INFO: task kworker/u8:6:1148 blocked for more than 143 seconds. Not tainted 6.15.0-rc3-syzkaller-00032-ga79be02bba5c #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:6 state:D stack:23688 pid:1148 tgid:1148 ppid:2 task_flags:0x4248060 flags:0x00004000 Workqueue: writeback wb_workfn (flush-8:0) Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x116f/0x5de0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6860 io_schedule+0xbf/0x130 kernel/sched/core.c:7742 bit_wait_io+0x15/0xe0 kernel/sched/wait_bit.c:247 __wait_on_bit+0x62/0x180 kernel/sched/wait_bit.c:49 out_of_line_wait_on_bit+0xd9/0x110 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:105 [inline] do_get_write_access+0x93d/0x12a0 fs/jbd2/transaction.c:1092 jbd2_journal_get_write_access+0x1d6/0x280 fs/jbd2/transaction.c:1241 __ext4_journal_get_write_access+0x6a/0x340 fs/ext4/ext4_jbd2.c:241 ext4_mb_mark_context+0x175/0xd40 fs/ext4/mballoc.c:4001 ext4_mb_mark_diskspace_used+0x466/0x8c0 fs/ext4/mballoc.c:4131 ext4_mb_new_blocks+0xa5b/0x4f00 fs/ext4/mballoc.c:6233 ext4_ext_map_blocks+0x1b95/0x5d60 fs/ext4/extents.c:4379 ext4_map_create_blocks fs/ext4/inode.c:520 [inline] ext4_map_blocks+0x45b/0x1390 fs/ext4/inode.c:706 mpage_map_one_extent fs/ext4/inode.c:2224 [inline] mpage_map_and_submit_extent fs/ext4/inode.c:2277 [inline] ext4_do_writepages+0x1a2c/0x3490 fs/ext4/inode.c:2739 ext4_writepages+0x37a/0x7d0 fs/ext4/inode.c:2829 do_writepages+0x1b2/0x820 mm/page-writeback.c:2656 __writeback_single_inode+0x160/0xfb0 fs/fs-writeback.c:1680 writeback_sb_inodes+0x601/0xf90 fs/fs-writeback.c:1976 __writeback_inodes_wb+0xf8/0x2d0 fs/fs-writeback.c:2047 wb_writeback+0x7f3/0xb70 fs/fs-writeback.c:2158 wb_check_old_data_flush fs/fs-writeback.c:2262 [inline] wb_do_writeback fs/fs-writeback.c:2315 [inline] wb_workfn+0x8ca/0xbe0 fs/fs-writeback.c:2343 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz-executor:5830 blocked for more than 143 seconds. Not tainted 6.15.0-rc3-syzkaller-00032-ga79be02bba5c #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22840 pid:5830 tgid:5830 ppid:5828 task_flags:0x440100 flags:0x00000002 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x116f/0x5de0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6860 io_schedule+0xbf/0x130 kernel/sched/core.c:7742 bit_wait_io+0x15/0xe0 kernel/sched/wait_bit.c:247 __wait_on_bit+0x62/0x180 kernel/sched/wait_bit.c:49 out_of_line_wait_on_bit+0xd9/0x110 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:105 [inline] do_get_write_access+0x93d/0x12a0 fs/jbd2/transaction.c:1092 jbd2_journal_get_write_access+0x1d6/0x280 fs/jbd2/transaction.c:1241 __ext4_journal_get_write_access+0x6a/0x340 fs/ext4/ext4_jbd2.c:241 ext4_reserve_inode_write+0x1be/0x320 fs/ext4/inode.c:5892 __ext4_mark_inode_dirty+0x197/0x870 fs/ext4/inode.c:6066 ext4_dirty_inode+0xd9/0x130 fs/ext4/inode.c:6103 __mark_inode_dirty+0x1eb/0xe50 fs/fs-writeback.c:2527 generic_update_time+0xcf/0xf0 fs/inode.c:2064 inode_update_time fs/inode.c:2077 [inline] __file_update_time fs/inode.c:2305 [inline] file_update_time+0x17d/0x1c0 fs/inode.c:2335 ext4_page_mkwrite+0x35e/0x1750 fs/ext4/inode.c:6221 do_page_mkwrite+0x171/0x380 mm/memory.c:3287 wp_page_shared mm/memory.c:3688 [inline] do_wp_page+0xb9e/0x58e0 mm/memory.c:3907 handle_pte_fault mm/memory.c:6013 [inline] __handle_mm_fault+0x1ada/0x2a40 mm/memory.c:6140 handle_mm_fault+0x3fe/0xad0 mm/memory.c:6309 do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1337 handle_page_fault arch/x86/mm/fault.c:1480 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1538 