INFO: task syz-executor.3:13958 blocked for more than 143 seconds. Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:18872 pid:13958 ppid:8110 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x9d1/0xe40 kernel/sched/core.c:6555 schedule+0xcb/0x190 kernel/sched/core.c:6631 wb_wait_for_completion+0x165/0x290 fs/fs-writeback.c:192 __writeback_inodes_sb_nr+0x2f0/0x3d0 fs/fs-writeback.c:2639 try_to_writeback_inodes_sb+0xa5/0xd0 fs/fs-writeback.c:2687 ext4_nonda_switch fs/ext4/inode.c:3029 [inline] ext4_da_write_begin+0x243/0x760 fs/ext4/inode.c:3056 generic_perform_write+0x314/0x610 mm/filemap.c:3772 ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285 ext4_file_write_iter+0x1d0/0x1900 __kernel_write_iter+0x323/0x770 fs/read_write.c:517 dump_emit_page+0xa79/0xca0 fs/coredump.c:864 dump_user_range+0x5b/0xf0 fs/coredump.c:915 elf_core_dump+0x3ca3/0x45d0 fs/binfmt_elf.c:2137 do_coredump+0x180a/0x27d0 fs/coredump.c:762 get_signal+0x1490/0x1820 kernel/signal.c:2845 arch_do_signal_or_restart+0x8d/0x5f0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop+0x74/0x160 kernel/entry/common.c:168 exit_to_user_mode_prepare+0xad/0x110 kernel/entry/common.c:203 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:309 exc_page_fault+0xa2/0x120 arch/x86/mm/fault.c:1578 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0033:0x8b30a4 RSP: 002b:0000000020000338 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007f69e9dabf80 RCX: 00007f69e9c8c0d9 RDX: 0000000020000380 RSI: 0000000020000330 RDI: 0000000000200000 RBP: 00007f69e9ce7ae9 R08: 0000000020000400 R09: 0000000020000400 R10: 00000000200003c0 R11: 0000000000000206 R12: 0000000000000000 R13: 00007ffe8a038e9f R14: 00007f69eaa3c300 R15: 0000000000022000 INFO: task syz-executor.3:14150 blocked for more than 145 seconds. Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:21080 pid:14150 ppid:8110 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x9d1/0xe40 kernel/sched/core.c:6555 schedule+0xcb/0x190 kernel/sched/core.c:6631 wb_wait_for_completion+0x165/0x290 fs/fs-writeback.c:192 __writeback_inodes_sb_nr+0x2f0/0x3d0 fs/fs-writeback.c:2639 try_to_writeback_inodes_sb+0xa5/0xd0 fs/fs-writeback.c:2687 ext4_nonda_switch fs/ext4/inode.c:3029 [inline] ext4_da_write_begin+0x243/0x760 fs/ext4/inode.c:3056 generic_perform_write+0x314/0x610 mm/filemap.c:3772 ext4_buffered_write_iter+0x122/0x3a0 fs/ext4/file.c:285 ext4_file_write_iter+0x1d0/0x1900 __kernel_write_iter+0x323/0x770 fs/read_write.c:517 dump_emit_page+0xa79/0xca0 fs/coredump.c:864 dump_user_range+0x5b/0xf0 fs/coredump.c:915 elf_core_dump+0x3ca3/0x45d0 fs/binfmt_elf.c:2137 do_coredump+0x180a/0x27d0 fs/coredump.c:762 get_signal+0x1490/0x1820 kernel/signal.c:2845 arch_do_signal_or_restart+0x8d/0x5f0 arch/x86/kernel/signal.c:306 exit_to_user_mode_loop+0x74/0x160 kernel/entry/common.c:168 exit_to_user_mode_prepare+0xad/0x110 kernel/entry/common.c:203 irqentry_exit_to_user_mode+0x5/0x30 kernel/entry/common.c:309 exc_page_fault+0xa2/0x120 arch/x86/mm/fault.c:1578 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0033:0xdb7 RSP: 002b:00000000200000f8 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007f69e9dabf80 RCX: 00007f69e9c8c0d9 RDX: 0000000020000100 RSI: 00000000200000f0 RDI: 0000000000000000 RBP: 00007f69e9ce7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe8a038e9f R14: 00007f69eaa3c300 R15: 0000000000022000 Showing all locks held in the system: 3 locks held by kworker/u4:0/9: #0: ffff888144fb2138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x796/0xd10 kernel/workqueue.c:2262 #1: ffffc900000e7d00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0xd10 kernel/workqueue.c:2264 #2: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8d3238d0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x30/0xd00 kernel/rcu/tasks.h:507 1 lock held by rcu_tasks_trace/13: #0: ffffffff8d3240d0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x30/0xd00 kernel/rcu/tasks.h:507 1 lock held by khungtaskd/28: #0: ffffffff8d323700 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 2 locks held by getty/4737: #0: ffff88814a726098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc900015902f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6e8/0x1e50 drivers/tty/n_tty.c:2177 3 locks held by syz-executor.3/13958: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff888073560e08 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff888073560e08 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 #2: ffff88814b8820e0 (&type->s_umount_key#30){++++}-{3:3}, at: try_to_writeback_inodes_sb+0x20/0xd0 fs/fs-writeback.c:2684 3 locks held by syz-executor.3/14150: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff888031cba218 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff888031cba218 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 #2: ffff88814b8820e0 (&type->s_umount_key#30){++++}-{3:3}, at: try_to_writeback_inodes_sb+0x20/0xd0 fs/fs-writeback.c:2684 2 locks held by syz-executor.2/14736: #0: ffff888075ca2218 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: iterate_dir+0x121/0x5f0 fs/readdir.c:55 #1: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: file_accessed include/linux/fs.h:2516 [inline] #1: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: iterate_dir+0x514/0x5f0 fs/readdir.c:70 1 lock held by syz-executor.3/15032: #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1811 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1933 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x4cd/0x10b0 fs/ext4/inode.c:240 1 lock held by