ci2 starts bisection 2025-12-26 18:11:49.213526151 +0000 UTC m=+2608921.390649218
bisecting fixing commit since 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4
building syzkaller on 86341da6b45d602116fb0c60fac1641c24aedbe9
ensuring issue is reproducible on original commit 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4

testing commit 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 1f72a853d3468318d262a9a2aca249b32a42a3ac0b1ed3c81395d23e47aba472
all runs: crashed: INFO: task hung in __fdget_pos
representative crash: INFO: task hung in __fdget_pos, types: [HANG]
check whether we can drop unnecessary instrumentation
disabling configs for [bug_or_warning kasan locking atomic_sleep memleak ubsan], they are not needed
testing commit 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 685821f384941a8129ae9086f3070f1e2bbb136d257c976dcf63d3ceb688d3fe
all runs: crashed: INFO: task hung in __fdget_pos
representative crash: INFO: task hung in __fdget_pos, types: [HANG]
the bug reproduces without the instrumentation
disabling configs for [bug_or_warning kasan locking atomic_sleep memleak ubsan], they are not needed
kconfig minimization: base=3829 full=7619 leaves diff=2129
split chunks (needed=false): <2129>
split chunk #0 of len 2129 into 5 parts
testing without sub-chunk 1/5
disabling configs for [locking atomic_sleep memleak ubsan bug_or_warning kasan], they are not needed
testing commit 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 9a53625c58d6404725eac957e28cd99ff6de3fb91a0b05db75d56a143d9132da
all runs: crashed: INFO: task hung in __fdget_pos
representative crash: INFO: task hung in __fdget_pos, types: [HANG]
the chunk can be dropped
testing without sub-chunk 2/5
disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed
testing commit 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: 4113a0345dd86b84c2e912e42d92ff7df679d91c573c4e5827522c9b6f038bf7
all runs: crashed: INFO: task hung in __fdget_pos
representative crash: INFO: task hung in __fdget_pos, types: [HANG]
the chunk can be dropped
testing without sub-chunk 3/5
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing commit 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: b2b7327decee12b716609d90346885566545b70f2462e4ea41dae1277aec922c
all runs: crashed: INFO: task hung in __fdget_pos
representative crash: INFO: task hung in __fdget_pos, types: [HANG]
the chunk can be dropped
testing without sub-chunk 4/5
disabling configs for [kasan locking atomic_sleep memleak ubsan bug_or_warning], they are not needed
testing commit 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: ca266c2a8c794c5a2ea929e38169534ca13279b46f08989f3a4bb3bcf3c1d5b4
all runs: crashed: INFO: task hung in __fdget_pos
representative crash: INFO: task hung in __fdget_pos, types: [HANG]
the chunk can be dropped
testing without sub-chunk 5/5
disabling configs for [ubsan bug_or_warning kasan locking atomic_sleep memleak], they are not needed
testing commit 7b34dc04e4ff0f37ba4ad8414f42abae9f8f68e4 gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: e1e4710831e4e7e6243fef5fea4df3ee04f51d20ba44d2be356c4b29743c8f50
all runs: crashed: INFO: task hung in __fdget_pos
representative crash: INFO: task hung in __fdget_pos, types: [HANG]
the chunk can be dropped
disabling configs for [memleak ubsan bug_or_warning kasan locking atomic_sleep], they are not needed
testing current HEAD 50cbba13faa294918f0e1a9cb2b0aba19f4e6fba
testing commit 50cbba13faa294918f0e1a9cb2b0aba19f4e6fba gcc
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
kernel signature: b91e5dc6c7152fa496bc5dd0e1fca3c63ff715372efabc98e052708baecaef3b
all runs: crashed: INFO: task hung in __fdget_pos
representative crash: INFO: task hung in __fdget_pos, types: [HANG]
crash still not fixed/happens on the oldest tested release
revisions tested: 8, total time: 1h36m13.065070889s (build: 38m44.745291252s, test: 53m55.712612026s)
crash still not fixed or there were kernel test errors
commit msg: Linux 6.1.159
crash: INFO: task hung in __fdget_pos
INFO: task syz.3.17:2558 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.17        state:D stack:14768 pid:2558  ppid:2101   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x568/0x840 kernel/sched/core.c:6561
 schedule+0x50/0xb0 kernel/sched/core.c:6637
 schedule_preempt_disabled+0x2e/0x40 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x44c/0x9b0 kernel/locking/mutex.c:747
 __fdget_pos+0xa8/0xc0 fs/file.c:1038
 fdget_pos include/linux/file.h:74 [inline]
 __do_sys_getdents64 fs/readdir.c:365 [inline]
 __se_sys_getdents64+0x4d/0xf0 fs/readdir.c:354
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f10a0f9eec9
RSP: 002b:00007f10a0dee038 EFLAGS: 00000246 ORIG_RAX: 00000000000000d9
RAX: ffffffffffffffda RBX: 00007f10a11f6090 RCX: 00007f10a0f9eec9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
RBP: 00007f10a1021f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f10a11f6128 R14: 00007f10a11f6090 R15: 00007ffe015a99f8
 </TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff827719a8 (rcu_tasks.tasks_gp_mutex){....}-{3:3}, at: rcu_tasks_one_gp kernel/rcu/tasks.h:517 [inline]
 #0: ffffffff827719a8 (rcu_tasks.tasks_gp_mutex){....}-{3:3}, at: rcu_tasks_kthread+0x97/0x4c0 kernel/rcu/tasks.h:562
1 lock held by khungtaskd/27:
