/0x90
 con_install+0x97/0x770
 tty_init_dev+0xd7/0x4d0
 tty_open+0x7d9/0xcc0
 chrdev_open+0x4d9/0x600
 do_dentry_open+0x816/0x1380
 vfs_open+0x3b/0x340
 path_openat+0x2e44/0x3830
 do_file_open+0x23e/0x4a0
 do_sys_openat2+0x115/0x200
 __x64_sys_openat+0x138/0x170
 do_syscall_64+0x174/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f959795e90e
RSP: 002b:00007f959882db28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f959882e6c0 RCX: 00007f959795e90e
RDX: 0000000000000002 RSI: 00007f959882dc00 RDI: ffffffffffffff9c
RBP: 00007f9597a35024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9597c26038 R14: 00007f9597c25fa0 R15: 00007ffe448052a8
 </TASK>

Showing all locks held in the system:
7 locks held by kworker/1:0/24:
 #0: ffff8881056b5940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc900001e7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff88816b92d1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
 #3: ffff8881916321d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #4: ffff8881afbde1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #5: ffff8881900ec260 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_register+0x4b/0x200
 #6: ffffffff8f3bfbe0 (registration_lock){+.+.}-{4:4}, at: register_framebuffer+0x8d/0x880
7 locks held by kworker/1:1/32:
 #0: ffff8881056b5940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90000a77c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff88816b75c1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
 #3: ffff88816dc391d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #4: ffff8881bde361a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #5: ffff888174d64260 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_register+0x4b/0x200
 #6: ffffffff8f3bfbe0 (registration_lock){+.+.}-{4:4}, at: register_framebuffer+0x8d/0x880
1 lock held by khungtaskd/35:
 #0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
3 locks held by kworker/u11:1/4988:
 #0: ffff888174653940 ((wq_completion)hci8){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90003e5fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff88819ad50ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0
7 locks held by kworker/0:3/5065:
 #0: ffff8881056b5940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000357fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff88816b50b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
 #3: ffff88802e89c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #4: ffff88801cbbe1a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #5: ffff88802ee80260 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_register+0x4b/0x200
 #6: ffffffff8f3bfbe0 (registration_lock){+.+.}-{4:4}, at: register_framebuffer+0x8d/0x880
2 locks held by getty/5427:
 #0: ffff8881741d20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffffc900023682e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360
7 locks held by kworker/1:6/6967:
 #0: ffff8881056b5940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90003b2fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff88816b8451d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30
 #3: ffff88816e8ed1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #4: ffff8881abdb71a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450
 #5: ffff8881900d4260 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_register+0x4b/0x200
 #6: ffffffff8f3bfbe0 (registration_lock){+.+.}-{4:4}, at: register_framebuffer+0x8d/0x880
3 locks held by kworker/0:9/8322:
 #0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90006887c40 ((work_completion)(&helper->damage_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff888109eaf270 (&helper->lock){+.+.}-{4:4}, at: drm_fb_helper_damage_work+0x15b/0xf20
1 lock held by syz.1.585/10380:
 #0: ffff888168e64260 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_dev_restore+0xb1/0x290
4 locks held by syz.3.604/10710:
 #0: ffff8881bfdf20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffff8881bfdf2128 (&tty->atomic_write_lock){+.+.}-{4:4}, at: file_tty_write+0x1e4/0x9c0
 #2: ffff8881bfdf22c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_write+0x1f5/0x11e0
 #3: ffffc900028a0370 (&ldata->output_lock){+.+.}-{4:4}, at: n_tty_write+0x66d/0x11e0
10 locks held by syz.4.622/11008:
2 locks held by syz.2.623/11029:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x204/0xcc0
