INFO: task hung in io_uring_del_tctx_node (5)

Status: fixed on 2026/01/07 12:29
Subsystems: io-uring
[Documentation on labels]
Reported-by: syzbot+10a9b495f54a17b607a6@syzkaller.appspotmail.com
Fix commit: 101e596e7404 io_uring/fdinfo: cap SQ iteration at max SQ entries
First crash: 412d, last: 228d
Cause bisection: introduced by (bisect log) :
commit 1cba30bf9fdd6c982708f3587f609a30c370d889
Author: Keith Busch <kbusch@kernel.org>
Date: Thu Oct 16 18:09:38 2025 +0000

  io_uring: add support for IORING_SETUP_SQE_MIXED

Crash: INFO: task hung in io_uring_del_tctx_node (log)
Repro: C syz .config
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] io_uring/fdinfo: cap SQ iteration at max SQ entries 1 (1) 2025/10/28 01:12
[syzbot] [io-uring?] INFO: task hung in io_uring_del_tctx_node (5) 6 (8) 2025/10/28 01:09
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in io_uring_del_tctx_node 1 2 1201d 1205d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:02
upstream INFO: task hung in io_uring_del_tctx_node (3) io-uring 1 1 766d 766d 0/29 auto-obsoleted due to no activity on 2024/10/02 07:14
upstream INFO: task hung in io_uring_del_tctx_node (4) io-uring 1 syz, C done 8 437d 433d 0/29 closed as invalid on 2025/06/02 13:41
upstream INFO: task hung in io_uring_del_tctx_node io-uring fs 1 syz, C unreliable 37 1617d 1781d 20/29 fixed on 2022/03/08 16:11
linux-5.15 INFO: task hung in io_uring_del_tctx_node (2) 1 5 173d 381d 0/3 auto-obsoleted due to no activity on 2026/05/28 07:00
upstream INFO: task hung in io_uring_del_tctx_node (2) io-uring 1 syz, C error error 20 1246d 1608d 0/29 auto-obsoleted due to no activity on 2023/07/30 22:24
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2025/10/27 22:25 39m hdanton@sina.com patch linux-next OK log

