INFO: task syz-executor:5839 blocked for more than 143 seconds. Not tainted 6.16.0-rc2-syzkaller-00082-gfb4d33ab452e #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:17848 pid:5839 tgid:5839 ppid:5826 task_flags:0x40014c flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5396 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6785 __schedule_loop kernel/sched/core.c:6863 [inline] schedule+0x165/0x360 kernel/sched/core.c:6878 wb_wait_for_completion+0x15f/0x260 fs/fs-writeback.c:216 __writeback_inodes_sb_nr+0x1f6/0x250 fs/fs-writeback.c:2747 sync_filesystem+0xa3/0x230 fs/sync.c:54 generic_shutdown_super+0x6f/0x2c0 fs/super.c:622 kill_block_super+0x44/0x90 fs/super.c:1755 ext4_kill_sb+0x68/0xb0 fs/ext4/super.c:7391 deactivate_locked_super+0xbc/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1417 task_work_run+0x1d4/0x260 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x6ad/0x22e0 kernel/exit.c:955 do_group_exit+0x21c/0x2d0 kernel/exit.c:1104 __do_sys_exit_group kernel/exit.c:1115 [inline] __se_sys_exit_group kernel/exit.c:1113 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1113 x64_sys_call+0x21ba/0x21c0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4c5b38e929 RSP: 002b:00007fffb65907f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f4c5b41094a RCX: 00007f4c5b38e929 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000075 R08: 00007fffb658e595 R09: 00007fffb6591ab0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffb6591ab0 R13: 00007f4c5b410925 R14: 000000000005b2d4 R15: 00007fffb6593c70 INFO: task syz.2.2243:12009 blocked for more than 143 seconds. Not tainted 6.16.0-rc2-syzkaller-00082-gfb4d33ab452e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.2243 state:D stack:27792 pid:12009 tgid:12007 ppid:5844 task_flags:0x400040 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5396 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6785 __schedule_loop kernel/sched/core.c:6863 [inline] schedule+0x165/0x360 kernel/sched/core.c:6878 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75 ___down_common kernel/locking/semaphore.c:268 [inline] __down_common+0x319/0x6a0 kernel/locking/semaphore.c:293 down+0x80/0xd0 kernel/locking/semaphore.c:100 console_lock+0x145/0x1b0 kernel/printk/printk.c:2849 con_install+0x9b/0x710 drivers/tty/vt/vt.c:3599 tty_driver_install_tty drivers/tty/tty_io.c:1295 [inline] tty_init_dev+0xd7/0x4d0 drivers/tty/tty_io.c:1407 tty_open_by_driver drivers/tty/tty_io.c:2073 [inline] tty_open+0x5ab/0xd10 drivers/tty/tty_io.c:2120 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0xdf3/0x1970 fs/open.c:964 vfs_open+0x3b/0x340 fs/open.c:1094 do_open fs/namei.c:3896 [inline] path_openat+0x2ee5/0x3830 fs/namei.c:4055 do_filp_open+0x1fa/0x410 fs/namei.c:4082 do_sys_openat2+0x121/0x1c0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f486398d290 RSP: 002b:00007f48617f5b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f486398d290 RDX: 0000000000000002 RSI: 00007f48617f5c10 RDI: 00000000ffffff9c RBP: 00007f48617f5c10 R08: 0000000000000000 R09: 00007f48617f5986 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f4863bb5fa0 R15: 00007ffd9550ca98 INFO: task syz.3.2245:12027 blocked for more than 146 seconds. Not tainted 6.16.0-rc2-syzkaller-00082-gfb4d33ab452e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.2245 state:D stack:25640 pid:12027 tgid:12026 ppid:5836 task_flags:0x400140 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5396 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6785 __schedule_loop kernel/sched/core.c:6863 [inline] schedule+0x165/0x360 kernel/sched/core.c:6878 io_schedule+0x80/0xd0 kernel/sched/core.c:7723 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:247 __wait_on_bit+0xb9/0x310 kernel/sched/wait_bit.c:49 out_of_line_wait_on_bit+0x123/0x170 kernel/sched/wait_bit.c:64 __ext4_get_inode_loc+0xd11/0x1040 fs/ext4/inode.c:4892 __ext4_get_inode_loc_noinmem fs/ext4/inode.c:4910 [inline] __ext4_iget+0x450/0x4260 fs/ext4/inode.c:5169 __ext4_fill_super fs/ext4/super.c:5500 [inline] ext4_fill_super+0x4592/0x6080 fs/ext4/super.c:5724 get_tree_bdev_flags+0x40e/0x4d0 fs/super.c:1681 vfs_get_tree+0x92/0x2b0 