INFO: task syz.6.87:7121 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.87 state:D stack:25256 pid:7121 tgid:7121 ppid:6482 task_flags:0x400040 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:5360 [inline]
__schedule+0x1798/0x4cc0 kernel/sched/core.c:6964
__schedule_loop kernel/sched/core.c:7046 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7061
io_schedule+0x80/0xd0 kernel/sched/core.c:7906
folio_wait_bit_common+0x6b0/0xb90 mm/filemap.c:1330
folio_lock include/linux/pagemap.h:1141 [inline]
writeback_get_folio mm/page-writeback.c:2468 [inline]
writeback_iter+0x8d8/0x12a0 mm/page-writeback.c:2562
iomap_writepages+0x14d/0x2d0 fs/iomap/buffered-io.c:1761
gfs2_writepages+0x177/0x250 fs/gfs2/aops.c:175
do_writepages+0x32b/0x550 mm/page-writeback.c:2604
filemap_fdatawrite_wbc mm/filemap.c:389 [inline]
__filemap_fdatawrite_range mm/filemap.c:422 [inline]
__filemap_fdatawrite mm/filemap.c:428 [inline]
filemap_fdatawrite+0x199/0x240 mm/filemap.c:433
gfs2_ordered_write fs/gfs2/log.c:733 [inline]
gfs2_log_flush+0x966/0x24c0 fs/gfs2/log.c:1102
gfs2_trans_end+0x37c/0x570 fs/gfs2/trans.c:158
gfs2_page_mkwrite+0x14a8/0x1910 fs/gfs2/file.c:535
do_page_mkwrite+0x14a/0x310 mm/memory.c:3489
wp_page_shared mm/memory.c:3890 [inline]
do_wp_page+0x268d/0x5800 mm/memory.c:4109
handle_pte_fault mm/memory.c:6198 [inline]
__handle_mm_fault+0x1033/0x5400 mm/memory.c:6323
handle_mm_fault+0x40a/0x8e0 mm/memory.c:6492
do_user_addr_fault+0xa81/0x1390 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7f8c44f56958
RSP: 002b:00007ffe07340988 EFLAGS: 00010206
RAX: 0000200000000200 RBX: 0000000000000004 RCX: 00676e7277682f76
RDX: 000000000000000b RSI: 7277682f7665642f RDI: 0000200000000200
RBP: 00007f8c451c7da0 R08: 0000001b31120000 R09: 0000000000000001
R10: 0000000000000001 R11: 0000000000000009 R12: 00007f8c451c5fac
R13: 00007f8c451c5fa0 R14: fffffffffffffffe R15: 00007ffe07340aa0
Showing all locks held in the system:
4 locks held by kworker/u8:1/13:
#0: ffff88801baf3948 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88801baf3948 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90000127ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90000127ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffff8880260220e0 (&type->s_umount_key#92){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:562
#3: ffff88804d074e50 (&sdp->sd_log_flush_lock){++++}-{4:4}, at: gfs2_log_flush+0x103/0x24c0 fs/gfs2/log.c:1045
1 lock held by khungtaskd/31:
#0: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/0:2/981:
#0: ffff88801a871548 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88801a871548 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffff8880b8624008 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
#2: ffff88807bd75240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x26b/0x3180 drivers/net/netdevsim/fib.c:1490
3 locks held by dhcpcd/5527:
#0: ffff8880b8739f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:636
#1: ffff8880b8724008 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
#2: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#2: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#2: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: rhashtable_lookup_fast include/linux/rhashtable.h:671 [inline]
#2: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: __netlink_lookup+0xbd/0x810 net/netlink/af_netlink.c:498
2 locks held by getty/6828:
#0: ffff88814dd250a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900032602f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
4 locks held by syz.6.87/7121:
#0: ffff88804847e808 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1a3/0x450 mm/mmap_lock.c:238
#1: ffff888026022518 (sb_pagefaults#2){.+.+}-{0:0}, at: do_page_mkwrite+0x14a/0x310 mm/memory.c:3489
#2: ffff888026022610 (sb_internal#4){.+.+}-{0:0}, at: gfs2_trans_begin+0x6f/0xe0 fs/gfs2/trans.c:118
#3: ffff88804d074e50 (&sdp->sd_log_flush_lock){++++}-{4:4}, at: gfs2_log_flush+0x103/0x24c0 fs/gfs2/log.c:1045
