INFO: task syz.0.16:6764 [ 335.237115][ T38] INFO: task syz.0.16:6764 blocked for more than 143 seconds.
Tainted: G W 6.16.0-syzkaller-04055-g14bed9bc81ba #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.16 state:D stack:17384 pid:6764 tgid:6763 ppid:6552 task_flags:0x400140 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5397 [inline]
__schedule+0x165b/0x4c50 kernel/sched/core.c:6786
__schedule_loop kernel/sched/core.c:6864 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6879
io_schedule+0x81/0xe0 kernel/sched/core.c:7724
folio_wait_bit_common+0x6b5/0xb90 mm/filemap.c:1317
folio_lock include/linux/pagemap.h:1141 [inline]
invalidate_inode_pages2_range+0x55a/0xa80 mm/truncate.c:690
bch2_write_invalidate_inode_pages_range+0xc5/0x110 fs/bcachefs/fs-io-pagecache.c:68
bch2_direct_write+0x2a6d/0x2cf0 fs/bcachefs/fs-io-direct.c:662
bch2_write_iter+0x192/0x2ba0 fs/bcachefs/fs-io-buffered.c:1064
iter_file_splice_write+0x93f/0x1000 fs/splice.c:738
do_splice_from fs/splice.c:935 [inline]
direct_splice_actor+0x104/0x160 fs/splice.c:1158
splice_direct_to_actor+0x5b3/0xcd0 fs/splice.c:1102
do_splice_direct_actor fs/splice.c:1201 [inline]
do_splice_direct+0x187/0x270 fs/splice.c:1227
do_sendfile+0x4ec/0x7f0 fs/read_write.c:1370
__do_sys_sendfile64 fs/read_write.c:1431 [inline]
__se_sys_sendfile64+0x13e/0x190 fs/read_write.c:1417
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4d9110e929
RSP: 002b:00007f4d9037e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f4d91335fa0 RCX: 00007f4d9110e929
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005
RBP: 00007f4d91190b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000800000009 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f4d91335fa0 R15: 00007fffd9556568
INFO: task syz.0.16:6776 blocked for more than 143 seconds.
Tainted: G W 6.16.0-syzkaller-04055-g14bed9bc81ba #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.16 state:D stack:26344 pid:6776 tgid:6763 ppid:6552 task_flags:0x440040 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5397 [inline]
__schedule+0x165b/0x4c50 kernel/sched/core.c:6786
__schedule_loop kernel/sched/core.c:6864 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6879
__bch2_two_state_lock+0x1ea/0x370 fs/bcachefs/two_state_shared_lock.c:7
bch2_two_state_lock fs/bcachefs/two_state_shared_lock.h:55 [inline]
bch2_readahead+0x94f/0x1100 fs/bcachefs/fs-io-buffered.c:296
read_pages+0x17a/0x580 mm/readahead.c:160
page_cache_ra_unbounded+0x63b/0x740 mm/readahead.c:297
filemap_get_pages+0x443/0x1df0 mm/filemap.c:2602
filemap_splice_read+0x502/0xbd0 mm/filemap.c:2990
do_splice_read fs/splice.c:979 [inline]
splice_direct_to_actor+0x4b1/0xcd0 fs/splice.c:1083
do_splice_direct_actor fs/splice.c:1201 [inline]
do_splice_direct+0x187/0x270 fs/splice.c:1227
do_sendfile+0x4ec/0x7f0 fs/read_write.c:1370
__do_sys_sendfile64 fs/read_write.c:1431 [inline]
__se_sys_sendfile64+0x13e/0x190 fs/read_write.c:1417
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4d9110e929
RSP: 002b:00007f4d9035d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f4d91336080 RCX: 00007f4d9110e929
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000000000000006
RBP: 00007f4d91190b39 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000e3aa6ea R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f4d91336080 R15: 00007fffd9556568
Showing all locks held in the system:
1 lock held by khungtaskd/38:
#0: ffffffff8d7aa840 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d7aa840 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8d7aa840 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770
7 locks held by kworker/u8:14/4361:
2 locks held by getty/5575:
#0: ffff88823bf520a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e9b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1410 drivers/tty/n_tty.c:2222
1 lock held by syz.0.16/6764:
#0: ffff888027ac0488 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1157
1 lock held by syz.0.16/6776:
#0: ffff88804b000b88 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline]
#0: ffff88804b000b88 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xf4/0x740 mm/readahead.c:228
1 lock held by syz.1.17/6800:
#0: ffff888042eae488 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1157
1 lock held by syz.1.17/6812:
