INFO: task syz.3.106:6766 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.106 state:D stack:24768 pid:6766 tgid:6765 ppid:5803 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x1553/0x5240 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7289
rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
__rt_mutex_slowlock_locked+0x1f8f/0x25c0 kernel/locking/rtmutex.c:1760
rt_mutex_slowlock+0xbd/0x170 kernel/locking/rtmutex.c:1800
__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
rwbase_write_lock+0x14d/0x730 kernel/locking/rwbase_rt.c:244
inode_lock_nested include/linux/fs.h:1073 [inline]
__start_dirop fs/namei.c:2929 [inline]
start_dirop fs/namei.c:2940 [inline]
filename_create+0x200/0x370 fs/namei.c:4928
filename_mkdirat+0xd2/0x520 fs/namei.c:5265
__do_sys_mkdirat fs/namei.c:5293 [inline]
__se_sys_mkdirat+0x35/0x150 fs/namei.c:5290
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1cdddeb687
RSP: 002b:00007f1cdc03de58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f1cdc03dee0 RCX: 00007f1cdddeb687
RDX: 00000000000001ff RSI: 00002000000001c0 RDI: 00000000ffffff9c
RBP: 0000000000000000 R08: 0000200000000100 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00002000000001c0
R13: 00007f1cdc03dea0 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz.3.106:6782 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.106 state:D stack:25192 pid:6782 tgid:6765 ppid:5803 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x1553/0x5240 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7008
io_schedule+0x80/0xe0 kernel/sched/core.c:7835
folio_wait_bit_common+0x6dd/0xbc0 mm/filemap.c:1323
folio_lock include/linux/pagemap.h:1159 [inline]
release_metapage+0x103/0xab0 fs/jfs/jfs_metapage.c:870
discard_metapage fs/jfs/jfs_metapage.h:88 [inline]
__get_metapage+0x9a3/0xde0 fs/jfs/jfs_metapage.c:753
dtSplitPage+0x791/0x37c0 fs/jfs/jfs_dtree.c:1471
dtSplitUp fs/jfs/jfs_dtree.c:1092 [inline]
dtInsert+0x10a4/0x5f10 fs/jfs/jfs_dtree.c:871
jfs_create+0x75b/0xb10 fs/jfs/namei.c:138
lookup_open fs/namei.c:4489 [inline]
open_last_lookups fs/namei.c:4589 [inline]
path_openat+0x13b4/0x38a0 fs/namei.c:4833
do_file_open+0x23e/0x4a0 fs/namei.c:4865
do_sys_openat2+0x113/0x200 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1cdddec819
RSP: 002b:00007f1cdc01d028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f1cde066090 RCX: 00007f1cdddec819
RDX: 0000000000040441 RSI: 0000200000000040 RDI: ffffffffffffff9c
RBP: 00007f1cdde82c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000106 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1cde066128 R14: 00007f1cde066090 R15: 00007ffc6c404028
Showing all locks held in the system:
1 lock held by khungtaskd/37:
#0: ffffffff8ddcb9c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8ddcb9c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8ddcb9c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:6/71:
#0: ffff888019c44138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#0: ffff888019c44138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
#1: ffffc9000156fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
#1: ffffc9000156fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
#2: ffffffff8f15cc78 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
4 locks held by kworker/u8:11/1358:
#0: ffff88801aac4138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#0: ffff88801aac4138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
#1: ffffc9000698fc40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
#1: ffffc9000698fc40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
#2: ffff88803c6ae0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:565
#3: ffff88806c96b2a8 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:108
2 locks held by dhcpcd/5460:
#0: ffff8880655da928 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: netlink_dump+0xe4/0xe80 net/netlink/af_netlink.c:2267
