syzbot


INFO: task hung in f2fs_release_file (3)

Status: upstream: reported C repro on 2025/12/05 19:05
Subsystems: f2fs
[Documentation on labels]
Reported-by: syzbot+4235e4d7b6fd75704528@syzkaller.appspotmail.com
First crash: 51d, last: 10d
Cause bisection: the cause commit could be any of (bisect log):
  2aac2538a97d f2fs: do sanity check on xattr node footer in f2fs_get_xnode_page()
  1788971e0bfa f2fs: introduce FAULT_INCONSISTENT_FOOTER
  1cf6b5670af1 f2fs: do sanity check on inode footer in f2fs_get_inode_page()
  986c50f6bca1 f2fs: fix to avoid accessing uninitialized curseg
  c2ecba026586 f2fs: control nat_bits feature via mount option
  19426c4988aa Revert "f2fs: rebuild nat_bits during umount"
  
Fix bisection: failed (error log, bisect log)
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [f2fs?] INFO: task hung in f2fs_release_file (3) 0 (10) 2025/12/06 10:34
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in f2fs_release_file (2) f2fs 1 2 145d 155d 0/29 auto-obsoleted due to no activity on 2025/11/28 04:29
upstream INFO: task hung in f2fs_release_file f2fs 1 2 898d 949d 0/29 auto-obsoleted due to no activity on 2023/11/05 16:58
Last patch testing requests (11)
Created Duration User Patch Repo Result
2025/12/15 22:47 21m retest repro upstream OK log
2025/12/15 22:47 22m retest repro upstream OK log
2025/12/06 10:34 19m kartikey406@gmail.com patch upstream report log
2025/12/06 08:50 31m kartikey406@gmail.com patch upstream OK log
2025/12/06 08:03 16m kartikey406@gmail.com patch upstream report log
2025/12/06 06:55 17m kartikey406@gmail.com patch upstream report log
2025/12/06 06:26 18m kartikey406@gmail.com patch upstream report log
2025/12/06 05:34 16m kartikey406@gmail.com patch upstream report log
2025/12/06 04:47 28m kartikey406@gmail.com patch upstream OK log
2025/12/06 02:31 20m kartikey406@gmail.com patch upstream report log
2025/12/06 01:58 23m kartikey406@gmail.com patch upstream report log

Sample crash report:
INFO: task syz.0.17:6059 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:26872 pid:6059  tgid:6059  ppid:5935   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0x145f/0x5070 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7241
 rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
 __rt_mutex_slowlock_locked+0x1dfe/0x25e0 kernel/locking/rtmutex.c:1760
 rt_mutex_slowlock+0xb5/0x160 kernel/locking/rtmutex.c:1800
 __rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
 rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244
 inode_lock include/linux/fs.h:1027 [inline]
 f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2066
 __fput+0x45b/0xa80 fs/file_table.c:468
 task_work_run+0x1d4/0x260 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0xef/0x4e0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2c1/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7577ddf749
RSP: 002b:00007ffdec437d28 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f7578037da0 RCX: 00007f7577ddf749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f7578037da0 R08: 0000000000000000 R09: 00000006ec43801f
R10: 00007f7578037cb0 R11: 0000000000000246 R12: 000000000002d6d7
R13: 00007ffdec437e20 R14: ffffffffffffffff R15: 00007ffdec437e40
 </TASK>
INFO: task syz.0.17:6060 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D stack:22600 pid:6060  tgid:6059  ppid:5935   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0x145f/0x5070 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6960
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
 f2fs_issue_checkpoint+0x365/0x5b0 fs/f2fs/checkpoint.c:-1
 f2fs_unlink+0x62c/0xa90 fs/f2fs/namei.c:604
 vfs_unlink+0x386/0x650 fs/namei.c:5378
 do_unlinkat+0x2cf/0x570 fs/namei.c:5448
 __do_sys_unlinkat fs/namei.c:5478 [inline]
 __se_sys_unlinkat fs/namei.c:5471 [inline]
 __x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5471
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xec/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7577ddf749
RSP: 002b:00007f7577446038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f7578035fa0 RCX: 00007f7577ddf749
RDX: 0000000000000000 RSI: 0000200000000380 RDI: ffffffffffffff9c
RBP: 00007f7577e63f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7578036038 R14: 00007f7578035fa0 R15: 00007ffdec437bc8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/38:
 #0: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:4/65:
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
 #1: ffffc9000150fbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc9000150fbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
 #2: ffff8880325720d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:13/3204:
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
 #1: ffffc9000cc6fbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc9000cc6fbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