Sample crash report:
INFO: task syz.1.18:6077 blocked for more than 143 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18        state:D stack:28088 pid:6077  tgid:6075  ppid:5942   task_flags:0x400548 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5258 [inline]
 __schedule+0x150e/0x5070 kernel/sched/core.c:6866
 __schedule_loop kernel/sched/core.c:6948 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6963
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7020
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776
 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179
 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195
 io_uring_cancel_generic+0x6ca/0x7d0 io_uring/cancel.c:646
 io_uring_files_cancel include/linux/io_uring.h:19 [inline]
 do_exit+0x34f/0x25b0 kernel/exit.c:911
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1112
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x87/0x4f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2d0/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8bba38f749
RSP: 002b:00007f8bbb1b50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f8bba5e5fa8 RCX: 00007f8bba38f749
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8bba5e5fa8
RBP: 00007f8bba5e5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8bba5e6038 R14: 00007ffdeae09510 R15: 00007ffdeae095f8
 </TASK>
INFO: task syz.2.19:6078 blocked for more than 145 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19        state:D stack:27768 pid:6078  tgid:6076  ppid:5951   task_flags:0x400548 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5258 [inline]
 __schedule+0x150e/0x5070 kernel/sched/core.c:6866
 __schedule_loop kernel/sched/core.c:6948 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6963
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7020
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776
 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179
 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195
 io_uring_cancel_generic+0x6ca/0x7d0 io_uring/cancel.c:646
 io_uring_files_cancel include/linux/io_uring.h:19 [inline]
 do_exit+0x34f/0x25b0 kernel/exit.c:911
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1112
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x87/0x4f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2d0/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbaaef8f749
RSP: 002b:00007fbaafde40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fbaaf1e5fa8 RCX: 00007fbaaef8f749
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fbaaf1e5fa8
RBP: 00007fbaaf1e5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbaaf1e6038 R14: 00007ffd1d575f40 R15: 00007ffd1d576028
 </TASK>
INFO: task syz.3.20:6082 blocked for more than 147 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.20        state:D stack:28088 pid:6082  tgid:6081  ppid:5954   task_flags:0x400548 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5258 [inline]
 __schedule+0x150e/0x5070 kernel/sched/core.c:6866
 __schedule_loop kernel/sched/core.c:6948 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6963
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7020
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776
 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179
 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195
 io_uring_cancel_generic+0x6ca/0x7d0 io_uring/cancel.c:646
 io_uring_files_cancel include/linux/io_uring.h:19 [inline]
 do_exit+0x34f/0x25b0 kernel/exit.c:911
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1112
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x87/0x4f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2d0/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f361a78f749
RSP: 002b:00007f361b6fc0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f361a9e5fa8 RCX: 00007f361a78f749
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f361a9e5fa8
RBP: 00007f361a9e5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f361a9e6038 R14: 00007ffddd550d00 R15: 00007ffddd550de8
 </TASK>
INFO: task syz.0.17:6086 blocked for more than 149 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:27928 pid:6086  tgid:6084  ppid:5946   task_flags:0x400548 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5258 [inline]
 __schedule+0x150e/0x5070 kernel/sched/core.c:6866
 __schedule_loop kernel/sched/core.c:6948 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6963
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7020
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776
 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179
 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195
 io_uring_cancel_generic+0x6ca/0x7d0 io_uring/cancel.c:646
 io_uring_files_cancel include/linux/io_uring.h:19 [inline]
 do_exit+0x34f/0x25b0 kernel/exit.c:911
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1112
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x87/0x4f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2d0/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd4c678f749
RSP: 002b:00007fd4c76f50e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fd4c69e5fa8 RCX: 00007fd4c678f749
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fd4c69e5fa8
RBP: 00007fd4c69e5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd4c69e6038 R14: 00007ffc3a032110 R15: 00007ffc3a0321f8
 </TASK>
INFO: task syz.4.21:6090 blocked for more than 151 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.21        state:D stack:28056 pid:6090  tgid:6089  ppid:5952   task_flags:0x400548 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5258 [inline]
 __schedule+0x150e/0x5070 kernel/sched/core.c:6866
 __schedule_loop kernel/sched/core.c:6948 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6963
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7020
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776
 io_uring_del_tctx_node+0xf0/0x2c0 io_uring/tctx.c:179
 io_uring_clean_tctx+0xd4/0x1a0 io_uring/tctx.c:195
 io_uring_cancel_generic+0x6ca/0x7d0 io_uring/cancel.c:646
 io_uring_files_cancel include/linux/io_uring.h:19 [inline]
 do_exit+0x34f/0x25b0 kernel/exit.c:911
 do_group_exit+0x21c/0x2d0 kernel/exit.c:1112
 get_signal+0x1285/0x1340 kernel/signal.c:3034
 arch_do_signal_or_restart+0x9a/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
 exit_to_user_mode_loop+0x87/0x4f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2d0/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Crashes (19):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/24 04:29 linux-next cc3aa43b44bd d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: task hung in io_uring_del_tctx_node
2025/10/25 07:15 linux-next 72fb0170ef1f c0460fcd .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/10/25 04:48 linux-next 72fb0170ef1f c0460fcd .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: task hung in io_uring_del_tctx_node
2025/11/27 14:31 upstream 4941a17751c9 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in io_uring_del_tctx_node
2025/11/24 07:42 upstream ac3fd01e4c1e 4fb8ef37 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/11/11 01:06 upstream 4ea7c1717f3f 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/11/01 18:05 upstream ba36dd5ee6fd 2c50b6a9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/10/26 03:54 upstream 9bb956508c9d c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/10/25 03:04 upstream 6fab32bb6508 c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/07/11 16:49 upstream bc9ff192a6c9 3cda49cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/06/28 19:15 upstream 35e261cd95dd fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/06/23 05:12 upstream b67ec639010f d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in io_uring_del_tctx_node
2025/07/24 06:05 upstream 01a412d06bc5 0c1d6ded .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 INFO: task hung in io_uring_del_tctx_node
2025/08/30 03:27 upstream fb679c832b64 807a3b61 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 INFO: task hung in io_uring_del_tctx_node
2025/10/27 03:46 linux-next 72fb0170ef1f c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: task hung in io_uring_del_tctx_node
2025/10/25 02:20 linux-next 72fb0170ef1f c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: task hung in io_uring_del_tctx_node
2025/10/22 18:08 linux-next aaa9c3550b60 252fbbad .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce INFO: task hung in io_uring_del_tctx_node
2025/10/19 08:31 linux-next 93f3bab4310d 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: task hung in io_uring_del_tctx_node
2025/09/17 20:00 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next 4d4a3cc7f280 e2beed91 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-riscv64 INFO: task hung in io_uring_del_tctx_node
* Struck through repros no longer work on HEAD.