#1: ffffffff8f15cc78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8f15cc78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 net/core/rtnetlink.c:6848
2 locks held by getty/5550:
#0: ffff888036f9f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13c0 drivers/tty/n_tty.c:2211
4 locks held by kworker/u8:16/6732:
#0: ffff88801aee1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#0: ffff88801aee1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
#1: ffffc90005defc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
#1: ffffc90005defc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
#2: ffffffff8f14e4c0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 net/core/net_namespace.c:675
#3: ffffffff8f15cc78 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x55/0x2c0 net/mac80211/main.c:1683
2 locks held by syz.3.106/6766:
#0: ffff88803c6ae480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:493
#1: ffff88806c96b678 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1073 [inline]
#1: ffff88806c96b678 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2929 [inline]
#1: ffff88806c96b678 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2940 [inline]
#1: ffff88806c96b678 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 fs/namei.c:4928
4 locks held by syz.3.106/6782:
#0: ffff88803c6ae480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:493
#1: ffff88806c96b678 (&type->i_mutex_dir_key#8){++++}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline]
#1: ffff88806c96b678 (&type->i_mutex_dir_key#8){++++}-{4:4}, at: open_last_lookups fs/namei.c:4586 [inline]
#1: ffff88806c96b678 (&type->i_mutex_dir_key#8){++++}-{4:4}, at: path_openat+0xb5e/0x38a0 fs/namei.c:4833
#2: ffff88806c96b2a8 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_create+0x22e/0xb10 fs/jfs/namei.c:101
#3: ffff88806c969f28 (&jfs_ip->commit_mutex/1){+.+.}-{4:4}, at: jfs_create+0x249/0xb10 fs/jfs/namei.c:102
1 lock held by syz-executor/7631:
8 locks held by syz-executor/8723:
#0: ffff88803791a480 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2710 [inline]
#0: ffff88803791a480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 fs/read_write.c:684
#1: ffff88805e84e078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 fs/kernfs/file.c:343
#2: ffff8880283a8008 (kn->active#52){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff8880283a8008 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 fs/kernfs/file.c:344
#3: ffffffff8e9c9e18 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 drivers/net/netdevsim/bus.c:234
#4: ffff888064f8d160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
#4: ffff888064f8d160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1166 [inline]
#4: ffff888064f8d160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 drivers/base/dd.c:1364
#5: ffff88803fbce300 (&devlink->lock_key#13){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 drivers/net/netdevsim/dev.c:1778
#6: ffffffff8f15cc78 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0xed/0x680 drivers/net/netdevsim/netdev.c:1180
#7: ffff88803fd00f28 (&dev_instance_lock_key#24){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2785 [inline]
#7: ffff88803fd00f28 (&dev_instance_lock_key#24){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x583/0x2360 net/core/dev.c:12386
1 lock held by syz-executor/8751:
#0: ffffffff8f15cc78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#0: ffffffff8f15cc78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#0: ffffffff8f15cc78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4093
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xfd9/0x1030 kernel/hung_task.c:515
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 7631 Comm: syz-executor Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
RIP: 0010:__bfs kernel/locking/lockdep.c:1753 [inline]
RIP: 0010:__bfs_backwards kernel/locking/lockdep.c:1860 [inline]
RIP: 0010:check_irq_usage kernel/locking/lockdep.c:2796 [inline]
RIP: 0010:check_prev_add kernel/locking/lockdep.c:3169 [inline]