 #2: ffff8880288e80d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:14/3460:
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
 #1: ffffc9000cf0fbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc9000cf0fbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
 #2: ffff888037eb20d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
6 locks held by kworker/u8:16/3563:
3 locks held by kworker/u8:17/3753:
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
 #1: ffffc9000d6dfbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc9000d6dfbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
 #2: ffff8880106100d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:18/3828:
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
 #0: ffff888141693938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
 #1: ffffc9000d8afbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
 #1: ffffc9000d8afbc0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
 #2: ffff88803a3140d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
1 lock held by udevd/5172:
 #0: ffff8880358b6a08 (&ep->lock){+.+.}-{3:3}, at: spin_lock_irq include/linux/spinlock_rt.h:93 [inline]
 #0: ffff8880358b6a08 (&ep->lock){+.+.}-{3:3}, at: ep_poll fs/eventpoll.c:2040 [inline]
 #0: ffff8880358b6a08 (&ep->lock){+.+.}-{3:3}, at: do_epoll_wait+0x848/0xbb0 fs/eventpoll.c:2461
2 locks held by getty/5564:
 #0: ffff888034c8f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x44f/0x1460 drivers/tty/n_tty.c:2211
1 lock held by syz.0.17/6059:
 #0: ffff888056ac8b00 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #0: ffff888056ac8b00 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2066
3 locks held by syz.0.17/6060:
 #0: ffff8880288e8480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
 #1: ffff888056a99488 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
 #1: ffff888056a99488 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2873 [inline]
 #1: ffff888056a99488 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2884 [inline]
 #1: ffff888056a99488 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5429
 #2: ffff888056ac8b00 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #2: ffff888056ac8b00 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5364
4 locks held by f2fs_ckpt-7:0/6064:
1 lock held by syz.1.18/6086:
 #0: ffff888056acbaa8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #0: ffff888056acbaa8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2066
3 locks held by syz.1.18/6087:
 #0: ffff88803a314480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
 #1: ffff888056aca798 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
 #1: ffff888056aca798 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2873 [inline]
 #1: ffff888056aca798 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2884 [inline]
 #1: ffff888056aca798 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5429
 #2: ffff888056acbaa8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #2: ffff888056acbaa8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5364
3 locks held by f2fs_ckpt-7:1/6091:
1 lock held by syz.2.19/6113:
 #0: ffff888056acea50 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #0: ffff888056acea50 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2066
3 locks held by syz.2.19/6114:
 #0: ffff888037eb2480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
 #1: ffff888056acd740 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
 #1: ffff888056acd740 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2873 [inline]
 #1: ffff888056acd740 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2884 [inline]
 #1: ffff888056acd740 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5429
 #2: ffff888056acea50 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #2: ffff888056acea50 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5364
5 locks held by f2fs_ckpt-7:2/6118:
1 lock held by syz.3.20/6140:
 #0: ffff888056a9c430 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #0: ffff888056a9c430 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2066
3 locks held by syz.3.20/6141:
 #0: ffff888032572480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
 #1: ffff888056a9b120 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
 #1: ffff888056a9b120 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2873 [inline]
 #1: ffff888056a9b120 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2884 [inline]
 #1: ffff888056a9b120 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5429
 #2: ffff888056a9c430 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #2: ffff888056a9c430 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5364
2 locks held by f2fs_ckpt-7:3/6148:
1 lock held by syz.4.21/6181:
