[v6.1] INFO: task hung in __tun_chr_ioctl

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4078fa637fcd Linux 6.1.91
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11f6703c980000
kernel config: https://syzkaller.appspot.com/x/.config?x=715ba80acfd3def4
dashboard link: https://syzkaller.appspot.com/bug?extid=930abbbea4b72c328531
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2443dfe91c62/disk-4078fa63.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/12dbc2af3348/vmlinux-4078fa63.xz
kernel image: https://storage.googleapis.com/syzbot-assets/da3589238e32/bzImage-4078fa63.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+930abb...@syzkaller.appspotmail.com

INFO: task syz-executor.4:10431 blocked for more than 143 seconds.
Not tainted 6.1.91-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4 state:D stack:27000 pid:10431 ppid:3574 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0x142d/0x4550 kernel/sched/core.c:6558
schedule+0xbf/0x180 kernel/sched/core.c:6634
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
__tun_chr_ioctl+0x465/0x2430 drivers/net/tun.c:3101
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:870 [inline]
__se_sys_ioctl+0xf1/0x160 fs/ioctl.c:856
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup