INFO: task syz.3.361:9883 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.361       state:D stack:25384 pid:9883  tgid:9882  ppid:5587   task_flags:0x400140 flags:0x00080003
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x16d9/0x5700 kernel/sched/core.c:7284
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7376
 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153
 kthread_flush_worker+0x138/0x1a0 kernel/kthread.c:1579
 __alloc_workqueue+0x16f4/0x1fe0 kernel/workqueue.c:6011
 alloc_workqueue_va kernel/workqueue.c:6033 [inline]
 alloc_workqueue_noprof+0xe3/0x210 kernel/workqueue.c:6049
 btrfs_alloc_workqueue+0x1ec/0x2d0 fs/btrfs/async-thread.c:112
 btrfs_init_workqueues+0x100/0x680 fs/btrfs/disk-io.c:1966
 open_ctree+0x14d0/0x4190 fs/btrfs/disk-io.c:3540
 btrfs_fill_super fs/btrfs/super.c:974 [inline]
 btrfs_get_tree_super fs/btrfs/super.c:1969 [inline]
 btrfs_get_tree_subvol fs/btrfs/super.c:2112 [inline]
 btrfs_get_tree+0x1084/0x1980 fs/btrfs/super.c:2146
 vfs_get_tree+0x92/0x2a0 fs/super.c:1932
 fc_mount fs/namespace.c:1282 [inline]
 do_new_mount_fc fs/namespace.c:3898 [inline]
 do_new_mount+0x325/0xb00 fs/namespace.c:3974
 do_mount fs/namespace.c:4338 [inline]
 __do_sys_mount fs/namespace.c:4556 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4533
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f796ac2f7ca
RSP: 002b:00007f7968e85e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f7968e85ee0 RCX: 00007f796ac2f7ca
RDX: 0000200000005100 RSI: 0000200000000040 RDI: 00007f7968e85ea0
RBP: 0000200000005100 R08: 00007f7968e85ee0 R09: 0000000000800810
R10: 0000000000800810 R11: 0000000000000246 R12: 0000200000000040
R13: 00007f7968e85ea0 R14: 000000000000510a R15: 0000200000000140
 </TASK>

Showing all locks held in the system:
locks held by khungtaskd/38: 1, last CPU#1:
 #0: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871
locks held by getty/5339: 2, on CPU#1:
 #0: ffff8880369980a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900044d32e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
locks held by syz.3.361/9883: 1, on CPU#0:
 #0: ffff888037f7e0e0 (&type->s_umount_key#54/1){+.+.}-{4:4}, at: alloc_super fs/super.c:351 [inline]
 #0: ffff888037f7e0e0 (&type->s_umount_key#54/1){+.+.}-{4:4}, at: sget_fc+0x9d4/0x1a80 fs/super.c:874
locks held by syz.2.515/11771: 4, last CPU#0:
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline]
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
 #1: ffff88802b740390 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #1: ffff88802b740390 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: shmem_file_write_iter+0x82/0x120 mm/shmem.c:3433
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: get_obj_cgroup_from_memcg mm/memcontrol.c:2992 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: charge_memcg+0x47/0x310 mm/memcontrol.c:5207
 #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: percpu_ref_tryget_many include/linux/percpu-refcount.h:241 [inline]
 #3: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: percpu_ref_tryget+0x15/0x180 include/linux/percpu-refcount.h:266
locks held by syz.1.510/11773: 4, last CPU#0:
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline]
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
 #1: ffff88806087a910 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #1: ffff88806087a910 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: shmem_file_write_iter+0x82/0x120 mm/shmem.c:3433
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
 #3: ffff8880b8433f28 ((lock).lock.wait_lock#2){....}-{2:2}, at: rt_mutex_slowunlock+0xbf/0xa30 kernel/locking/rtmutex.c:1430
locks held by syz.0.511/11776: 2, last CPU#0:
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline]
