syzbot

INFO: task jfsCommit:107 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jfsCommit       state:D stack:27144 pid:107   ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x10ec/0x40b0 kernel/sched/core.c:6561
 schedule+0xb9/0x180 kernel/sched/core.c:6637
 io_schedule+0x7c/0xd0 kernel/sched/core.c:8797
 __lock_metapage fs/jfs/jfs_metapage.c:50 [inline]
 lock_metapage+0x1e8/0x310 fs/jfs/jfs_metapage.c:64
 __get_metapage+0x4c6/0xfa0 fs/jfs/jfs_metapage.c:639
 diIAGRead+0xce/0x140 fs/jfs/jfs_imap.c:2672
 diFree+0x898/0x2460 fs/jfs/jfs_imap.c:959
 jfs_evict_inode+0x327/0x430 fs/jfs/inode.c:156
 evict+0x485/0x870 fs/inode.c:705
 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
 jfs_lazycommit+0x427/0xa50 fs/jfs/jfs_txnmgr.c:2732
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task jfsCommit:108 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jfsCommit       state:D stack:26888 pid:108   ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x10ec/0x40b0 kernel/sched/core.c:6561
 schedule+0xb9/0x180 kernel/sched/core.c:6637
 io_schedule+0x7c/0xd0 kernel/sched/core.c:8797
 __lock_metapage fs/jfs/jfs_metapage.c:50 [inline]
 lock_metapage+0x1e8/0x310 fs/jfs/jfs_metapage.c:64
 __get_metapage+0x4c6/0xfa0 fs/jfs/jfs_metapage.c:639
 diIAGRead+0xce/0x140 fs/jfs/jfs_imap.c:2672
 diFree+0x898/0x2460 fs/jfs/jfs_imap.c:959
 jfs_evict_inode+0x327/0x430 fs/jfs/inode.c:156
 evict+0x485/0x870 fs/inode.c:705
 txLazyCommit fs/jfs/jfs_txnmgr.c:2664 [inline]
 jfs_lazycommit+0x427/0xa50 fs/jfs/jfs_txnmgr.c:2732
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8cb2b630 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8cb2be50 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/27:
 #0: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #0: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #0: ffffffff8cb2aca0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513
2 locks held by jfsCommit/107:
 #0: ffff8880294b0920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diFree+0x2a4/0x2460 fs/jfs/jfs_imap.c:889
 #1: ffff888068a6b8b8 (&jfs_ip->rdwrlock/1){.+.+}-{3:3}, at: diFree+0x2c2/0x2460 fs/jfs/jfs_imap.c:894
2 locks held by jfsCommit/108:
 #0: ffff888075978920 (&(imap->im_aglock[index])){+.+.}-{3:3}, at: diFree+0x2a4/0x2460 fs/jfs/jfs_imap.c:889
 #1: ffff888053129cf8 (&jfs_ip->rdwrlock/1){.+.+}-{3:3}, at: diFree+0x2c2/0x2460 fs/jfs/jfs_imap.c:894
2 locks held by getty/4027:
 #0: ffff88814d2ec098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41b/0x1380 drivers/tty/n_tty.c:2198
2 locks held by syz-executor/4392:
1 lock held by syz-executor/4397:
 #0: ffff888027ec20e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
2 locks held by syz-executor/4401:
 #0: ffff88801caa40e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
 #1: ffffffff8cf27ee8 (jfs_log_mutex){+.+.}-{3:3}, at: lmLogClose+0xb0/0x520 fs/jfs/jfs_logmgr.c:1444
1 lock held by syz-executor/4404:
 #0: ffff888024a580e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
2 locks held by kworker/u4:5/4420:
 #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #1: ffff8880b8e27848 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x398/0x6d0 kernel/sched/psi.c:999
2 locks held by udevd/4474:
2 locks held by syz-executor/4659:
 #0: ffff888027a620e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
