INFO: task syz.1.168:7140 blocked for more than 143 seconds.
Tainted: G W 6.16.0-syzkaller-11952-g6e64f4580381 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.168 state:D stack:22120 pid:7140 tgid:7139 ppid:5846 task_flags:0x400140 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x16f3/0x4c20 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7058
io_schedule+0x81/0xe0 kernel/sched/core.c:7903
TXN_SLEEP_DROP_LOCK fs/jfs/jfs_txnmgr.c:125 [inline]
txBeginAnon+0x154/0x3f0 fs/jfs/jfs_txnmgr.c:468
extAlloc+0x124/0xfb0 fs/jfs/jfs_extent.c:83
jfs_get_block+0x346/0xab0 fs/jfs/inode.c:248
__block_write_begin_int+0x6b2/0x1900 fs/buffer.c:2145
block_write_begin+0x8a/0x120 fs/buffer.c:2256
jfs_write_begin+0x35/0x80 fs/jfs/inode.c:300
generic_perform_write+0x29d/0x8c0 mm/filemap.c:4175
generic_file_write_iter+0x118/0x550 mm/filemap.c:4318
do_iter_readv_writev+0x57d/0x800 fs/read_write.c:-1
vfs_writev+0x323/0x970 fs/read_write.c:1057
do_pwritev fs/read_write.c:1153 [inline]
__do_sys_pwritev2 fs/read_write.c:1211 [inline]
__se_sys_pwritev2+0x17c/0x2a0 fs/read_write.c:1202
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f84fb46ebe9
RSP: 002b:00007f84f96d6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000148
RAX: ffffffffffffffda RBX: 00007f84fb695fa0 RCX: 00007f84fb46ebe9
RDX: 0000000000000001 RSI: 00002000000001c0 RDI: 0000000000000004
RBP: 00007f84fb4f1e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000e7b R11: 0000000000000246 R12: 0000000000000000
R13: 00007f84fb696038 R14: 00007f84fb695fa0 R15: 00007ffe96e7fff8
Showing all locks held in the system:
1 lock held by khungtaskd/38:
#0: ffffffff8d9a8b80 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d9a8b80 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8d9a8b80 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
6 locks held by kworker/u8:2/43:
#0: ffff888019881138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888019881138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319
#1: ffffc90000b47bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc90000b47bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319
#2: ffff88806003a300 (&devlink->lock_key#12){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:853
#3: ffff88805dcff520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff88805dcff520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:806 [inline]
#3: ffff88805dcff520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:866
#4: ffffffff8d9a8b80 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d9a8b80 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#4: ffffffff8d9a8b80 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d9a8b80 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1bb/0x2c0 kernel/locking/spinlock_rt.c:57
#5: ffff8880b893f968 ((&c->lock)){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff8880b893f968 ((&c->lock)){+.+.}-{3:3}, at: ___slab_alloc+0x25c/0xdd0 mm/slub.c:3768
6 locks held by kworker/u8:4/68:
3 locks held by kworker/u8:5/70:
#0: ffff88814cad2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff88814cad2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319
#1: ffffc9000155fbc0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc9000155fbc0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319
#2: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#2: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x119/0x15a0 net/ipv6/addrconf.c:4194
4 locks held by kworker/u8:10/3530:
4 locks held by kworker/u8:14/4602:
#0: ffff88801a6f4138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff88801a6f4138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319
#1: ffffc9000ef87bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc9000ef87bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319
#2: ffffffff8ecc10e0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 net/core/net_namespace.c:658
#3: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: wg_destruct+0x25/0x2f0 drivers/net/wireguard/device.c:246
2 locks held by dhcpcd/5500:
#0: ffffffff8ecb24b8 (vlan_ioctl_mutex){+.+.}-{4:4}, at: sock_ioctl+0x5f1/0x790 net/socket.c:1321
#1: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: vlan_ioctl_handler+0xd0/0x650 net/8021q/vlan.c:577
2 locks held by getty/5600:
#0: ffff88823bf768a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1410 drivers/tty/n_tty.c:2222
5 locks held by kworker/1:5/5928:
#0: ffff88814ca43d38 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff88814ca43d38 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3319
#1: ffffc900051ffbc0 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc900051ffbc0 ((work_completion)(&(&idev->mc_dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3319
#2: ffff888037972628 (&idev->mc_lock){+.+.}-{4:4}, at: mld_dad_work+0x3e/0x490 net/ipv6/mcast.c:2298
