INFO: task syz-executor.4:4682 blocked for more than 143 seconds. Not tainted 6.1.92-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.4 state:D stack:20504 pid:4682 ppid:4015 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x142d/0x4550 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 wait_on_state fs/btrfs/extent-io-tree.c:709 [inline] wait_extent_bit+0x423/0x570 fs/btrfs/extent-io-tree.c:742 lock_extent+0x17a/0x200 fs/btrfs/extent-io-tree.c:1657 btrfs_page_mkwrite+0x550/0xc90 fs/btrfs/inode.c:8602 do_page_mkwrite+0x1a1/0x5f0 mm/memory.c:2992 wp_page_shared+0x164/0x380 mm/memory.c:3341 handle_pte_fault mm/memory.c:5031 [inline] __handle_mm_fault mm/memory.c:5155 [inline] handle_mm_fault+0x2525/0x5340 mm/memory.c:5276 do_user_addr_fault arch/x86/mm/fault.c:1371 [inline] handle_page_fault arch/x86/mm/fault.c:1462 [inline] exc_page_fault+0x26f/0x660 arch/x86/mm/fault.c:1518 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0010:copy_user_short_string+0xd/0x40 arch/x86/lib/copy_user_64.S:233 Code: 74 0a 89 d1 f3 a4 89 c8 0f 01 ca c3 89 d0 0f 01 ca c3 01 ca eb e7 0f 1f 80 00 00 00 00 89 d1 83 e2 07 c1 e9 03 74 12 4c 8b 06 <4c> 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 89 d1 8a RSP: 0018:ffffc900055f73b0 EFLAGS: 00050202 RAX: ffffffff84385601 RBX: 00007fffffffefc8 RCX: 0000000000000007 RDX: 0000000000000000 RSI: ffffc900055f7460 RDI: 00000000200002a0 RBP: ffffc900055f7510 R08: 0000000000000000 R09: fffff52000abee93 R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000038 R13: ffffc900055f7460 R14: 00000000200002a0 R15: ffffc900055f7460 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline] _copy_to_user+0xe9/0x130 lib/usercopy.c:41 copy_to_user include/linux/uaccess.h:169 [inline] fiemap_fill_next_extent+0x231/0x410 fs/ioctl.c:144 emit_fiemap_extent fs/btrfs/extent_io.c:3561 [inline] fiemap_process_hole+0x107e/0x1290 fs/btrfs/extent_io.c:3821 extent_fiemap+0xef7/0x1ff0 btrfs_fiemap+0x174/0x1e0 fs/btrfs/inode.c:8274 ioctl_fiemap fs/ioctl.c:219 [inline] do_vfs_ioctl+0x18e9/0x2a90 fs/ioctl.c:810 __do_sys_ioctl fs/ioctl.c:868 [inline] __se_sys_ioctl+0x81/0x160 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fac54e7cee9 RSP: 002b:00007fac55b330c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fac54fb3f80 RCX: 00007fac54e7cee9 RDX: 0000000020000280 RSI: 00000000c020660b RDI: 0000000000000004 RBP: 00007fac54eda6fe R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fac54fb3f80 R15: 00007ffdf5427be8 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8d12ae50 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:516 1 lock held by rcu_tasks_trace/13: #0: ffffffff8d12b650 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:516 1 lock held by khungtaskd/27: #0: ffffffff8d12ac80 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8d12ac80 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8d12ac80 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6494 3 locks held by kworker/u5:0/48: #0: ffff888016327938 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90000b97d20 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffff88807675d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1dc/0x400 net/bluetooth/hci_sync.c:308