syz-executor.3/16121: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.2/16129: #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1811 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1933 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x4cd/0x10b0 fs/ext4/inode.c:240 1 lock held by syz-executor.3/16251: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.2/16349: #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1811 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1933 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x4cd/0x10b0 fs/ext4/inode.c:240 1 lock held by syz-executor.2/16436: #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1811 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1933 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x4cd/0x10b0 fs/ext4/inode.c:240 1 lock held by syz-executor.2/16510: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.2/16544: #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1811 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1933 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x4cd/0x10b0 fs/ext4/inode.c:240 1 lock held by syz-executor.2/16587: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.3/16651: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.0/16688: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.3/16690: #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1811 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1933 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x4cd/0x10b0 fs/ext4/inode.c:240 1 lock held by syz-executor.5/16901: #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: __sb_start_write include/linux/fs.h:1811 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: sb_start_intwrite include/linux/fs.h:1933 [inline] #0: ffff88814b882650 (sb_internal){.+.+}-{0:0}, at: ext4_evict_inode+0x4cd/0x10b0 fs/ext4/inode.c:240 1 lock held by syz-executor.3/17037: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.2/17038: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.3/17064: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.2/17176: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.0/17189: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.0/17260: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.2/18332: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.0/18334: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.3/18338: 1 lock held by syz-executor.0/18349: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.2/18350: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.3/18354: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.2/18359: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.0/18362: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 1 lock held by syz-executor.3/18367: #0: ffff88814b884b98 (&sbi->s_writepages_rwsem){.+.+}-{0:0}, at: ext4_writepages+0x1d8/0x290 fs/ext4/inode.c:2964 2 locks held by syz-executor.4/18372: #0: ffff888038a68400 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: iterate_dir+0x121/0x5f0 fs/readdir.c:55 #1: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: file_accessed include/linux/fs.h:2516 [inline] #1: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: iterate_dir+0x514/0x5f0 fs/readdir.c:70 2 locks held by syz-executor.5/18376: #0: ffff888075ca6850 (&type->i_mutex_dir_key#3){++++}-{3:3}, at: iterate_dir+0x121/0x5f0 fs/readdir.c:55 #1: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: file_accessed include/linux/fs.h:2516 [inline] #1: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: iterate_dir+0x514/0x5f0 fs/readdir.c:70 2 locks held by syz-executor.5/18551: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff88805d002c20 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff88805d002c20 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.2/18566: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff8880311ad440 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff8880311ad440 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.0/18567: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff8880311ade48 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff8880311ade48 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.3/18576: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff888046015440 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff888046015440 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.5/18578: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff88803786b628 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff88803786b628 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.2/18602: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff8880327eb628 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff8880327eb628 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.3/18604: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff8880438cb628 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff8880438cb628 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.0/18610: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff8880327eca38 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff8880327eca38 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.5/18619: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff8880522b2218 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff8880522b2218 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 2 locks held by syz-executor.0/18652: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff888073560400 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff888073560400 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 3 locks held by syz-executor.3/18660: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff8880423bc030 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff8880423bc030 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 #2: ffff88814b8863f8 (&journal->j_checkpoint_mutex){+.