fs/super.c:1804 do_new_mount+0x24a/0xa40 fs/namespace.c:3885 do_mount fs/namespace.c:4222 [inline] __do_sys_mount fs/namespace.c:4433 [inline] __se_sys_mount+0x317/0x410 fs/namespace.c:4410 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe682f900ca RSP: 002b:00007fe683e8ce68 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fe683e8cef0 RCX: 00007fe682f900ca RDX: 00002000000007c0 RSI: 00002000000006c0 RDI: 00007fe683e8ceb0 RBP: 00002000000007c0 R08: 00007fe683e8cef0 R09: 0000000000000040 R10: 0000000000000040 R11: 0000000000000246 R12: 00002000000006c0 R13: 00007fe683e8ceb0 R14: 0000000000000576 R15: 000000000000002c INFO: task kmmpd-loop3:12030 blocked for more than 146 seconds. Not tainted 6.16.0-rc2-syzkaller-00082-gfb4d33ab452e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kmmpd-loop3 state:D stack:29496 pid:12030 tgid:12030 ppid:2 task_flags:0x208040 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5396 [inline] __schedule+0x16f5/0x4d00 kernel/sched/core.c:6785 __schedule_loop kernel/sched/core.c:6863 [inline] schedule+0x165/0x360 kernel/sched/core.c:6878 io_schedule+0x80/0xd0 kernel/sched/core.c:7723 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:247 __wait_on_bit+0xb9/0x310 kernel/sched/wait_bit.c:49 out_of_line_wait_on_bit+0x123/0x170 kernel/sched/wait_bit.c:64 wait_on_buffer include/linux/buffer_head.h:422 [inline] write_mmp_block_thawed+0x201/0x2a0 fs/ext4/mmp.c:52 write_mmp_block+0x13e/0x3b0 fs/ext4/mmp.c:67 kmmpd+0x391/0xa10 fs/ext4/mmp.c:178 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 1 lock held by kthreadd/2: 7 locks held by kworker/R-netns/8: #0: ffff88801b2f6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801b2f6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321 #1: ffffc900000d7ba0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc900000d7ba0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321 #2: ffffffff8f5036d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 net/core/net_namespace.c:662 #3: ffff88807f6ba0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:884 [inline] #3: ffff88807f6ba0e8 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:108 [inline] #3: ffff88807f6ba0e8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x10a/0x3d0 net/devlink/core.c:506 #4: ffff88807f6bf250 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:276 [inline] #4: ffff88807f6bf250 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:109 [inline] #4: ffff88807f6bf250 (&devlink->lock_key#2){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x11c/0x3d0 net/devlink/core.c:506 #5: ffffffff8f5102c8 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0xdb/0x670 drivers/net/netdevsim/netdev.c:1064 #6: ffff888059340d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2756 [inline] #6: ffff888059340d30 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x5a1/0x2320 net/core/dev.c:12036 3 locks held by kworker/u8:0/12: 3 locks held by kworker/u8:1/13: 2 locks held by kworker/1:0/24: 1 lock held by khungtaskd/31: #0: ffffffff8e13eda0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e13eda0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e13eda0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770 1 lock held by kworker/R-write/33: 3 locks held by kworker/u8:2/36: 3 locks held by kworker/u8:3/49: 2 locks held by kworker/1:1H/55: #0: ffff888140ec3948 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff888140ec3948 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321 #1: ffffc9000130fbc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000130fbc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321 3 locks held by kworker/u8:4/61: 2 locks held by kswapd0/80: 2 locks held by kworker/0:2/971: 3 locks held by kworker/u8:5/988: 3 locks held by kworker/u8:6/2939: 3 locks held by kworker/u8:7/2960: 4 locks held by kworker/R-bat_e/3398: 3 locks held by kworker/u8:9/3506: 1 lock held by klogd/5189: 2 locks held by udevd/5200: 2 locks held by crond/5574: 2 locks held by getty/5586: #0: ffff88814c1840a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002fee2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 2 locks held by syz-executor/5832: 