#3: ffffffff8dac5348 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:161 [inline]
#3: ffffffff8dac5348 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:253
#4: ffff8880b893f968 ((&c->lock)){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#4: ffff8880b893f968 ((&c->lock)){+.+.}-{3:3}, at: put_cpu_partial+0x3d/0x100 mm/slub.c:3265
3 locks held by syz.1.168/7140:
#0: ffff888038fec488 (sb_writers#17){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:3107 [inline]
#0: ffff888038fec488 (sb_writers#17){.+.+}-{0:0}, at: vfs_writev+0x28e/0x970 fs/read_write.c:1055
#1: ffff88805d9de7d8 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:869 [inline]
#1: ffff88805d9de7d8 (&sb->s_type->i_mutex_key#25){+.+.}-{4:4}, at: generic_file_write_iter+0xec/0x550 mm/filemap.c:4315
#2: ffff88805d9de388 (&jfs_ip->rdwrlock#3){++++}-{4:4}, at: jfs_get_block+0x141/0xab0 fs/jfs/inode.c:213
1 lock held by syz-executor/7678:
#0: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline]
#0: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3433
1 lock held by syz-executor/7782:
#0: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 net/ipv4/devinet.c:979
4 locks held by syz-executor/7920:
#0: ffff8880343ac488 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:3107 [inline]
#0: ffff8880343ac488 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x217/0xaa0 fs/read_write.c:682
#1: ffff88805451c478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1e1/0x4f0 fs/kernfs/file.c:325
#2: ffff888144f7ba58 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x204/0x4f0 fs/kernfs/file.c:326
#3: ffffffff8e53e6b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x12c/0x6f0 drivers/net/netdevsim/bus.c:184
7 locks held by syz-executor/7939:
#0: ffff8880343ac488 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:3107 [inline]
#0: ffff8880343ac488 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x217/0xaa0 fs/read_write.c:682
#1: ffff888028e75078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1e1/0x4f0 fs/kernfs/file.c:325
#2: ffff888144f7bb48 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x204/0x4f0 fs/kernfs/file.c:326
#3: ffffffff8e53e6b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x360 drivers/net/netdevsim/bus.c:234
#4: ffff888027cc30d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:911 [inline]
#4: ffff888027cc30d8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1096 [inline]
#4: ffff888027cc30d8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x800 drivers/base/dd.c:1294
#5: ffff88805c917300 (&devlink->lock_key#11){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 drivers/net/netdevsim/dev.c:1721
#6: ffffffff8d9ae530 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 kernel/rcu/tree.c:3815
2 locks held by syz-executor/8101:
#0: ffffffff8ecc10e0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0 net/core/net_namespace.c:566
#1: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock_killable include/linux/rtnetlink.h:145 [inline]
#1: ffffffff8eccdfb8 (rtnl_mutex){+.+.}-{4:4}, at: register_netdev+0x18/0x60 net/core/dev.c:11310
3 locks held by syz.0.439/8143:
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Tainted: G W 6.16.0-syzkaller-11952-g6e64f4580381 #0 PREEMPT_{RT,(full)}
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0xf93/0xfe0 kernel/hung_task.c:491
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 3530 Comm: kworker/u8:10 Tainted: G W 6.16.0-syzkaller-11952-g6e64f4580381 #0 PREEMPT_{RT,(full)}
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: bat_events batadv_nc_worker
RIP: 0010:lock_is_held include/linux/lockdep.h:-1 [inline]
RIP: 0010:try_to_take_rt_mutex+0x4f/0xb00 kernel/locking/rtmutex.c:1090
Code: 11 1d 8f 48 c1 e8 03 0f b6 04 10 84 c0 0f 85 d2 08 00 00 83 3d d1 fd 24 04 00 74 20 49 8d 7e 18 be ff ff ff ff e8 21 51 fd ff <48> ba 00 00 00 00 00 fc ff df 85 c0 0f 84 58 08 00 00 4d 8d 6e 50
RSP: 0018:ffffc9000d1f75a0 EFLAGS: 00000082
RAX: 0000000000000001 RBX: 1ffff92001a3eeec RCX: 6cab7597af12c500
RDX: dffffc0000000000 RSI: ffffffff8d214e97 RDI: ffffffff8b61fb80
RBP: ffffc9000d1f7870 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52001a3eeec R12: 0000000000000000
R13: ffffc9000d1f78c8 R14: ffff88805c013000 R15: ffff888031120000
FS: 0000000000000000(0000) GS:ffff8881268cb000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f01467ab000 CR3: 00000000291b2000 CR4: 00000000003526f0
Call Trace:
rtlock_slowlock_locked+0xd8/0x4010 kernel/locking/rtmutex.c:1839
rtlock_slowlock kernel/locking/rtmutex.c:1895 [inline]
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
rt_spin_lock+0x152/0x2c0 kernel/locking/spinlock_rt.c:57
spin_lock_bh include/linux/spinlock_rt.h:88 [inline]
batadv_nc_purge_paths+0x104/0x3f0 net/batman-adv/network-coding.c:442
batadv_nc_worker+0x8c8/0xbc0 net/batman-adv/network-coding.c:722
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245