INFO: task syz.0.260:6823 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.260 state:D stack:25640 pid:6823 tgid:6823 ppid:5625 task_flags:0x440040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
rwsem_down_read_slowpath+0x6ba/0x920 kernel/locking/rwsem.c:1114
__down_read_common kernel/locking/rwsem.c:1291 [inline]
__down_read kernel/locking/rwsem.c:1304 [inline]
down_read+0x9c/0x330 kernel/locking/rwsem.c:1576
filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
do_sync_mmap_readahead+0x75e/0x990 mm/filemap.c:3434
filemap_fault+0x7d9/0x13b0 mm/filemap.c:3588
__do_fault+0x138/0x2a0 mm/memory.c:5425
do_shared_fault mm/memory.c:5924 [inline]
do_fault mm/memory.c:5998 [inline]
do_pte_missing+0x684/0x34b0 mm/memory.c:4566
handle_pte_fault mm/memory.c:6379 [inline]
__handle_mm_fault mm/memory.c:6517 [inline]
handle_mm_fault+0x1b36/0x3080 mm/memory.c:6686
do_user_addr_fault+0xa4d/0x1340 arch/x86/mm/fault.c:1343
handle_page_fault arch/x86/mm/fault.c:1483 [inline]
exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7f55ac467682
RSP: 002b:00007f55ac94fb70 EFLAGS: 00010246
RAX: 0000200000000ac0 RBX: 0000000000000004 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 00005555706c43d8
RBP: 00007f55ac94fc90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000000 R12: 00007f55ac94fcd0
R13: 00007f55ac82618c R14: 0000000000023f0c R15: 00007f55ac826180
INFO: task syz.0.260:6827 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.260 state:D stack:27992 pid:6827 tgid:6823 ppid:5625 task_flags:0x440140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
rwsem_down_read_slowpath+0x6ba/0x920 kernel/locking/rwsem.c:1114
__down_read_common kernel/locking/rwsem.c:1291 [inline]
__down_read kernel/locking/rwsem.c:1304 [inline]
down_read+0x9c/0x330 kernel/locking/rwsem.c:1576
filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
filemap_get_pages+0x4a9/0x1ec0 mm/filemap.c:2710
filemap_splice_read+0x61b/0xd60 mm/filemap.c:3099
do_splice_read fs/splice.c:980 [inline]
splice_direct_to_actor+0x48b/0xcb0 fs/splice.c:1084
do_splice_direct_actor fs/splice.c:1202 [inline]
do_splice_direct+0x195/0x290 fs/splice.c:1228
do_sendfile+0x52e/0x7c0 fs/read_write.c:1371
__do_sys_sendfile64 fs/read_write.c:1432 [inline]
__se_sys_sendfile64+0x144/0x1a0 fs/read_write.c:1418
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f55ac59e0d9
RSP: 002b:00007f55ad4f4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f55ac826090 RCX: 00007f55ac59e0d9
RDX: 0000000000000000 RSI: 000000000000000b RDI: 000000000000000b
RBP: 00007f55ac635024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000200000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f55ac826128 R14: 00007f55ac826090 R15: 00007f55ac94fa48
INFO: task syz.1.265:6865 blocked for more than 144 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.265 state:D stack:25640 pid:6865 tgid:6865 ppid:5622 task_flags:0x440040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
rwsem_down_read_slowpath+0x6ba/0x920 kernel/locking/rwsem.c:1114
__down_read_common kernel/locking/rwsem.c:1291 [inline]
__down_read kernel/locking/rwsem.c:1304 [inline]
down_read+0x9c/0x330 kernel/locking/rwsem.c:1576
filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
do_sync_mmap_readahead+0x75e/0x990 mm/filemap.c:3434
filemap_fault+0x7d9/0x13b0 mm/filemap.c:3588
__do_fault+0x138/0x2a0 mm/memory.c:5425
do_shared_fault mm/memory.c:5924 [inline]
do_fault mm/memory.c:5998 [inline]
do_pte_missing+0x684/0x34b0 mm/memory.c:4566
handle_pte_fault mm/memory.c:6379 [inline]
__handle_mm_fault mm/memory.c:6517 [inline]
handle_mm_fault+0x1b36/0x3080 mm/memory.c:6686
do_user_addr_fault+0xa4d/0x1340 arch/x86/mm/fault.c:1343
handle_page_fault arch/x86/mm/fault.c:1483 [inline]
exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7fda84267682
RSP: 002b:00007fda8474fb70 EFLAGS: 00010246
RAX: 0000200000000ac0 RBX: 0000000000000004 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000006 RDI: 0000555560c713d8
RBP: 00007fda8474fc90 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000000 R12: 00007fda8474fcd0
R13: 00007fda84625fac R14: 0000000000024708 R15: 00007fda84625fa0
INFO: task syz.1.265:6871 blocked for more than 144 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.265 state:D stack:27992 pid:6871 tgid:6865 ppid:5622 task_flags:0x440140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
rwsem_down_read_slowpath+0x6ba/0x920 kernel/locking/rwsem.c:1114
__down_read_common kernel/locking/rwsem.c:1291 [inline]
__down_read kernel/locking/rwsem.c:1304 [inline]
down_read+0x9c/0x330 kernel/locking/rwsem.c:1576
filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
filemap_get_pages+0x4a9/0x1ec0 mm/filemap.c:2710
filemap_splice_read+0x61b/0xd60 mm/filemap.c:3099
do_splice_read fs/splice.c:980 [inline]
splice_direct_to_actor+0x48b/0xcb0 fs/splice.c:1084
do_splice_direct_actor fs/splice.c:1202 [inline]
do_splice_direct+0x195/0x290 fs/splice.c:1228
do_sendfile+0x52e/0x7c0 fs/read_write.c:1371
__do_sys_sendfile64 fs/read_write.c:1432 [inline]
__se_sys_sendfile64+0x144/0x1a0 fs/read_write.c:1418
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fda8439e0d9
RSP: 002b:00007fda85317028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007fda84626090 RCX: 00007fda8439e0d9
RDX: 0000000000000000 RSI: 000000000000000b RDI: 000000000000000b
RBP: 00007fda84435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000200000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fda84626128 R14: 00007fda84626090 R15: 00007fda8474fa48
Showing all locks held in the system:
1 lock held by khungtaskd/30:
#0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8eb59c60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5362:
#0: ffff88823bf8c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
2 locks held by syz.4.241/6692:
1 lock held by syz.0.260/6823:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.0.260/6827:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.1.265/6865:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.1.265/6871:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.7.334/7215:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.7.334/7217:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.5.361/7324:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.9.554/8306:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.9.554/8307:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: do_page_cache_ra mm/readahead.c:347 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: force_page_cache_ra+0x25e/0x2e0 mm/readahead.c:378
1 lock held by syz.9.554/8308:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.3.609/8538:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.3.609/8540:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.6.712/8924:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
1 lock held by syz.2.733/9002:
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#0: ffff8880238bfc80 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_order+0x3eb/0xee0 mm/readahead.c:517
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 4939 Comm: kworker/1:1H Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: kblockd blk_mq_run_work_fn
RIP: 0010:check_wait_context kernel/locking/lockdep.c:-1 [inline]
RIP: 0010:__lock_acquire+0x48d/0x2cf0 kernel/locking/lockdep.c:5187
Code: ce c0 0b 00 00 31 c1 ff cb 49 ff cc f7 c1 00 60 00 00 74 cf eb 17 48 c7 c7 90 7f a2 8e 4c 89 fe e8 08 a6 6d 03 8b 45 20 eb cf <44> 89 eb 65 8b 05 e5 31 ca 11 85 c0 74 22 41 b4 03 41 83 be 70 0b
RSP: 0018:ffffc9000fa4ee18 EFLAGS: 00000086
RAX: 0000000000020007 RBX: 0000000000000001 RCX: 00000000ffffffff
RDX: 0000000000000003 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff8880258d8c18 R08: ffffffff8177827f R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8eb59c60 R12: ffffffffffffffff
R13: 0000000000000000 R14: ffff8880258d8000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888125055000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fba1a5ef2f8 CR3: 0000000079970000 CR4: 00000000003526f0
Call Trace:
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:840 [inline]
class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
unwind_next_frame+0xac/0x2550 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489
_kmalloc_noprof include/linux/slab.h:988 [inline]
slab_free_hook mm/slub.c:2629 [inline]
slab_free mm/slub.c:6377 [inline]
kmem_cache_free+0x156/0x650 mm/slub.c:6504
mempool_free+0xec/0x130 mm/mempool.c:704
__bio_chain_endio block/bio.c:329 [inline]
bio_endio+0x35/0x9d0 block/bio.c:1802
blk_update_request+0x57b/0xe50 block/blk-mq.c:1016
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1147
nullb_complete_cmd drivers/block/null_blk/main.c:1412 [inline]
null_handle_cmd drivers/block/null_blk/main.c:1464 [inline]
null_queue_rq+0xc2a/0xe70 drivers/block/null_blk/main.c:1703
blk_mq_dispatch_rq_list+0x499/0x1990 block/blk-mq.c:2117
__blk_mq_sched_dispatch_requests+0x13a5/0x1580 block/blk-mq-sched.c:313
blk_mq_sched_dispatch_requests+0xd7/0x190 block/blk-mq-sched.c:329
blk_mq_run_work_fn+0x22e/0x300 block/blk-mq.c:2532
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245