INFO: task kworker/u8:5:1066 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:5 state:D stack:22232 pid:1066 tgid:1066 ppid:2 task_flags:0x4208060 flags:0x00004000
Workqueue: writeback wb_workfn (flush-7:0)
Call Trace:
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x1742/0x4c30 kernel/sched/core.c:6961
__schedule_loop kernel/sched/core.c:7043 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7058
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115
__mutex_lock_common kernel/locking/mutex.c:676 [inline]
__mutex_lock+0x704/0x14d0 kernel/locking/mutex.c:760
jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
jfs_write_inode+0x145/0x220 fs/jfs/inode.c:132
write_inode fs/fs-writeback.c:1525 [inline]
__writeback_single_inode+0x6f1/0xfd0 fs/fs-writeback.c:1745
writeback_sb_inodes+0x6c7/0x1010 fs/fs-writeback.c:1976
__writeback_inodes_wb+0x111/0x240 fs/fs-writeback.c:2047
wb_writeback+0x44f/0xae0 fs/fs-writeback.c:2158
wb_check_old_data_flush fs/fs-writeback.c:2262 [inline]
wb_do_writeback fs/fs-writeback.c:2315 [inline]
wb_workfn+0xae7/0xee0 fs/fs-writeback.c:2343
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xa55/0x16a0 kernel/workqueue.c:3319
worker_thread+0xa57/0xfc0 kernel/workqueue.c:3400
kthread+0x711/0x890 kernel/kthread.c:463
ret_from_fork+0x435/0x7c0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task kworker/u8:5:1066 is blocked on a mutex likely owned by task syz.0.16:6330.
task:syz.0.16 state:R running task stack:24696 pid:6330 tgid:6329 ppid:6232 task_flags:0x400140 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:5357 [inline]
__schedule+0x1742/0x4c30 kernel/sched/core.c:6961
preempt_schedule_irq+0xb4/0x140 kernel/sched/core.c:7288
irqentry_exit+0x6c/0x80 kernel/entry/common.c:197
Showing all locks held in the system:
4 locks held by kworker/u8:0/12:
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc90000117ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc90000117ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff8880744d20e0 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
#3: ffff88805c972fe0 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
1 lock held by khungtaskd/30:
#0: ffffffff8db372a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8db372a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8db372a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
4 locks held by kworker/u8:1/32:
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc90000a8fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc90000a8fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff88807b6a80e0 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
#3: ffff888061bdb918 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
6 locks held by kworker/u9:0/50:
#0: ffff8880255c7948 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff8880255c7948 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc90000bafba0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc90000bafba0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff88802bc2cdc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d4/0x3a0 net/bluetooth/hci_sync.c:331
#3: ffff88802bc2c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x79a/0xd80 net/bluetooth/hci_sync.c:5670
#4: ffffffff8ef99388 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2079 [inline]
#4: ffffffff8ef99388 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x310 net/bluetooth/hci_conn.c:1313
#5: ffff88807ab17338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 net/bluetooth/l2cap_core.c:1762
4 locks held by kworker/u8:4/69:
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc9000211fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc9000211fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff8880731480e0 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
#3: ffff888061a7b918 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
4 locks held by kworker/u8:5/1066:
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc900042d7ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc900042d7ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff8880262b20e0 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
#3: ffff888061bd81c8 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
4 locks held by kworker/u8:6/3447:
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc9000cc3fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc9000cc3fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff8880277ac0e0 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
#3: ffff88805c92e730 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
2 locks held by getty/5464:
#0: ffff88814dc580a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x5ce/0x1ab0 drivers/tty/n_tty.c:2222
4 locks held by syz.0.16/6330:
4 locks held by syz.1.17/6352:
4 locks held by syz.2.18/6374:
4 locks held by syz.3.19/6403:
4 locks held by syz.4.20/6431:
4 locks held by kworker/u8:8/6432:
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc90003647ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc90003647ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff88804c0280e0 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
#3: ffff88805c977068 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
4 locks held by kworker/u8:9/6459:
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc900037e7ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc900037e7ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff888046fee0e0 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
#3: ffff8880619681c8 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
4 locks held by syz.5.21/6461:
4 locks held by kworker/u8:10/6486:
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline]
#0: ffff888020254148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x93a/0x16a0 kernel/workqueue.c:3319
#1: ffffc900038c7ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline]
#1: ffffc900038c7ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x16a0 kernel/workqueue.c:3319
#2: ffff88807731e0e0 (&type->s_umount_key#53){.+.+}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
#3: ffff8880758c01c8 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102
4 locks held by syz.6.22/6498:
4 locks held by syz.7.23/6529:
4 locks held by syz.8.24/6562:
1 lock held by dhcpcd/6565:
#0: ffff888075898e08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:870 [inline]
#0: ffff888075898e08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release net/socket.c:648 [inline]
#0: ffff888075898e08 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 net/socket.c:1439
2 locks held by dhcpcd/6566:
#0: ffff88807c24e258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1669 [inline]
#0: ffff88807c24e258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xc70 net/packet/af_packet.c:3251
#1: ffffffff8db3cd38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
#1: ffffffff8db3cd38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3d0/0x750 kernel/rcu/tree_exp.h:957
1 lock held by dhcpcd/6567:
#0: ffff8880279da258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1669 [inline]
#0: ffff8880279da258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xc70 net/packet/af_packet.c:3251
1 lock held by dhcpcd/6568:
#0: ffff88802e046258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1669 [inline]
#0: ffff88802e046258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xc70 net/packet/af_packet.c:3251
1 lock held by syz-executor/6570:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2e0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
watchdog+0x15af/0x15f0 kernel/hung_task.c:491
kthread+0x711/0x890 kernel/kthread.c:463
ret_from_fork+0x435/0x7c0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6352 Comm: syz.1.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:27 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:246 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp1+0x11/0x90 kernel/kcov.c:300
Code: 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 65 48 8b 14 25 08 50 10 92 <65> 8b 0d 48 12 54 10 81 e1 00 01 ff 00 74 11 81 f9 00 01 00 00 75
RSP: 0018:ffffc90002f872b8 EFLAGS: 00000293
RAX: ffffffff833b36fe RBX: dffffc0000000000 RCX: ffff88802afd3c00
RDX: ffff88802afd3c00 RSI: 0000000000000000 RDI: 00000000000000ff
RBP: 0000000000000000 R08: 00000000000001ff R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 000000000000000d
R13: ffff88805ea5a000 R14: 0000000000000000 R15: 1ffff1100bd4b402
FS: 00007f1d0f8436c0(0000) GS:ffff88812681b000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559d26466660 CR3: 0000000026974000 CR4: 00000000003526f0
Call Trace:
dtSplitRoot+0x76e/0x16d0 fs/jfs/jfs_dtree.c:1979
dtSplitUp fs/jfs/jfs_dtree.c:993 [inline]
dtInsert+0xef3/0x5ed0 fs/jfs/jfs_dtree.c:871
jfs_create+0x6c8/0xa80 fs/jfs/namei.c:137
lookup_open fs/namei.c:3708 [inline]
open_last_lookups fs/namei.c:3807 [inline]
path_openat+0x14f1/0x3830 fs/namei.c:4043
do_filp_open+0x1fa/0x410 fs/namei.c:4073
do_sys_openat2+0x121/0x1c0 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_creat fs/open.c:1528 [inline]
__se_sys_creat fs/open.c:1522 [inline]
__x64_sys_creat+0x8f/0xc0 fs/open.c:1522
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x8a/0x300 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f1d0e98e169
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1d0f843038 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: ffffffffffffffda RBX: 00007f1d0ebb5fa0 RCX: 00007f1d0e98e169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000e00
RBP: 00007f1d0ea10a68 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f1d0ebb5fa0 R15: 00007fffea9ea468