#0: ffff88804b001c08 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline]
#0: ffff88804b001c08 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xf4/0x740 mm/readahead.c:228
1 lock held by syz.2.18/6836:
#0: ffff8880540aa488 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1157
1 lock held by syz.2.18/6847:
#0: ffff88804b002c88 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline]
#0: ffff88804b002c88 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xf4/0x740 mm/readahead.c:228
1 lock held by syz.3.20/6884:
#0: ffff888042c72488 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1157
1 lock held by syz.3.20/6895:
#0: ffff88804b0493c8 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline]
#0: ffff88804b0493c8 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xf4/0x740 mm/readahead.c:228
1 lock held by syz.4.22/6943:
#0: ffff888061a14488 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1157
1 lock held by syz.4.22/6955:
#0: ffff88804b04a448 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline]
#0: ffff88804b04a448 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xf4/0x740 mm/readahead.c:228
1 lock held by syz.5.24/6997:
#0: ffff8880618fc488 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1157
1 lock held by syz.5.24/7008:
#0: ffff88804b04c548 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline]
#0: ffff88804b04c548 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xf4/0x740 mm/readahead.c:228
1 lock held by syz.6.26/7050:
#0: ffff888031686488 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1157
1 lock held by syz.6.26/7062:
#0: ffff88804b004d88 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline]
#0: ffff88804b004d88 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xf4/0x740 mm/readahead.c:228
1 lock held by syz.7.27/7097:
#0: ffff88803709c488 (sb_writers#12){.+.+}-{0:0}, at: direct_splice_actor+0x49/0x160 fs/splice.c:1157
1 lock held by syz.7.27/7108:
#0: ffff88804b004548 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline]
#0: ffff88804b004548 (mapping.invalidate_lock#3){.+.+}-{4:4}, at: page_cache_ra_unbounded+0xf4/0x740 mm/readahead.c:228
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Tainted: G W 6.16.0-syzkaller-04055-g14bed9bc81ba #0 PREEMPT_{RT,(full)}
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:307 [inline]
watchdog+0xe9e/0xee0 kernel/hung_task.c:470
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 4361 Comm: kworker/u8:14 Tainted: G W 6.16.0-syzkaller-04055-g14bed9bc81ba #0 PREEMPT_{RT,(full)}
Tainted: [W]=WARN
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
RIP: 0010:rt_mutex_slowunlock+0x70/0x860 kernel/locking/rtmutex.c:1412
Code: 41 48 c7 44 24 48 dd f2 1a 8d 48 c7 44 24 50 f0 60 f0 8a 4c 8d 7c 24 40 49 c1 ef 03 48 b8 f1 f1 f1 f1 00 00 00 f3 4b 89 04 27 <43> c7 44 27 08 f3 f3 f3 f3 48 c7 44 24 60 01 00 00 00 48 8d 7c 24
RSP: 0018:ffffc9000f297640 EFLAGS: 00000a02
RAX: f3000000f1f1f1f1 RBX: ffffc9000f2976a0 RCX: 9b4206a1487e9800
RDX: 0000000000000009 RSI: ffffffff8d1d7300 RDI: ffff8880b883f550
RBP: ffffc9000f297728 R08: 0000000000000000 R09: ffffffff8af059ab
R10: 0000000000000000 R11: fffffbfff1df483f R12: dffffc0000000000
R13: ffff8880b883f550 R14: ffff8880b883f530 R15: 1ffff92001e52ed0
FS: 0000000000000000(0000) GS:ffff888126b22000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560b07f3aa58 CR3: 0000000039aea000 CR4: 00000000003526f0
Call Trace:
spin_unlock include/linux/spinlock_rt.h:105 [inline]
___slab_alloc+0x2d1/0xe20 mm/slub.c:3750
__slab_alloc mm/slub.c:3949 [inline]
__slab_alloc_node mm/slub.c:4024 [inline]
slab_alloc_node mm/slub.c:4185 [inline]
__do_kmalloc_node mm/slub.c:4327 [inline]
__kmalloc_noprof+0x145/0x430 mm/slub.c:4340
kmalloc_noprof include/linux/slab.h:909 [inline]
batadv_tvlv_realloc_packet_buff net/batman-adv/tvlv.c:283 [inline]
batadv_tvlv_container_ogm_append+0x16a/0x520 net/batman-adv/tvlv.c:324
batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:820 [inline]
batadv_iv_ogm_schedule+0x264/0xf00 net/batman-adv/bat_iv_ogm.c:876
batadv_iv_send_outstanding_bat_ogm_packet+0x6c6/0x7e0 net/batman-adv/bat_iv_ogm.c:1720
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
kthread+0x70e/0x8a0 kernel/kthread.c:464
ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245