 #0: ffffffff82771768 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #0: ffffffff82771768 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #0: ffffffff82771768 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x2a/0xf0 kernel/locking/lockdep.c:6513
2 locks held by kworker/u4:3/37:
 #0: ffff888100068938 ((wq_completion)events_unbound){....}-{0:0}, at: process_one_work+0x223/0x4c0 kernel/workqueue.c:2267
 #1: ffffc90000357e68 ((work_completion)(&sub_info->work)){....}-{0:0}, at: process_one_work+0x223/0x4c0 kernel/workqueue.c:2267
2 locks held by getty/480:
 #0: ffff88810a279098 (&tty->ldisc_sem){....}-{0:0}, at: tty_ldisc_ref_wait+0x1c/0x40 drivers/tty/tty_ldisc.c:244
 #1: ffffc900003fb2f0 (&ldata->atomic_read_lock){....}-{3:3}, at: n_tty_read+0x19e/0x6d0 drivers/tty/n_tty.c:2198
2 locks held by syz.3.17/2556:
 #0: ffff8881072af6e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff888113bbc150 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.3.17/2558:
 #0: ffff8881072af6e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
2 locks held by syz.4.18/3015:
 #0: ffff888107eef0e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff8881138f8150 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.4.18/3018:
 #0: ffff888107eef0e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
2 locks held by syz.5.19/3475:
 #0: ffff888100e52ce8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff8881138f8690 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.5.19/3478:
 #0: ffff888100e52ce8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
2 locks held by syz.6.20/3935:
 #0: ffff888100e504e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff888113bbc690 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.6.20/3938:
 #0: ffff888100e504e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
2 locks held by syz.7.21/4395:
 #0: ffff88810023a4e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff888113bbcbd0 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.7.21/4398:
 #0: ffff88810023a4e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
2 locks held by syz.8.22/4855:
 #0: ffff88810829bae8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff8881138f8bd0 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.8.22/4858:
 #0: ffff88810829bae8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
2 locks held by syz.9.23/5315:
 #0: ffff888106bcc2e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff888113bbd110 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.9.23/5318:
 #0: ffff888106bcc2e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
2 locks held by syz.0.24/5775:
 #0: ffff8881086e1ae8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff888113bbd650 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.0.24/5778:
 #0: ffff8881086e1ae8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
2 locks held by syz.1.25/6235:
 #0: ffff888106bd48e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038
 #1: ffff8881138f9110 (&sb->s_type->i_mutex_key#15){....}-{3:3}, at: iterate_dir+0x40/0x180 fs/readdir.c:55
1 lock held by syz.1.25/6238:
 #0: ffff888106bd48e8 (&f->f_pos_lock){....}-{3:3}, at: __fdget_pos+0xa8/0xc0 fs/file.c:1038

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x74/0xbb lib/dump_stack.c:106
 nmi_cpu_backtrace+0x102/0x160 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0xa5/0x160 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0x533/0x560 kernel/hung_task.c:377
 kthread+0xcc/0xe0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6435 Comm: modprobe Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:mas_next_nentry lib/maple_tree.c:4783 [inline]
RIP: 0010:mas_next_entry+0x223/0x320 lib/maple_tree.c:4839
Code: 4b 8b 1c 10 48 8b 01 4c 21 e8 48 39 c1 0f 84 97 fe ff ff 4d 85 db 0f 84 8e fe ff ff b8 00 00 00 00 48 85 db 74 07 4c 89 5f 10 <48> 89 d8 48 8b 11 4c 21 ea 48 39 d1 0f 84 8b 00 00 00 48 85 c0 0f
RSP: 0018:ffffc90004a8baa0 EFLAGS: 00000286
RAX: 0000000000000000 RBX: ffff888108375c60 RCX: ffff88810875cd00
RDX: 0000000000000007 RSI: ffffffffffffffff RDI: ffffc90004a8bae0
RBP: ffff88810875cd0c R08: ffff88810875cd80 R09: ffff88810875cd40
R10: 0000000000000038 R11: 00007f1cf1c74fff R12: ffffc90004a8bb08
R13: ffffffffffffff00 R14: 0000000000000006 R15: 00007f1cf1c64fff
FS:  0000000000000000(0000) GS:ffff888237c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1cf1a71440 CR3: 0000000108787000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 validate_mm_mt+0x8e/0x1e0 mm/mmap.c:296
 __split_vma+0x1a/0x170 mm/mmap.c:2355
 do_mas_align_munmap+0x48d/0x720 mm/mmap.c:2501
 __mmap_region mm/mmap.c:2698 [inline]
 mmap_region+0x2df/0x930 mm/mmap.c:2916
 do_mmap+0x427/0x5c0 mm/mmap.c:1436
 vm_mmap_pgoff+0xc7/0x160 mm/util.c:520
 ksys_mmap_pgoff+0x184/0x1e0 mm/mmap.c:1482
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1cf1d4b242
Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00
RSP: 002b:00007ffce84d4648 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f1cf1a69000 RCX: 00007f1cf1d4b242
RDX: 0000000000000003 RSI: 0000000000002000 RDI: 00007f1cf1a69000
RBP: 0000000000000812 R08: 0000000000000000 R09: 000000000000d000
R10: 0000000000000812 R11: 0000000000000206 R12: 00007ffce84d4708
R13: 00007f1cf1d28580 R14: 00007ffce84d4ac0 R15: 00000fff9d09a8cc
 </TASK>