+.}-{3:3}, at: jbd2_log_do_checkpoint+0xd11/0x14c0 fs/jbd2/checkpoint.c:284 2 locks held by syz-executor.5/18664: 2 locks held by syz-executor.2/18670: 3 locks held by syz-executor.5/18699: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff888073650e08 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff888073650e08 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 #2: ffff88814b8863f8 (&journal->j_checkpoint_mutex){+.+.}-{3:3}, at: jbd2_log_do_checkpoint+0xd11/0x14c0 fs/jbd2/checkpoint.c:284 3 locks held by syz-executor.0/18704: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff888073652218 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff888073652218 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 #2: ffff88814b8863f8 (&journal->j_checkpoint_mutex){+.+.}-{3:3}, at: jbd2_log_do_checkpoint+0xd11/0x14c0 fs/jbd2/checkpoint.c:284 3 locks held by syz-executor.2/18716: 2 locks held by syz-executor.3/18728: 2 locks held by syz-executor.5/18747: 2 locks held by syz-executor.0/18752: 2 locks held by syz-executor.3/18773: 3 locks held by syz-executor.2/18775: 3 locks held by syz-executor.0/18880: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff88805b3bb628 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff88805b3bb628 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 #2: ffffffff8d323700 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:324 3 locks held by syz-executor.5/18881: 2 locks held by syz-executor.2/18893: 3 locks held by syz-executor.3/18894: 3 locks held by syz-executor.0/18931: #0: ffff88814b882460 (sb_writers#4){.+.+}-{0:0}, at: do_coredump+0x17e5/0x27d0 fs/coredump.c:761 #1: ffff888043b90e08 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #1: ffff888043b90e08 (&sb->s_type->i_mutex_key#7){++++}-{3:3}, at: ext4_buffered_write_iter+0xae/0x3a0 fs/ext4/file.c:279 #2: ffff8880b993a1d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x110 kernel/sched/core.c:537 2 locks held by syz-executor.2/18945: 3 locks held by syz-executor.3/18956: 2 locks held by syz-executor.5/18973: 2 locks held by syz-executor.0/19015: 2 locks held by syz-executor.3/19025: 2 locks held by syz-executor.2/19026: 2 locks held by syz-executor.5/19038: 2 locks held by syz-executor.5/19137: 2 locks held by syz-executor.0/19184: 3 locks held by syz-executor.3/19191: 3 locks held by syz-executor.2/19200: 2 locks held by syz-executor.0/19213: 3 locks held by syz-executor.2/19266: 3 locks held by syz-executor.0/19318: 2 locks held by syz-executor.5/19403: 2 locks held by syz-executor.2/19404: 2 locks held by syz-executor.0/19416: 3 locks held by syz-executor.3/19449: 2 locks held by syz-executor.5/19469: 2 locks held by syz-executor.2/19486: 1 lock held by syz-executor.4/19546: #0: ffffffff8d328d38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline] #0: ffffffff8d328d38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a6/0x890 kernel/rcu/tree_exp.h:946 2 locks held by syz-executor.0/19551: 1 lock held by syz-executor.0/19558: #0: ffffffff8d328d38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline] #0: ffffffff8d328d38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x46f/0x890 kernel/rcu/tree_exp.h:946 1 lock held by syz-executor.5/19596: 2 locks held by syz-executor.5/19600: 2 locks held by syz-executor.2/19603: 1 lock held by syz-executor.3/19606: 2 locks held by syz-executor.0/19611: 1 lock held by syz-executor.2/19612: 1 lock held by syz-executor.5/19614: 1 lock held by sed/19615: #0: ffff8880b993a1d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x110 kernel/sched/core.c:537 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 nmi_cpu_backtrace+0x4e3/0x560 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x19b/0x3e0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xcd5/0xd20 kernel/hung_task.c:377 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 56 Comm: kworker/u4:4 Not tainted 6.1.0-syzkaller-13031-g77856d911a8c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: bat_events batadv_nc_worker RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:35 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:106 [inline] RIP: 0010:__local_bh_disable_ip+0xb7/0x210 kernel/softirq.c:323 Code: 0f 85 5a 01 00 00 4c 89 f3 48 c1 eb 03 42 80 3c 23 00 74 08 4c 89 f7 e8 27 b1 8e 00 48 c7 44 24 60 00 00 00 00 9c 8f 44 24 60 <42> 80 3c 23 00 74 08 4c 89 f7 e8 8a b0 8e 00 48 8d 7c 24 40 4c 8b RSP: 0018:ffffc90001577a40 EFLAGS: 00000246 RAX: 0000000080000000 RBX: 1ffff920002aef54 RCX: 1ffff110041641a9 RDX: 0000000000000000 RSI: 0000000000000201 RDI: ffffffff8a858d30 RBP: ffffc90001577b18 R08: dffffc0000000000 R09: fffffbfff20ec24b R10: fffffbfff20ec24b R11: 1ffffffff20ec24a R12: dffffc0000000000 R13: 1ffff920002aef4c R14: ffffc90001577aa0 R15: 0000000000000201 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555e0b1cfb08 CR3: 000000000d08e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __raw_spin_lock_bh include/linux/spinlock_api_smp.h:125 [inline] _raw_spin_lock_bh+0x18/0x40 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] batadv_nc_purge_paths+0xe0/0x3f0 net/batman-adv/network-coding.c:442 batadv_nc_worker+0x2da/0x5b0 net/batman-adv/network-coding.c:720 process_one_work+0x81c/0xd10 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308