syzbot
INFO: task hung in write_versions
Status:
upstream: reported on 2026/08/05 03:52
Reported-by: syzbot+b18133a2d3c311efffdf@syzkaller.appspotmail.com
First crash: 100d, last: 3d05h
Sample crash report:
INFO: task syz.7.412:6501 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.412 state:D stack:27152 pid: 6501 ppid: 5459 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
write_versions+0x90/0xbb0 fs/nfsd/nfsctl.c:683
nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
vfs_write+0x304/0xd70 fs/read_write.c:592
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f92e74d7f19
RSP: 002b:00007f92e5725028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f92e7754fa0 RCX: 00007f92e74d7f19
RDX: 0000000000000009 RSI: 00002000000008c0 RDI: 0000000000000003
RBP: 00007f92e7566f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f92e7755038 R14: 00007f92e7754fa0 R15: 00007fff8b7a56f8
</TASK>
INFO: task syz.7.412:6504 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.412 state:D
stack:27152 pid: 6504 ppid: 5459 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
write_ports+0xb3/0xb80 fs/nfsd/nfsctl.c:848
nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
vfs_write+0x304/0xd70 fs/read_write.c:592
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f92e74d7f19
RSP: 002b:00007f92e5704028 EFLAGS: 00000246
ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f92e7755090 RCX: 00007f92e74d7f19
RDX: 0000000000000005 RSI: 0000200000000940 RDI: 0000000000000004
RBP: 00007f92e7566f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f92e7755128 R14: 00007f92e7755090 R15: 00007fff8b7a56f8
</TASK>
INFO: task syz.7.412:6508 blocked for more than 148 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.412 state:D
stack:27152 pid: 6508 ppid: 5459 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
nfsd_svc+0x60/0x9e0 fs/nfsd/nfssvc.c:785
write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:426
nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
vfs_write+0x304/0xd70 fs/read_write.c:592
ksys_write+0x153/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f92e74d7f19
RSP: 002b:00007f92e56e3028 EFLAGS: 00000246
ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f92e7755180 RCX: 00007f92e74d7f19
RDX: 0000000000000001 RSI: 00002000000009c0 RDI: 0000000000000005
RBP: 00007f92e7566f6d R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f92e7755218 R14: 00007f92e7755180 R15: 00007fff8b7a56f8
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0:
ffffffff8d11efa0
(
rcu_read_lock
){....}-{1:2}
, at: rcu_lock_acquire+0x0/0x30
2 locks held by dhcpcd/3852:
#0:
ffff88801d0bf690
(
nlk_cb_mutex-ROUTE
){+.+.}-{3:3}
, at: __netlink_dump_start+0xf5/0x720 net/netlink/af_netlink.c:2371
#1:
ffffffff8e26ca48 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0x70a/0xdd0 net/netlink/af_netlink.c:2298
2 locks held by kworker/0:7/4790:
#0:
ffff8880b8e3a358
(&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x130 kernel/sched/core.c:475
#1: ffff8880b8e27888 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x517/0x810 kernel/sched/psi.c:891
2 locks held by kworker/1:17/5719:
3 locks held by syz.1.365/6292:
#0: ffff888024879270 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
#1: ffff88801f162460 (sb_writers#21){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
#2: ffffffff8d3713e8 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_svc+0x60/0x9e0 fs/nfsd/nfssvc.c:785
3 locks held by syz.7.412/6501:
#0: ffff888063929770 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
#1: ffff888079bac460 (sb_writers#21){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
#2: ffffffff8d3713e8 (nfsd_mutex){+.+.}-{3:3}, at: write_versions+0x90/0xbb0 fs/nfsd/nfsctl.c:683
3 locks held by syz.7.412/6504:
#0:
ffff8880248534f0
(
&f->f_pos_lock
){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
#1: ffff888079bac460 (sb_writers
#21
){.+.+}-{0:0}
, at: vfs_write+0x296/0xd70 fs/read_write.c:590
#2:
ffffffff8d3713e8
(
nfsd_mutex
){+.+.}-{3:3}
, at: write_ports+0xb3/0xb80 fs/nfsd/nfsctl.c:848
3 locks held by syz.7.412/6508:
#0:
ffff888077efb770
(
&f->f_pos_lock
){+.+.}-{3:3}
, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
#1:
ffff888079bac460
(
sb_writers
#21
){.+.+}-{0:0}
, at: vfs_write+0x296/0xd70 fs/read_write.c:590
#2: ffffffff8d3713e8
(
nfsd_mutex){+.+.}-{3:3}
, at: nfsd_svc+0x60/0x9e0 fs/nfsd/nfssvc.c:785
3 locks held by syz.9.669/8015:
#0:
ffff8880551fc370
(
&f->f_pos_lock
){+.+.}-{3:3}
, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
#1:
ffff888079bac460
(
sb_writers
#21
){.+.+}-{0:0}
, at: vfs_write+0x296/0xd70 fs/read_write.c:590
* Struck through repros no longer work on HEAD.