INFO: task syz.9.1806:23453 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.1806 state:D stack:25576 pid:23453 tgid:23452 ppid:18156 task_flags:0x400140 flags:0x00080003
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x16f3/0x4c20 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7026
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
kthread_flush_worker+0x1c6/0x240 kernel/kthread.c:1564
__alloc_workqueue+0x1470/0x1b70 kernel/workqueue.c:5795
alloc_workqueue_noprof+0xd4/0x210 kernel/workqueue.c:5818
btrfs_alloc_workqueue+0x1ec/0x2d0 fs/btrfs/async-thread.c:112
btrfs_init_workqueues+0x62/0x6c0 fs/btrfs/disk-io.c:1965
open_ctree+0x141d/0x3d20 fs/btrfs/disk-io.c:3426
btrfs_fill_super fs/btrfs/super.c:987 [inline]
btrfs_get_tree_super fs/btrfs/super.c:1952 [inline]
btrfs_get_tree_subvol fs/btrfs/super.c:2089 [inline]
btrfs_get_tree+0xf5a/0x1830 fs/btrfs/super.c:2123
vfs_get_tree+0x92/0x2b0 fs/super.c:1751
fc_mount fs/namespace.c:1208 [inline]
do_new_mount_fc fs/namespace.c:3651 [inline]
do_new_mount+0x302/0xa10 fs/namespace.c:3727
do_mount fs/namespace.c:4050 [inline]
__do_sys_mount fs/namespace.c:4238 [inline]
__se_sys_mount+0x313/0x410 fs/namespace.c:4215
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5113d2066a
RSP: 002b:00007f5111f85e68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f5111f85ef0 RCX: 00007f5113d2066a
RDX: 0000200000000000 RSI: 00002000000015c0 RDI: 00007f5111f85eb0
RBP: 0000200000000000 R08: 00007f5111f85ef0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00002000000015c0
R13: 00007f5111f85eb0 R14: 000000000000559e R15: 0000200000001600
Showing all locks held in the system:
1 lock held by khungtaskd/39:
#0: ffffffff8d3aa400 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d3aa400 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d3aa400 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by kworker/u8:5/71:
#0: ffff88805bbdb938 ((wq_completion)btrfs-flush_delalloc#272){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88805bbdb938 ((wq_completion)btrfs-flush_delalloc#272){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc9000156fbc0 ((work_completion)(&work->normal_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc9000156fbc0 ((work_completion)(&work->normal_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
9 locks held by kworker/u8:9/1478:
2 locks held by getty/5571:
#0: ffff88823bf780a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222
4 locks held by syz-executor/18271:
#0: ffff88805b5f40d0 (&type->s_umount_key#60){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
#0: ffff88805b5f40d0 (&type->s_umount_key#60){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
#0: ffff88805b5f40d0 (&type->s_umount_key#60){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:505
#1: ffff888034fdc0d0 (&type->s_umount_key#54){++++}-{4:4}, at: ovl_sync_fs+0x127/0x160 fs/overlayfs/super.c:253
#2: ffff888050b10ee8 (&fs_info->ordered_operations_mutex){+.+.}-{4:4}, at: btrfs_wait_ordered_roots+0xdb/0x6b0 fs/btrfs/ordered-data.c:828
#3: ffff888035f349a8 (&root->ordered_extent_mutex){+.+.}-{4:4}, at: btrfs_wait_ordered_extents+0x217/0xcc0 fs/btrfs/ordered-data.c:772
1 lock held by syz.9.1806/23453:
#0: ffff88805d1e20d0 (&type->s_umount_key#51/1){+.+.}-{4:4}, at: alloc_super+0x1ba/0x9a0 fs/super.c:344
4 locks held by syz-executor/23718:
2 locks held by syz.2.1974/26029:
3 locks held by syz.7.1977/26077:
5 locks held by syz.8.1978/26082:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf60/0xfa0 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x436/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 3 Comm: pool_workqueue_ Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:remove_class_from_lock_chain kernel/locking/lockdep.c:6197 [inline]
RIP: 0010:remove_class_from_lock_chains kernel/locking/lockdep.c:6236 [inline]
RIP: 0010:zap_class+0xc2/0x360 kernel/locking/lockdep.c:6281
Code: 49 81 fc 00 00 08 00 0f 84 a5 01 00 00 4e 8b 2c e5 40 a3 43 92 4d 85 ed 0f 94 c0 49 83 c5 f8 0f 94 c1 08 c1 75 d7 45 8b 7d 00 <41> f6 c7 fc 0f 84 e2 00 00 00 41 c1 ef 08 4e 8d 34 7d 10 a3 88 91
RSP: 0018:ffffc90000087bc0 EFLAGS: 00000046
RAX: 00000000001b0c00 RBX: 000000000000106f RCX: 00000000001b0c00
RDX: ffffffff9283a358 RSI: ffffffff9283a358 RDI: ffffffff923579d8
RBP: ffffffff9287a7b0 R08: 0000000000000000 R09: ffffffff81a7ce68
R10: dffffc0000000000 R11: fffffbfff1d6bbc7 R12: 0000000000000bfb
R13: ffffffff93142830 R14: ffffffff91bebc1a R15: 0000000017607b24
FS: 0000000000000000(0000) GS:ffff888127120000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007effebc34000 CR3: 0000000066a4a000 CR4: 00000000003526f0
Call Trace:
__lockdep_free_key_range kernel/locking/lockdep.c:6407 [inline]
lockdep_unregister_key+0x1a6/0x310 kernel/locking/lockdep.c:6609
wq_unregister_lockdep kernel/workqueue.c:4848 [inline]
pwq_release_workfn+0x6d2/0x870 kernel/workqueue.c:5144
kthread_worker_fn+0x507/0xb60 kernel/kthread.c:1010
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x436/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245