INFO: task syz-executor:5951 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:21192 pid:5951 tgid:5951 ppid:1 task_flags:0x400140 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x16f3/0x4c20 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7058
io_schedule+0x81/0xe0 kernel/sched/core.c:7903
folio_wait_bit_common+0x6b5/0xb90 mm/filemap.c:1317
__folio_lock mm/filemap.c:1675 [inline]
folio_lock include/linux/pagemap.h:1133 [inline]
__filemap_get_folio+0x167/0xa40 mm/filemap.c:1929
truncate_inode_pages_range+0x3cf/0xb90 mm/truncate.c:388
evict+0x517/0x9c0 fs/inode.c:812
dispose_list fs/inode.c:852 [inline]
evict_inodes+0x64c/0x6d0 fs/inode.c:906
generic_shutdown_super+0x9a/0x2c0 fs/super.c:628
kill_block_super+0x44/0x90 fs/super.c:1723
deactivate_locked_super+0xb9/0x130 fs/super.c:474
cleanup_mnt+0x425/0x4c0 fs/namespace.c:1318
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f19c30801f7
RSP: 002b:00007ffcb5a6b6d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f19c3101d7d RCX: 00007f19c30801f7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffcb5a6b790
RBP: 00007ffcb5a6b790 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffcb5a6c820
R13: 00007f19c3101d7d R14: 000000000004882f R15: 00007ffcb5a6c860
Showing all locks held in the system:
1 lock held by khungtaskd/39:
#0: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
6 locks held by kworker/u8:9/1140:
2 locks held by getty/5575:
#0: ffff88823bf680a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e832e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1410 drivers/tty/n_tty.c:2222
1 lock held by syz-executor/5951:
#0: ffff8880108b00d0 (&type->s_umount_key#112){++++}-{4:4}, at: __super_lock fs/super.c:57 [inline]
#0: ffff8880108b00d0 (&type->s_umount_key#112){++++}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
#0: ffff8880108b00d0 (&type->s_umount_key#112){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
3 locks held by udevd/6063:
2 locks held by udevd/6156:
#0: ffff888010e1c488 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:500
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: inode_lock include/linux/fs.h:979 [inline]
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: open_last_lookups fs/namei.c:3892 [inline]
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: path_openat+0x8e6/0x3840 fs/namei.c:4131
2 locks held by udevd/6212:
#0: ffff888010e1c488 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:500
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1024 [inline]
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by udevd/6335:
#0: ffff888010e1c488 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:500
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1024 [inline]
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff8880108e3cf8 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
#2: ffff8880b88334d0 ((lock)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#2: ffff8880b88334d0 ((lock)#2){+.+.}-{3:3}, at: lru_add_drain+0x6c/0x110 mm/swap.c:736
1 lock held by syz.1.1641/10540:
#0: ffff8880108b00d0 (&type->s_umount_key#112){++++}-{4:4}, at: __super_lock fs/super.c:59 [inline]
#0: ffff8880108b00d0 (&type->s_umount_key#112){++++}-{4:4}, at: super_lock+0x2a9/0x3b0 fs/super.c:121
6 locks held by syz.5.1867/11472:
1 lock held by udevadm/11475:
2 locks held by syz.7.1871/11479:
5 locks held by syz.2.1869/11483:
5 locks held by syz.6.1874/11491:
1 lock held by sed/11489:
5 locks held by syz.0.1875/11492:
#0: ffff888033171308 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x19f/0x3d0 mm/mmap_lock.c:147
#1: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#1: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#1: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x29/0x200 mm/pgtable-generic.c:286
#2: ffff88803c7fa358 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#2: ffff88803c7fa358 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0x13e/0x210 mm/pgtable-generic.c:401
#3: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#3: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#3: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8d3a9d40 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1bb/0x2c0 kernel/locking/spinlock_rt.c:57
#4: ffff8880b88334d0 ((lock)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#4: ffff8880b88334d0 ((lock)#2){+.+.}-{3:3}, at: __folio_batch_add_and_move+0xf3/0x4b0 mm/swap.c:-1
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 39 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0xf93/0xfe0 kernel/hung_task.c:491
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x436/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 1140 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
RIP: 0010:__rcu_read_lock+0x30/0x60 kernel/rcu/tree_plugin.h:416
Code: 48 8b 1c 25 08 b0 7f 91 48 81 c3 44 04 00 00 48 89 d8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 84 c0 75 18 ff 03 <8b> 03 3d 00 00 00 40 7d 07 5b e9 d1 c1 11 09 cc 90 0f 0b 90 eb f3
RSP: 0018:ffffc90004a17870 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff888026632204 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90004a179d0 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffed100ba51c17 R12: ffff88803bcd1400
R13: ffff88803bcd1410 R14: ffff88803b0c9538 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888127025000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbb13ea2000 CR3: 0000000030490000 CR4: 00000000003526f0
Call Trace:
rcu_read_lock include/linux/rcupdate.h:839 [inline]
batadv_iv_ogm_slide_own_bcast_window net/batman-adv/bat_iv_ogm.c:762 [inline]
batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:834 [inline]
batadv_iv_ogm_schedule+0x446/0xf00 net/batman-adv/bat_iv_ogm.c:874
batadv_iv_send_outstanding_bat_ogm_packet+0x6c6/0x7e0 net/batman-adv/bat_iv_ogm.c:1714
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x436/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245