 #0: ffff888042d28178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #0: ffff888042d28178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2066
3 locks held by syz.4.21/6182:
 #0: ffff888010610480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
 #1: ffff888056ac8178 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
 #1: ffff888056ac8178 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2873 [inline]
 #1: ffff888056ac8178 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2884 [inline]
 #1: ffff888056ac8178 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5429
 #2: ffff888042d28178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #2: ffff888042d28178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5364
2 locks held by f2fs_ckpt-7:4/6186:
1 lock held by syz.5.22/6219:
 #0: ffff888042d2b120 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #0: ffff888042d2b120 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2066
3 locks held by syz.5.22/6220:
 #0: ffff888035334480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
 #1: ffff888042d29e10 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
 #1: ffff888042d29e10 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2873 [inline]
 #1: ffff888042d29e10 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2884 [inline]
 #1: ffff888042d29e10 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5429
 #2: ffff888042d2b120 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #2: ffff888042d2b120 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5364
3 locks held by f2fs_ckpt-7:5/6224:
1 lock held by syz.6.23/6266:
 #0: ffff888042d2d740 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #0: ffff888042d2d740 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2066
3 locks held by syz.6.23/6267:
 #0: ffff88803d850480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
 #1: ffff888042d2c430 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
 #1: ffff888042d2c430 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2873 [inline]
 #1: ffff888042d2c430 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2884 [inline]
 #1: ffff888042d2c430 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5429
 #2: ffff888042d2d740 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
 #2: ffff888042d2d740 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5364
4 locks held by f2fs_ckpt-7:6/6271:
11 locks held by syz-executor/6274:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xf95/0xfe0 kernel/hung_task.c:515
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 3563 Comm: kworker/u8:16 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: bat_events batadv_dat_purge
RIP: 0010:__lock_is_held kernel/locking/lockdep.c:5598 [inline]
RIP: 0010:lock_is_held_type+0x98/0x150 kernel/locking/lockdep.c:5940
Code: eb 48 81 c3 90 0b 00 00 45 31 ff 49 83 ff 31 73 24 48 89 df 4c 89 f6 e8 f6 01 00 00 85 c0 75 2a 49 ff c7 49 63 85 88 0b 00 00 <48> 83 c3 28 49 39 c7 7c d8 eb 11 48 c7 c7 d0 e5 47 8d 4c 89 fe e8
RSP: 0018:ffffc9000d2af6a8 EFLAGS: 00000002
RAX: 0000000000000006 RBX: ffff888030e48bb8 RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffff888058bd5718 RDI: ffff888030e48bb8
RBP: 00000000ffffffff R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52001a55f14 R12: 0000000000000046
R13: ffff888030e48000 R14: ffff888058bd5718 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff888126cef000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5287fd6480 CR3: 00000000109fa000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 lock_is_held include/linux/lockdep.h:249 [inline]
 rtlock_slowlock_locked+0xba/0x4010 kernel/locking/rtmutex.c:1836
 rtlock_slowlock kernel/locking/rtmutex.c:1895 [inline]
 rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
 __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
 rt_spin_lock+0x158/0x3e0 kernel/locking/spinlock_rt.c:57
 spin_lock_bh include/linux/spinlock_rt.h:88 [inline]
 __batadv_dat_purge+0x131/0x400 net/batman-adv/distributed-arp-table.c:173
 batadv_dat_purge+0x20/0x70 net/batman-adv/distributed-arp-table.c:204
 process_one_work kernel/workqueue.c:3257 [inline]
 process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/11 19:46 upstream 755bc1335e3b d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs INFO: task hung in f2fs_release_file
2026/01/11 16:39 upstream 755bc1335e3b d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in f2fs_release_file
2025/12/01 22:02 upstream 7d0a66e4bb90 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs INFO: task hung in f2fs_release_file
2025/12/01 18:48 upstream 7d0a66e4bb90 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro (corrupt fs)] ci2-upstream-fs INFO: task hung in f2fs_release_file
2025/12/01 14:59 upstream 7d0a66e4bb90 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in f2fs_release_file
* Struck through repros no longer work on HEAD.