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
 #1: ffff88803f6b3810 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #1: ffff88803f6b3810 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: shmem_file_write_iter+0x82/0x120 mm/shmem.c:3433
locks held by syz.5.513/11777: 3, last CPU#0:
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline]
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
 #1: ffff88803f6b2190 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #1: ffff88803f6b2190 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: shmem_file_write_iter+0x82/0x120 mm/shmem.c:3433
 #2: ffff88803f6b1e58 (&info->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
 #2: ffff88803f6b1e58 (&info->lock){+.+.}-{3:3}, at: shmem_recalc_inode mm/shmem.c:444 [inline]
 #2: ffff88803f6b1e58 (&info->lock){+.+.}-{3:3}, at: shmem_alloc_and_add_folio mm/shmem.c:2036 [inline]
 #2: ffff88803f6b1e58 (&info->lock){+.+.}-{3:3}, at: shmem_get_folio_gfp+0xb4a/0x1c40 mm/shmem.c:2531
locks held by syz.4.514/11779: 3, last CPU#1:
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2756 [inline]
 #0: ffff88801beb8510 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
 #1: ffff888064f30390 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
 #1: ffff888064f30390 (&sb->s_type->i_mutex_key#15){+.+.}-{4:4}, at: shmem_file_write_iter+0x82/0x120 mm/shmem.c:3433
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
 #2: ffffffff8f1c3d00 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xfd7/0x1030 kernel/hung_task.c:561
 kthread+0x38b/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 11773 Comm: syz.1.510 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:check_preemption_disabled+0x19/0xd0 lib/smp_processor_id.c:53
Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 53 65 8b 05 6b ac 4b 08 65 48 8b 0d 3b ac 4b 08 85 c9 74 0c <5b> 41 5e 41 5f 5d e9 bc b6 03 00 cc 9c 59 f7 c1 00 02 00 00 74 ea
RSP: 0018:ffffc9001d907580 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000202 RCX: 0000000000000046
RDX: 0000000000000001 RSI: ffffffff8d8da1f4 RDI: ffffffff8bcc6a80
RBP: 0000000000000001 R08: ffffffff90b23b7f R09: 1ffffffff216476f
R10: dffffc0000000000 R11: fffffbfff2164770 R12: ffff888060f7f930
R13: ffffffff8236e585 R14: ffffffff8f1c3d00 R15: ffff88802ed28000
FS:  00007fa13cc466c0(0000) GS:ffff8881249bb000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8b4cf55000 CR3: 0000000034cb4000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 lockdep_recursion_inc kernel/locking/lockdep.c:465 [inline]
 lock_release+0xa1/0x3c0 kernel/locking/lockdep.c:5963
 rcu_lock_release include/linux/rcupdate.h:319 [inline]
 rcu_read_unlock include/linux/rcupdate.h:880 [inline]
 get_non_dying_memcg_end mm/memcontrol.c:876 [inline]
 mod_memcg_lruvec_state+0x23a/0x270 mm/memcontrol.c:997
 __update_lru_size include/linux/mm_inline.h:42 [inline]
 update_lru_size include/linux/mm_inline.h:51 [inline]
 lruvec_add_folio include/linux/mm_inline.h:356 [inline]
 lru_add+0x883/0xda0 mm/folio.c:148
 folio_batch_move_lru+0x4c7/0x820 mm/folio.c:194
 __folio_batch_add_and_move+0x44c/0xaa0 mm/folio.c:225
 shmem_alloc_and_add_folio mm/shmem.c:2037 [inline]
 shmem_get_folio_gfp+0xc8a/0x1c40 mm/shmem.c:2531
 shmem_get_folio mm/shmem.c:2637 [inline]
 shmem_write_begin+0x166/0x320 mm/shmem.c:3268
 generic_perform_write+0x2ad/0x8b0 mm/filemap.c:4374
 shmem_file_write_iter+0xfb/0x120 mm/shmem.c:3443
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa13e9aed8e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007fa13cc45da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa13cc466c0 RCX: 00007fa13e9aed8e
RDX: 0000000001000000 RSI: 00007fa134826000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 00007fa13cc45ee0 R14: 00007fa13cc45ea0 R15: 00007fa134826000
 </TASK>