1 lock held by gfs2_logd/syz:s/7126:
#0: ffff88804d074e50 (&sdp->sd_log_flush_lock){++++}-{4:4}, at: gfs2_log_flush+0x103/0x24c0 fs/gfs2/log.c:1045
1 lock held by dhcpcd/7897:
#0: ffff888056275e08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:861 [inline]
#0: ffff888056275e08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release net/socket.c:648 [inline]
#0: ffff888056275e08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 net/socket.c:1439
3 locks held by kworker/u8:13/8145:
#0: ffff88801b6fe948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88801b6fe948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90003effba0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90003effba0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffffffff8f732990 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 net/core/net_namespace.c:658
1 lock held by syz.2.385/9147:
#0: ffffffff8e342880 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 kernel/rcu/tree.c:3820
2 locks held by syz.5.410/9359:
#0: ffff8880260220e0 (&type->s_umount_key#92){++++}-{4:4}, at: __super_lock fs/super.c:59 [inline]
#0: ffff8880260220e0 (&type->s_umount_key#92){++++}-{4:4}, at: super_lock+0x2a9/0x3b0 fs/super.c:121
#1: ffff8880252ba7d0 (&bdi->wb_switch_rwsem){+.+.}-{4:4}, at: bdi_down_write_wb_switch_rwsem fs/fs-writeback.c:387 [inline]
#1: ffff8880252ba7d0 (&bdi->wb_switch_rwsem){+.+.}-{4:4}, at: sync_inodes_sb+0x19f/0xa10 fs/fs-writeback.c:2832
1 lock held by syz.2.422/9438:
#0: ffffffff8e3429b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
#0: ffffffff8e3429b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 kernel/rcu/tree_exp.h:957
4 locks held by dhcpcd-run-hook/9451:
#0: ffff8880b8739f98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:636
#1: ffff8880b8724008 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
#2: ffff888031e472b8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
#2: ffff888031e472b8 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0x13e/0x210 mm/pgtable-generic.c:401
#3: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#3: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#3: ffffffff8e33cf20 (rcu_read_lock){....}-{1:3}, at: page_table_check_set+0x18d/0x730 mm/page_table_check.c:112
2 locks held by sed/9459:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf60/0xfa0 kernel/hung_task.c:495
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x47c/0x820 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 5926 Comm: kworker/1:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: events free_obj_work
RIP: 0010:check_preemption_disabled+0x63/0x120 lib/smp_processor_id.c:19
Code: 08 0f 85 cc 00 00 00 48 83 c4 10 5b 41 5e 41 5f 5d e9 51 c9 02 00 cc 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 <74> c8 65 4c 8b 3c 25 08 70 c2 92 41 f6 47 2f 04 74 0a 41 83 bf 58
RSP: 0018:ffffc900044df3e0 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000080000000
RDX: 0000000000000000 RSI: ffffffff8dbd21a2 RDI: ffffffff8c037200
RBP: ffffffff8173bcb5 R08: 0000000000000000 R09: 0000000000000000
R10: ffffc900044df5d8 R11: ffffffff81ad3e20 R12: 0000000000000002
R13: ffffffff8e33cf20 R14: 0000000000000000 R15: 0000000000000246
FS: 0000000000000000(0000) GS:ffff888125af9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055d5ee758660 CR3: 000000000e138000 CR4: 00000000003526f0
Call Trace:
lockdep_recursion_inc kernel/locking/lockdep.c:465 [inline]
lock_acquire+0xe7/0x360 kernel/locking/lockdep.c:5867
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xc2/0x2390 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
__kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2484 [inline]
slab_free mm/slub.c:6121 [inline]
kmem_cache_free+0x19a/0x690 mm/slub.c:6232
free_object_list lib/debugobjects.c:326 [inline]
free_obj_work+0x377/0x4a0 lib/debugobjects.c:513
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x47c/0x820 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245