INFO: task kworker/1:1H:1172 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:1H state:D stack:26480 pid:1172 ppid:2 flags:0x00004000
Workqueue: xfs-log/loop1 xlog_ioend_work
Call Trace:
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
___down_common kernel/locking/semaphore.c:229 [inline]
__down_common+0x30e/0x650 kernel/locking/semaphore.c:250
down+0x80/0xd0 kernel/locking/semaphore.c:64
xfs_buf_lock+0x14d/0x460 fs/xfs/xfs_buf.c:1126
xfs_buf_item_unpin+0x1b6/0x650 fs/xfs/xfs_buf_item.c:582
xfs_trans_committed_bulk+0x39d/0x8b0 fs/xfs/xfs_trans.c:808
xlog_cil_committed+0x1d3/0x530 fs/xfs/xfs_log_cil.c:733
xlog_cil_process_committed+0x154/0x1a0 fs/xfs/xfs_log_cil.c:765
xlog_state_shutdown_callbacks+0x26e/0x360 fs/xfs/xfs_log.c:538
xlog_force_shutdown+0x2c9/0x320 fs/xfs/xfs_log.c:3807
xlog_ioend_work+0xaf/0x100 fs/xfs/xfs_log.c:1395
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
INFO: task syz.1.2:5843 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.2 state:D stack:26904 pid:5843 ppid:5771 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
xlog_wait fs/xfs/xfs_log_priv.h:622 [inline]
xlog_wait_on_iclog+0x474/0x680 fs/xfs/xfs_log.c:892
xlog_force_lsn+0x493/0x900 fs/xfs/xfs_log.c:3342
xfs_log_force_seq+0x1c3/0x430 fs/xfs/xfs_log.c:3379
__xfs_trans_commit+0x966/0xd90 fs/xfs/xfs_trans.c:1013
xfs_sync_sb_buf+0xfd/0x190 fs/xfs/libxfs/xfs_sb.c:1164
xfs_ioc_setlabel fs/xfs/xfs_ioctl.c:1823 [inline]
xfs_file_ioctl+0x1523/0x17b0 fs/xfs/xfs_ioctl.c:1921
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff061f9ce59
RSP: 002b:00007ff062dbe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff062216090 RCX: 00007ff061f9ce59
RDX: 00002000000004c0 RSI: 0000000041009432 RDI: 0000000000000004
RBP: 00007ff062032e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff062216128 R14: 00007ff062216090 R15: 00007ffd6a4b3818
Showing all locks held in the system:
1 lock held by khungtaskd/28:
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
3 locks held by kworker/u4:7/1145:
#0: ffff8880b8f3c298 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:559
#1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:189 [inline]
#1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: __schedule+0x21d3/0x4660 kernel/sched/core.c:6695
#2: ffff8880b8f295d8 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x6cf/0xd60 kernel/time/timer.c:1112
2 locks held by kworker/1:1H/1172:
#0: ffff888027446d38 ((wq_completion)xfs-log/loop1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888027446d38 ((wq_completion)xfs-log/loop1){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
#1: ffffc90005227d00 ((work_completion)(&iclog->ic_end_io_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90005227d00 ((work_completion)(&iclog->ic_end_io_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
2 locks held by getty/5531:
#0: ffff888031f320a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900015f72f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
2 locks held by kworker/0:4/5812:
#0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
#1: ffffc900048dfd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc900048dfd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
1 lock held by syz.1.2/5843:
#0: ffff88801e7e6418 (sb_writers#13){.+.+}-{0:0}, at: mnt_want_write_file+0x63/0x200 fs/namespace.c:456
2 locks held by kworker/u4:13/6234:
#0: ffff888017d44538 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017d44538 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
#1: ffffc90004ff7d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90004ff7d00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
1 lock held by udevd/6535:
2 locks held by syz-executor/6733:
#0: ffff88804f9180e0 (&type->s_umount_key#63){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff88804f9180e0 (&type->s_umount_key#63){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff88804f9180e0 (&type->s_umount_key#63){+.+.}-{3:3}, at: deactivate_super+0xa4/0xe0 fs/super.c:513
#1: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline]
#1: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 kernel/rcu/tree_exp.h:1004
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf59/0xfa0 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6733 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:__sanitizer_cov_trace_switch+0xd8/0xe0 kernel/kcov.c:-1
Code: 48 c1 e3 05 4c 8d 63 28 4d 39 fc 77 9d 49 ff c6 4d 89 33 49 89 4c 1b 08 4d 89 54 1b 10 49 89 7c 1b 18 49 89 54 1b 20 eb 81 5b <41> 5c 41 5e 41 5f c3 90 66 0f 1f 00 c7 87 f8 15 00 00 00 00 00 00
RSP: 0018:ffffc9000cdaf218 EFLAGS: 00000246
RAX: 0000000000000003 RBX: ffffffff8f187e08 RCX: 0000000000000003
RDX: ffffffff813b3aa1 RSI: ffffffff8cfa0640 RDI: 0000000000000001
RBP: ffffc9000cdaf358 R08: ffff88802b1abc00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc9000cdaf620
R13: ffffc9000cdaf308 R14: 0000000000000001 R15: dffffc0000000000
FS: 000055555a98d500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f60dd8be000 CR3: 0000000058f02000 CR4: 00000000003506f0
Call Trace:
unwind_next_frame+0x16d1/0x2990 arch/x86/kernel/unwind_orc.c:641
arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
save_stack+0x125/0x230 mm/page_owner.c:128
__reset_page_owner+0x4e/0x190 mm/page_owner.c:149
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1182 [inline]
free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2505
release_pages+0x208a/0x2300 mm/swap.c:1022
__folio_batch_release+0x71/0xe0 mm/swap.c:1042
folio_batch_release include/linux/pagevec.h:83 [inline]
shmem_undo_range+0x5ff/0x1a80 mm/shmem.c:1026
shmem_truncate_range mm/shmem.c:1135 [inline]
shmem_evict_inode+0x285/0xa70 mm/shmem.c:1264
evict+0x4b7/0x8a0 fs/inode.c:705
__dentry_kill+0x412/0x630 fs/dcache.c:611
dentry_kill+0xb8/0x290 fs/dcache.c:-1
dput+0xfe/0x1e0 fs/dcache.c:918
__fput+0x5b2/0x930 fs/file_table.c:392
task_work_run+0x1d4/0x260 kernel/task_work.c:245
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fecfb19e097
Code: a2 c7 05 5c 06 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
RSP: 002b:00007ffeca486d98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007fecfb2322ca RCX: 00007fecfb19e097
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeca486e50
RBP: 00007ffeca486e50 R08: 00007ffeca487e50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeca487ee0
R13: 00007fecfb2322ca R14: 0000000000037db4 R15: 00007ffeca487f20