 #1: ffff888120af61b0 (&tty->legacy_mutex){+.+.}-{4:4}, at: tty_init_dev+0x74/0x4d0
1 lock held by syz.7.650/11472:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x204/0xcc0
7 locks held by syz.7.650/11510:
 #0: ffff8881be664ef0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320
 #1: ffff888104faa450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #2: ffff888109b10880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #3: ffffffff8f3988a0 (pci_rescan_remove_lock){+.+.}-{4:4}, at: pci_stop_and_remove_bus_device_locked+0x13/0xb0
 #4: ffff8881056821f8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
 #5: ffff888168e64260 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_dev_unregister+0xa1/0x2d0
 #6: ffffffff8f3bfbe0 (registration_lock){+.+.}-{4:4}, at: unregister_framebuffer+0x2e/0x3b0
1 lock held by syz.8.673/11807:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x204/0xcc0
1 lock held by syz.0.674/11816:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0xdc/0x2e0
1 lock held by syz.6.688/11952:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x204/0xcc0
1 lock held by syz.3.704/12101:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0xdc/0x2e0
1 lock held by syz.1.714/12222:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x204/0xcc0
1 lock held by syz.4.723/12321:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0xdc/0x2e0
1 lock held by syz.5.730/12373:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x204/0xcc0
1 lock held by syz.7.826/12946:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x204/0xcc0
1 lock held by syz.9.827/12949:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0xdc/0x2e0
1 lock held by syz.0.841/13121:
 #0: ffffffff8f457dc0 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x204/0xcc0
1 lock held by syz.3.874/13223:
 #0: ffff88816b50b1d8 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x151/0x770
1 lock held by syz.2.977/13871:
 #0: ffff888191716140 (&dev->mutex){....}-{4:4}, at: nfc_unregister_rfkill+0x63/0x280
4 locks held by syz.2.977/13873:
 #0: ffffffff90098868 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
 #1: ffffffff900986a0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0
 #2: ffff888191716140 (&dev->mutex){....}-{4:4}, at: nfc_dev_up+0x3c/0x350
 #3: ffff8881bb82e348 (&ndev->req_lock){+.+.}-{4:4}, at: nci_dev_up+0xa3/0xdc0
2 locks held by syz.6.986/13914:
 #0: ffffffff90098868 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
 #1: ffffffff900986a0 (genl_mutex){+.+.}-{4:4}, at: genl_rcv_msg+0x10b/0x7a0
2 locks held by syz.1.987/13919:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 35 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 nmi_cpu_backtrace+0x274/0x2d0
 nmi_trigger_cpumask_backtrace+0x17a/0x380
 sys_info+0x135/0x170
 watchdog+0xfd7/0x1030
 kthread+0x388/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 13919 Comm: syz.1.987 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:lock_release+0x12/0x3c0
Code: ff ff ff 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 83 ec 30 <49> 89 f5 49 89 fe 65 48 8b 05 f0 c8 c9 11 48 89 44 24 28 0f 1f 44
RSP: 0018:ffffc9000464f6d8 EFLAGS: 00000286
RAX: ffffffff82490772 RBX: ffff88801fdc93e0 RCX: 0000000000080000
RDX: ffffc9003fdc2000 RSI: ffffffff826d48d0 RDI: ffff88801fdc93f8
RBP: ffffc9000464f830 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520008c9ed0 R12: 0000000000000000
R13: ffff88801fdc9360 R14: ffff88801fdc9388 R15: 0000000000000000
FS:  00007f5494c0e6c0(0000) GS:ffff88818d955000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f548adbd000 CR3: 00000001bc9ce000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 _raw_spin_unlock+0x16/0x50
 __dquot_alloc_space+0x280/0xea0
 shmem_inode_acct_blocks+0x2a1/0x460
 shmem_alloc_and_add_folio+0x8cf/0xf60
 shmem_get_folio_gfp+0x5da/0x16d0
 shmem_write_begin+0x16c/0x330
 generic_perform_write+0x2d5/0x8f0
 shmem_file_write_iter+0xf8/0x120
 vfs_write+0x612/0xba0
 ksys_write+0x150/0x270
 do_syscall_64+0x174/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5493d5e90e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007f5494c0dda8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5494c0e6c0 RCX: 00007f5493d5e90e
RDX: 00000000013bd7ef RSI: 00007f5489a00000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 00007f5494c0dee0 R14: 00007f5494c0dea0 R15: 00007f5489a00000
 </TASK>