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f1d9c0689c5 RSP: 002b:00007ffc98913910 EFLAGS: 00010206 RAX: 00007f1d991c48bc RBX: 00007ffc98913a10 RCX: 0000000000000000 RDX: 00007f1d991c48b8 RSI: 0000000000000008 RDI: 00007ffc98913a10 RBP: 00000000000003e6 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ffc989139f0 R11: 0000000000000000 R12: 0000000000000000 R13: 000000000003b744 R14: fffffffffffc48bc R15: 000000000003b744 INFO: task syz.3.1205:12378 blocked for more than 144 seconds. Not tainted 6.15.0-rc3-syzkaller-00032-ga79be02bba5c #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.1205 state:D stack:25672 pid:12378 tgid:12378 ppid:5841 task_flags:0x440040 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x116f/0x5de0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6860 io_schedule+0xbf/0x130 kernel/sched/core.c:7742 bit_wait_io+0x15/0xe0 kernel/sched/wait_bit.c:247 __wait_on_bit+0x62/0x180 kernel/sched/wait_bit.c:49 out_of_line_wait_on_bit+0xd9/0x110 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:105 [inline] do_get_write_access+0x93d/0x12a0 fs/jbd2/transaction.c:1092 jbd2_journal_get_write_access+0x1d6/0x280 fs/jbd2/transaction.c:1241 __ext4_journal_get_write_access+0x6a/0x340 fs/ext4/ext4_jbd2.c:241 ext4_reserve_inode_write+0x1be/0x320 fs/ext4/inode.c:5892 __ext4_mark_inode_dirty+0x197/0x870 fs/ext4/inode.c:6066 ext4_dirty_inode+0xd9/0x130 fs/ext4/inode.c:6103 __mark_inode_dirty+0x1eb/0xe50 fs/fs-writeback.c:2527 generic_update_time+0xcf/0xf0 fs/inode.c:2064 inode_update_time fs/inode.c:2077 [inline] __file_update_time fs/inode.c:2305 [inline] file_update_time+0x17d/0x1c0 fs/inode.c:2335 ext4_page_mkwrite+0x35e/0x1750 fs/ext4/inode.c:6221 do_page_mkwrite+0x171/0x380 mm/memory.c:3287 do_shared_fault mm/memory.c:5594 [inline] do_fault mm/memory.c:5656 [inline] do_pte_missing+0x29c/0x3fb0 mm/memory.c:4160 handle_pte_fault mm/memory.c:5997 [inline] __handle_mm_fault+0x103d/0x2a40 mm/memory.c:6140 handle_mm_fault+0x3fe/0xad0 mm/memory.c:6309 do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1337 handle_page_fault arch/x86/mm/fault.c:1480 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1538 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f684de6eada RSP: 002b:00007ffd1becb740 EFLAGS: 00010202 RAX: 0000001b30fc5000 RBX: 00007f684ece5720 RCX: 0000001b30fc4ff8 RDX: 0000001b30a20220 RSI: 0000000000000008 RDI: 00007f684ece5720 RBP: ffffffff818331de R08: 00007f684e1b61f8 R09: 00007f684e1a2000 R10: 00007f684cdfb008 R11: 0000000000000016 R12: 0000000000000016 R13: 00000000000000e8 R14: ffffffff818335ed R15: 00000000000000ee INFO: task syz.2.1208:12395 blocked for more than 144 seconds. Not tainted 6.15.0-rc3-syzkaller-00032-ga79be02bba5c #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.1208 state:D stack:28792 pid:12395 tgid:12395 ppid:5839 task_flags:0x440040 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x116f/0x5de0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6860 io_schedule+0xbf/0x130 kernel/sched/core.c:7742 bit_wait_io+0x15/0xe0 kernel/sched/wait_bit.c:247 __wait_on_bit+0x62/0x180 kernel/sched/wait_bit.c:49 out_of_line_wait_on_bit+0xd9/0x110 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:105 [inline] do_get_write_access+0x93d/0x12a0 fs/jbd2/transaction.c:1092 jbd2_journal_get_write_access+0x1d6/0x280 fs/jbd2/transaction.c:1241 __ext4_journal_get_write_access+0x6a/0x340 fs/ext4/ext4_jbd2.c:241 ext4_reserve_inode_write+0x1be/0x320 fs/ext4/inode.c:5892 __ext4_mark_inode_dirty+0x197/0x870 fs/ext4/inode.c:6066 ext4_dirty_inode+0xd9/0x130 fs/ext4/inode.c:6103 __mark_inode_dirty+0x1eb/0xe50 fs/fs-writeback.c:2527 generic_update_time+0xcf/0xf0 fs/inode.c:2064 inode_update_time fs/inode.c:2077 [inline] __file_update_time fs/inode.c:2305 [inline] file_update_time+0x17d/0x1c0 fs/inode.c:2335 ext4_page_mkwrite+0x35e/0x1750 fs/ext4/inode.c:6221 do_page_mkwrite+0x171/0x380 mm/memory.c:3287 do_shared_fault mm/memory.c:5594 [inline] do_fault mm/memory.c:5656 [inline] do_pte_missing+0x29c/0x3fb0 mm/memory.c:4160 handle_pte_fault mm/memory.c:5997 [inline] __handle_mm_fault+0x103d/0x2a40 mm/memory.c:6140 handle_mm_fault+0x3fe/0xad0 mm/memory.c:6309 do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1337 handle_page_fault arch/x86/mm/fault.c:1480 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1538 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f299b26547b RSP: 002b:00007ffe300bba20 EFLAGS: 00010246 RAX: 00000000005ffde8 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000001b30920000 RSI: 0000000000600000 RDI: 00007f299b498d50 RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000040000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 00005555913a4590 R14: 000000000008610b R15: 00007ffe300bbcd0 INFO: task syz.1.1209:12397 blocked for more than 144 seconds. Not tainted 6.15.0-rc3-syzkaller-00032-ga79be02bba5c #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.1209 state:D stack:28632 pid:12397 tgid:12397 ppid:5843 task_flags:0x440040 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x116f/0x5de0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:6860 io_schedule+0xbf/0x130 kernel/sched/core.c:7742 bit_wait_io+0x15/0xe0 kernel/sched/wait_bit.c:247 __wait_on_bit+0x62/0x180 kernel/sched/wait_bit.c:49 out_of_line_wait_on_bit+0xd9/0x110 kernel/sched/wait_bit.c:64 wait_on_bit_io include/linux/wait_bit.h:105 [inline] do_get_write_access+0x93d/0x12a0 fs/jbd2/transaction.c:1092 jbd2_journal_get_write_access+0x1d6/0x280 fs/jbd2/transaction.c:1241 __ext4_journal_get_write_access+0x6a/0x340 fs/ext4/ext4_jbd2.c:241 ext4_reserve_inode_write+0x1be/0x320 fs/ext4/inode.c:5892 __ext4_mark_inode_dirty+0x197/0x870 fs/ext4/inode.c:6066 ext4_dirty_inode+0xd9/0x130 fs/ext4/inode.c:6103 __mark_inode_dirty+0x1eb/0xe50 fs/fs-writeback.c:2527 generic_update_time+0xcf/0xf0 fs/inode.c:2064 inode_update_time fs/inode.c:2077 [inline] __file_update_time fs/inode.c:2305 [inline] file_update_time+0x17d/0x1c0 fs/inode.c:2335 ext4_page_mkwrite+0x35e/0x1750 fs/ext4/inode.c:6221 do_page_mkwrite+0x171/0x380 mm/memory.c:3287 do_shared_fault mm/memory.c:5594 [inline] do_fault mm/memory.c:5656 [inline] do_pte_missing+0x29c/0x3fb0 mm/memory.c:4160 handle_pte_fault mm/memory.c:5997 [inline] __handle_mm_fault+0x103d/0x2a40 mm/memory.c:6140 handle_mm_fault+0x3fe/0xad0 mm/memory.c:6309 do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1337 handle_page_fault arch/x86/mm/fault.c:1480 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1538 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7fa4b866547b RSP: 002b:00007ffc29c84290 EFLAGS: 00010246 RAX: 00000000003ffde8 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000001b30820000 RSI: 0000000000400000 RDI: 00007fa4b8898d50 RBP: 0000000000000000 R08: 0000000000000004 R09: 0000000000040000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 00000000000927c0 R14: 00000000000867b3 R15: 00007ffc29c84540 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8e3bf440 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e3bf440 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8e3bf440 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6764 