INFO: task syz.5.5602:19717 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.5602 state:D stack:24960 pid:19717 tgid:19716 ppid:19168 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5295 [inline]
__schedule+0x1585/0x5310 kernel/sched/core.c:6907
__schedule_loop kernel/sched/core.c:6989 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7004
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
rwsem_down_read_slowpath+0x61e/0x920 kernel/locking/rwsem.c:1086
__down_read_common kernel/locking/rwsem.c:1261 [inline]
__down_read kernel/locking/rwsem.c:1274 [inline]
down_read+0x99/0x2e0 kernel/locking/rwsem.c:1539
__super_lock fs/super.c:60 [inline]
super_lock+0x2d6/0x3d0 fs/super.c:122
__iterate_supers+0x126/0x290 fs/super.c:926
quota_sync_all fs/quota/quota.c:69 [inline]
__do_sys_quotactl fs/quota/quota.c:938 [inline]
__se_sys_quotactl+0x3a7/0x9e0 fs/quota/quota.c:917
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa5dbb9aeb9
RSP: 002b:00007fa5dc98a028 EFLAGS: 00000246 ORIG_RAX: 00000000000000b3
RAX: ffffffffffffffda RBX: 00007fa5dbe15fa0 RCX: 00007fa5dbb9aeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff80000101
RBP: 00007fa5dbc08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa5dbe16038 R14: 00007fa5dbe15fa0 R15: 00007ffcb4868978
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8e760320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8e760320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8e760320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5579:
#0: ffff8880332430a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
3 locks held by syz-executor/5815:
1 lock held by syz-executor/5817:
1 lock held by syz.5.5602/19717:
#0: ffff88803447e0e0 (&type->s_umount_key#79){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff88803447e0e0 (&type->s_umount_key#79){++++}-{4:4}, at: super_lock+0x2d6/0x3d0 fs/super.c:122
1 lock held by syz.7.7058/23478:
3 locks held by syz.1.7060/23486:
3 locks held by syz.6.7064/23493:
#0: ffff8880769b3008 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline]
#0: ffff8880769b3008 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: __sock_release+0x89/0x250 net/socket.c:665
#1: ffff8880635be260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline]
#1: ffff8880635be260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_release+0x77c/0xcc0 net/packet/af_packet.c:3148
#2: ffffffff8e7665b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
#2: ffffffff8e7665b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:347 [inline]
watchdog+0x103d/0x1090 kernel/hung_task.c:516
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 2469 Comm: kworker/0:1H Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: xfs-log/loop7 xlog_ioend_work
RIP: 0010:__bfs kernel/locking/lockdep.c:1815 [inline]
RIP: 0010:__bfs_backwards kernel/locking/lockdep.c:1860 [inline]
RIP: 0010:check_irq_usage kernel/locking/lockdep.c:2796 [inline]
RIP: 0010:check_prev_add kernel/locking/lockdep.c:3169 [inline]
RIP: 0010:check_prevs_add kernel/locking/lockdep.c:3284 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3908 [inline]
RIP: 0010:__lock_acquire+0x197b/0x2cf0 kernel/locking/lockdep.c:5237
Code: 14 25 ff 0f 00 00 39 05 8f 8f 81 12 73 06 89 05 87 8f 81 12 48 8b 02 48 89 df 4c 39 e8 0f 84 2c fe ff ff 4c 89 60 30 48 8b 00 <4c> 39 e8 75 f4 48 89 df e9 18 fe ff ff 48 89 fb 48 c7 c7 d0 e4 62
RSP: 0018:ffffc9000662f080 EFLAGS: 00000006
RAX: ffffffff96c4e578 RBX: 00000000000003fd RCX: 0000000000000666
RDX: ffffffff96c1de38 RSI: ffff88802d364810 RDI: 00000000000003fd
RBP: 44013ca3d9fa2e2e R08: ffffc9000662f048 R09: 0000000000000020
R10: dffffc0000000000 R11: ffffffff81a1fa40 R12: ffffffff96d361b8
R13: ffffffff93cd80b8 R14: ffff88802d363c80 R15: 0000000000000665
FS: 0000000000000000(0000) GS:ffff88812546a000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0067b6e000 CR3: 000000002896a000 CR4: 00000000003526f0
Call Trace:
lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
do_write_seqcount_begin_nested include/linux/seqlock.h:478 [inline]
do_write_seqcount_begin include/linux/seqlock.h:504 [inline]
psi_write_begin+0xab/0x160 kernel/sched/psi.c:183
psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
psi_sched_switch kernel/sched/stats.h:225 [inline]
__schedule+0x26b7/0x5310 kernel/sched/core.c:6901
preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:7091
preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
__raw_spin_unlock include/linux/spinlock_api_smp.h:169 [inline]
_raw_spin_unlock+0x3f/0x50 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:389 [inline]
xfs_ail_update_finish+0x137/0x160 fs/xfs/xfs_trans_ail.c:775
xfs_trans_ail_update_bulk+0xbc6/0xc30 fs/xfs/xfs_trans_ail.c:854
xlog_cil_ail_insert_batch fs/xfs/xfs_log_cil.c:792 [inline]
xlog_cil_ail_insert fs/xfs/xfs_log_cil.c:948 [inline]
xlog_cil_committed+0xc38/0x1170 fs/xfs/xfs_log_cil.c:995
xlog_cil_process_committed+0x15c/0x1b0 fs/xfs/xfs_log_cil.c:1025
xlog_state_do_iclog_callbacks fs/xfs/xfs_log.c:2411 [inline]
xlog_state_do_callback+0x57a/0xdf0 fs/xfs/xfs_log.c:2436
xlog_ioend_work+0xc6/0x100 fs/xfs/xfs_log.c:1208
process_one_work+0x949/0x1650 kernel/workqueue.c:3279
process_scheduled_works kernel/workqueue.c:3362 [inline]
worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 14 25 adc $0x25,%al
2: ff 0f decl (%rdi)
4: 00 00 add %al,(%rax)
6: 39 05 8f 8f 81 12 cmp %eax,0x12818f8f(%rip) # 0x12818f9b
c: 73 06 jae 0x14
e: 89 05 87 8f 81 12 mov %eax,0x12818f87(%rip) # 0x12818f9b
14: 48 8b 02 mov (%rdx),%rax
17: 48 89 df mov %rbx,%rdi
1a: 4c 39 e8 cmp %r13,%rax
1d: 0f 84 2c fe ff ff je 0xfffffe4f
23: 4c 89 60 30 mov %r12,0x30(%rax)
27: 48 8b 00 mov (%rax),%rax
* 2a: 4c 39 e8 cmp %r13,%rax <-- trapping instruction
2d: 75 f4 jne 0x23
2f: 48 89 df mov %rbx,%rdi
32: e9 18 fe ff ff jmp 0xfffffe4f
37: 48 89 fb mov %rdi,%rbx
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: c7 (bad)
3d: d0 e4 shl $1,%ah
3f: 62 .byte 0x62