RIP: 0010:check_prevs_add kernel/locking/lockdep.c:3284 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3908 [inline]
RIP: 0010:__lock_acquire+0x1821/0x2cf0 kernel/locking/lockdep.c:5237
Code: 00 0f 83 8a 01 00 00 4e 8b 24 fd c0 e8 56 95 ff c0 25 ff 0f 00 00 89 05 5d 15 b7 13 4d 85 e4 0f 84 b2 01 00 00 49 8b 44 24 10 <48> 85 c0 0f 84 1c 0d 00 00 8b 0d 48 15 b7 13 39 48 5c 0f 84 67 ff
RSP: 0018:ffffc90004af6b28 EFLAGS: 00000082
RAX: ffffffff92fd1688 RBX: 00000000000003cd RCX: ffffffff95ee1f98
RDX: ffffffff95dc0c28 RSI: ffff8880306f8c58 RDI: 00000000000003cd
RBP: 7a50a7ef17da49a0 R08: ffffc90004af6af0 R09: 0000000000000020
R10: dffffc0000000000 R11: ffffffff81a0a5d0 R12: ffffffff95ee1f98
R13: ffff8880306f8c58 R14: ffff8880306f8000 R15: 0000000000000156
FS: 0000000000000000(0000) GS:ffff888126336000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8770fe8710 CR3: 0000000050300000 CR4: 00000000003526f0
Call Trace:
lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
_raw_spin_lock_nested+0x32/0x50 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:647
raw_spin_rq_lock kernel/sched/sched.h:1618 [inline]
_task_rq_lock+0xbc/0x470 kernel/sched/core.c:747
class_task_rq_lock_constructor kernel/sched/sched.h:1920 [inline]
migrate_disable_switch kernel/sched/core.c:2366 [inline]
__schedule+0x16d3/0x5240 kernel/sched/core.c:6795
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7238
irqentry_exit+0x599/0x620 kernel/entry/common.c:239
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x20b/0x2e0 kernel/locking/lockdep.c:5872
Code: e9 30 ff ff ff e8 d5 88 83 09 f7 c3 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 41 66 ae 10 48 3b 44 24 30 75 33 fb 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 2e 55 cd
RSP: 0018:ffffc90004af70c0 EFLAGS: 00000296
RAX: 4fca10b169f3fa00 RBX: 0000000000000246 RCX: 0000000000000046
RDX: 0000000090d69c99 RSI: ffffffff8d7c0ea8 RDI: ffffffff8ba67680
RBP: 0000000000000000 R08: ffffffff8b26281c R09: ffffffff8ddcb9c0
R10: dffffc0000000000 R11: fffffbfff1ed4d77 R12: 0000000000000002
R13: ffffffff8ddcb9c0 R14: 0000000000000000 R15: 0000000000000000
rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
rcu_read_lock include/linux/rcupdate.h:850 [inline]
__rt_spin_trylock kernel/locking/spinlock_rt.c:110 [inline]
rt_spin_trylock+0x128/0x2b0 kernel/locking/spinlock_rt.c:118
refill_obj_stock+0x172/0xa70 mm/memcontrol.c:3087
__memcg_slab_free_hook+0x14d/0x470 mm/memcontrol.c:3282
memcg_slab_free_hook mm/slub.c:2484 [inline]
slab_free mm/slub.c:6162 [inline]
kmem_cache_free+0x413/0x6b0 mm/slub.c:6295
free_buffer_head+0x55/0x220 fs/buffer.c:3042
try_to_free_buffers+0x25b/0x300 fs/buffer.c:2983
block_invalidate_folio+0x5f8/0x730 fs/buffer.c:1671
folio_invalidate mm/truncate.c:140 [inline]
truncate_cleanup_folio+0xcb/0x190 mm/truncate.c:160
truncate_inode_pages_range+0x2d1/0xe30 mm/truncate.c:404
ext4_evict_inode+0x2c8/0x1040 fs/ext4/inode.c:197
evict+0x61e/0xb10 fs/inode.c:846
dispose_list fs/inode.c:888 [inline]
evict_inodes+0x75a/0x7f0 fs/inode.c:942
generic_shutdown_super+0xaa/0x2d0 fs/super.c:632
kill_block_super+0x44/0x90 fs/super.c:1725
ext4_kill_sb+0x68/0xb0 fs/ext4/super.c:7484
deactivate_locked_super+0xbc/0x130 fs/super.c:476
cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x70f/0x23c0 kernel/exit.c:976
do_group_exit+0x21b/0x2d0 kernel/exit.c:1118
__do_sys_exit_group kernel/exit.c:1129 [inline]
__se_sys_exit_group kernel/exit.c:1127 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1127
x64_sys_call+0x221a/0x2240 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f56eb9cc819
Code: Unable to access opcode bytes at 0x7f56eb9cc7ef.
RSP: 002b:00007ffecdba61c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f56eba6206d RCX: 00007f56eb9cc819
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000075 R08: 0000000000000000 R09: 00007f56eba62048
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffecdba7480
R13: 00007f56eba62048 R14: 00000000000514b6 R15: 00007ffecdba9640