6 locks held by kworker/u8:6/1148: #0: ffff88801f692148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213 #1: ffffc900040cfd18 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214 #2: ffff88814ec140e0 (&type->s_umount_key#31){++++}-{4:4}, at: super_trylock_shared+0x1e/0xf0 fs/super.c:562 #3: ffff88814ec16b98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: do_writepages+0x1b2/0x820 mm/page-writeback.c:2656 #4: ffff88814ec18950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x5e4/0x1410 fs/jbd2/transaction.c:444 #5: ffff88807a4d3450 (&ei->i_data_sem){++++}-{4:4}, at: ext4_map_blocks+0x355/0x1390 fs/ext4/inode.c:705 3 locks held by syz-executor/5830: #0: ffff8880313ea6c8 (vm_lock){++++}-{0:0}, at: do_user_addr_fault+0x452/0x1370 arch/x86/mm/fault.c:1328 #1: ffff88814ec14518 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x171/0x380 mm/memory.c:3287 #2: ffff88814ec18950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x5e4/0x1410 fs/jbd2/transaction.c:444 3 locks held by syz.3.1205/12378: #0: ffff88802882cbc8 (vm_lock){++++}-{0:0}, at: do_user_addr_fault+0x452/0x1370 arch/x86/mm/fault.c:1328 #1: ffff88814ec14518 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x171/0x380 mm/memory.c:3287 #2: ffff88814ec18950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x5e4/0x1410 fs/jbd2/transaction.c:444 2 locks held by getty/12394: #0: ffff88814c1400a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000b52d2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222 3 locks held by syz.2.1208/12395: #0: ffff88802f6c8088 (vm_lock){++++}-{0:0}, at: do_user_addr_fault+0x452/0x1370 arch/x86/mm/fault.c:1328 #1: ffff88814ec14518 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x171/0x380 mm/memory.c:3287 #2: ffff88814ec18950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x5e4/0x1410 fs/jbd2/transaction.c:444 3 locks held by syz.1.1209/12397: #0: ffff888076b906c8 (vm_lock){++++}-{0:0}, at: do_user_addr_fault+0x452/0x1370 arch/x86/mm/fault.c:1328 #1: ffff88814ec14518 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x171/0x380 mm/memory.c:3287 #2: ffff88814ec18950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x5e4/0x1410 fs/jbd2/transaction.c:444 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc3-syzkaller-00032-ga79be02bba5c #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline] watchdog+0xf70/0x12c0 kernel/hung_task.c:437 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 2973 Comm: kworker/u8:7 Not tainted 6.15.0-rc3-syzkaller-00032-ga79be02bba5c #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: bat_events batadv_nc_worker RIP: 0010:__sanitizer_cov_trace_cmp4+0x4/0x20 kernel/kcov.c:288 Code: d6 0f b7 f7 bf 02 00 00 00 e9 18 ff ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 0c 24 89 f2 89 fe bf 04 00 00 00 e9 ea fe ff ff 66 2e 0f 1f RSP: 0018:ffffc9000b497ab0 EFLAGS: 00000246 RAX: ffff888029480fc0 RBX: 000000000000003e RCX: 0000000000000006 RDX: 0000000000000000 RSI: 000000000000003e RDI: 0000000000000080 RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff90866917 R11: 0000000000000000 R12: ffffffff8b3c74b0 R13: 0000000000000080 R14: ffff888061bdcd80 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124abf000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc758b6ff8 CR3: 000000000e180000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: batadv_nc_purge_paths+0x1ff/0x3a0 net/batman-adv/network-coding.c:437 batadv_nc_worker+0x921/0x1030 net/batman-adv/network-coding.c:720 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245