1 lock held by syz-executor/5839: #0: ffff8880707420e0 (&type->s_umount_key#120){++++}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff8880707420e0 (&type->s_umount_key#120){++++}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff8880707420e0 (&type->s_umount_key#120){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 2 locks held by kworker/1:6/5972: 3 locks held by kworker/0:2H/6029: #0: ffff888140ec3948 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff888140ec3948 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321 #1: ffffc90004cbfbc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90004cbfbc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321 #2: ffffffff8e1448b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:336 [inline] #2: ffffffff8e1448b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 kernel/rcu/tree_exp.h:998 2 locks held by udevd/11487: #0: ffff888148c96f20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:884 [inline] #0: ffff888148c96f20 (&sb->s_type->i_mutex_key#8){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 block/fops.c:832 #1: ffff888148c970c0 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:934 [inline] #1: ffff888148c970c0 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_update_page mm/filemap.c:2462 [inline] #1: ffff888148c970c0 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_get_pages+0x7db/0x1ea0 mm/filemap.c:2624 1 lock held by udevd/11934: 1 lock held by syz.6.2224/11988: 2 locks held by syz.4.2241/12004: 2 locks held by syz.2.2243/12009: #0: ffffffff8e99e848 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8e99e848 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x200/0xd10 drivers/tty/tty_io.c:2120 #1: ffff8880234561c0 (&tty->legacy_mutex){+.+.}-{4:4}, at: tty_init_dev+0x74/0x4d0 drivers/tty/tty_io.c:1406 2 locks held by udevadm/12008: 1 lock held by syz.3.2245/12027: #0: ffff88807f0a20e0 (&type->s_umount_key#27/1){+.+.}-{4:4}, at: alloc_super+0x204/0x970 fs/super.c:345 1 lock held by kmmpd-loop3/12030: #0: ffff88807f0a2428 (sb_writers#4){.+.+}-{0:0}, at: kmmpd+0x391/0xa10 fs/ext4/mmp.c:178 3 locks held by kworker/1:8/12034: 3 locks held by syz-executor/12035: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc2-syzkaller-00082-gfb4d33ab452e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:307 [inline] watchdog+0xfee/0x1030 kernel/hung_task.c:470 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 3398 Comm: kworker/R-bat_e Not tainted 6.16.0-rc2-syzkaller-00082-gfb4d33ab452e #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Workqueue: bat_events batadv_tt_purge RIP: 0010:ipt_do_table+0x4/0x1640 net/ipv4/netfilter/ip_tables.c:226 Code: f1 22 f8 e9 a8 fb ff ff 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec a0 01 RSP: 0018:ffffc90000a08808 EFLAGS: 00000246 RAX: 1ffff11005fa2006 RBX: ffffffff8a00ea50 RCX: ffff88803103da00 RDX: ffffc90000a088c0 RSI: ffff88816e35b640 RDI: ffff888079aa4300 RBP: dffffc0000000000 R08: ffff88803103da00 R09: 0000000000000004 R10: 0000000000000003 R11: ffffffff8a00ea50 R12: 0000000000000002 R13: ffff88802fd10028 R14: 1ffff11005fa2000 R15: ffff88802fd10030 FS: 0000000000000000(0000) GS:ffff888125d51000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffcf0cecb68 CR3: 0000000078eab000 CR4: 0000000000350ef0 Call Trace: nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:272 [inline] NF_HOOK+0x206/0x3a0 include/linux/netfilter.h:315 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:317 __netif_receive_skb_one_core net/core/dev.c:5977 [inline] __netif_receive_skb+0x143/0x380 net/core/dev.c:6090 process_backlog+0x60e/0x14f0 net/core/dev.c:6442 __napi_poll+0xc7/0x480 net/core/dev.c:7414 napi_poll net/core/dev.c:7478 [inline] net_rx_action+0x707/0xe30 net/core/dev.c:7605 handle_softirqs+0x286/0x870 kernel/softirq.c:579 do_softirq+0xec/0x180 kernel/softirq.c:480 __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline] batadv_tt_purge+0x4d1/0x9e0 net/batman-adv/translation-table.c:3510 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 rescuer_thread+0x53c/0xdd0 kernel/workqueue.c:3498 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245