 #1: ffffffff8cf27ee8 (jfs_log_mutex){+.+.}-{3:3}, at: lmLogClose+0xb0/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/4660:
 #0: ffff8880242420e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
 #1: ffffffff8cf27ee8 (jfs_log_mutex){+.+.}-{3:3}, at: lmLogClose+0xb0/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/4769:
 #0: ffff888075ad00e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
 #1: ffffffff8cf27ee8 (jfs_log_mutex){+.+.}-{3:3}, at: lmLogClose+0xb0/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/4794:
 #0: ffff88805e7aa0e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
 #1: ffffffff8cf27ee8 (jfs_log_mutex){+.+.}-{3:3}, at: lmLogClose+0xb0/0x520 fs/jfs/jfs_logmgr.c:1444
2 locks held by syz-executor/4797:
 #0: ffff8880741c80e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
 #1: ffffffff8cf27ee8 (jfs_log_mutex){+.+.}-{3:3}, at: lmLogClose+0xb0/0x520 fs/jfs/jfs_logmgr.c:1444
1 lock held by syz-executor/4975:
 #0: ffff888072d740e0 (&type->s_umount_key#53){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362
2 locks held by syz.4.304/6033:
2 locks held by syz.3.305/6035:
3 locks held by syz.0.306/6036:
2 locks held by syz.2.307/6038:
1 lock held by syz.5.308/6041:
1 lock held by sed/6043:

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3f4/0x470 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xeee/0xf30 kernel/hung_task.c:377
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6041 Comm: syz.5.308 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:lock_acquire+0x1e7/0x490 kernel/locking/lockdep.c:5665
Code: 8c 8a e8 5c ee b4 08 b8 ff ff ff ff 65 0f c1 05 0f 80 9f 7e 83 f8 01 0f 85 f9 00 00 00 48 c7 84 24 80 00 00 00 00 00 00 00 9c <8f> 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 0f 85 f5 00 00 00 41
RSP: 0000:ffffc90003af7c38 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000001 RCX: 5b938df9e027f300
RDX: 0000000000000000 RSI: ffffffff8a8c1700 RDI: ffffffff8adef760
RBP: ffffc90003af7d48 R08: dffffc0000000000 R09: fffffbfff215c44f
R10: fffffbfff215c44f R11: 1ffffffff215c44e R12: 0000000000000000
R13: 1ffff9200075ef94 R14: 0000000000000246 R15: dffffc0000000000
FS:  000055558624e500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4eeb194000 CR3: 000000007f515000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 down_read_trylock+0x206/0x370 kernel/locking/rwsem.c:1562
 mmap_read_trylock include/linux/mmap_lock.h:136 [inline]
 get_mmap_lock_carefully mm/memory.c:5322 [inline]
 lock_mm_and_find_vma+0x2e/0x2f0 mm/memory.c:5384
 do_user_addr_fault+0x2db/0xb10 arch/x86/mm/fault.c:1312
 handle_page_fault arch/x86/mm/fault.c:1431 [inline]
 exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1487
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f4ef32509e6
Code: f0 72 6e 48 63 cd 48 01 c1 49 39 4f 08 72 4c 8d 4d ff 85 ed 74 33 66 0f 1f 44 00 00 48 39 f0 72 1b 4d 8b 07 49 89 c1 49 29 f1 <47> 0f b6 0c 08 45 84 c9 74 08 45 88 0c 00 49 8b 47 10 48 83 c0 01
RSP: 002b:00007ffe24f1fd80 EFLAGS: 00010206
RAX: 0000000000b95001 RBX: 00007ffe24f1fe20 RCX: 000000000000004c
RDX: 0000000000000055 RSI: 0000000000000001 RDI: 00007ffe24f1fec0
RBP: 0000000000000102 R08: 00007f4eea5ff000 R09: 0000000000b95000
R10: 0000000000000000 R11: 00007ffe24f1fe30 R12: 0000000000000001
R13: 00007f4ef342fc40 R14: 0000000000000000 R15: 00007ffe24f1fec0
 </TASK>