INFO: task hung in nilfs_transaction_begin

Status: upstream: reported C repro on 2026/08/31 11:58
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+1b6a250ffd3dc4419754@syzkaller.appspotmail.com
First crash: 14d, last: 14d
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2026/09/13 upstream (ToT) 2f0c1cf72f46 C [report] VFS: Busy inodes after unmount (use-after-free)
▶ ▼ Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in nilfs_transaction_begin nilfs 1 1 964d 964d 0/29 auto-obsoleted due to no activity on 2024/04/23 10:04
upstream INFO: task hung in nilfs_transaction_begin (3) prio:normal nilfs 1 syz, C error 7 14d 60d 27/29 upstream: reported C repro on 2026/07/16 07:51
linux-6.6 INFO: task hung in nilfs_transaction_begin 1 syz, C 2 15d 15d 0/2 upstream: reported C repro on 2026/08/31 00:52
upstream INFO: task hung in nilfs_transaction_begin (2) prio:low nilfs 1 syz, C error 14 100d 140d 29/29 fixed on 2026/07/15 08:27

Sample crash report:
INFO: task syz.0.17:4497 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17        state:D
 stack:26272 pid:4497  ppid:4419   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 schedule+0xb9/0x180 kernel/sched/core.c:6639
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
 rwsem_down_read_slowpath+0x513/0x880 kernel/locking/rwsem.c:1094
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x94/0x2d0 kernel/locking/rwsem.c:1522
 nilfs_transaction_begin+0x360/0x700 fs/nilfs2/segment.c:223
 nilfs_mkdir+0xd3/0x340 fs/nilfs2/namei.c:228
 vfs_mkdir+0x386/0x570 fs/namei.c:4157
 do_mkdirat+0x1d8/0x440 fs/namei.c:4182
 __do_sys_mkdirat fs/namei.c:4197 [inline]
 __se_sys_mkdirat fs/namei.c:4195 [inline]
 __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4195
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f497eb9cfc7
RSP: 002b:00007f497e1dce58 EFLAGS: 00000246
 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f497e1dcee0 RCX: 00007f497eb9cfc7
RDX: 00000000000001ff RSI: 0000200000000340 RDI: 00000000ffffff9c
RBP: 0000200000000080 R08: 0000200000000140 R09: 0000000000000000
R10: 0000200000000080 R11: 0000000000000246 R12: 0000200000000340
R13: 00007f497e1dcea0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
INFO: task syz.2.19:4517 blocked for more than 147 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.19        state:D stack:25968 pid:4517  ppid:4424   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 schedule+0xb9/0x180 kernel/sched/core.c:6639
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
 rwsem_down_read_slowpath+0x513/0x880 kernel/locking/rwsem.c:1094
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x94/0x2d0 kernel/locking/rwsem.c:1522
 nilfs_transaction_begin+0x360/0x700 fs/nilfs2/segment.c:223
 nilfs_mkdir+0xd3/0x340 fs/nilfs2/namei.c:228
 vfs_mkdir+0x386/0x570 fs/namei.c:4157
 do_mkdirat+0x1d8/0x440 fs/namei.c:4182
 __do_sys_mkdirat fs/namei.c:4197 [inline]
 __se_sys_mkdirat fs/namei.c:4195 [inline]
 __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4195
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f442dd9cfc7
RSP: 002b:00007f442ec5ee58 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f442ec5eee0 RCX: 00007f442dd9cfc7
RDX: 00000000000001ff RSI: 0000200000000340 RDI: 00000000ffffff9c
RBP: 0000200000000080 R08: 0000200000000140 R09: 0000000000000000
R10: 0000200000000080 R11: 0000000000000246 R12: 0000200000000340
R13: 00007f442ec5eea0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
INFO: task syz.1.18:4516 blocked for more than 150 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18        state:D
 stack:26448 pid:4516  ppid:4423   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 schedule+0xb9/0x180 kernel/sched/core.c:6639
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
 rwsem_down_read_slowpath+0x513/0x880 kernel/locking/rwsem.c:1094
 __down_read_common kernel/locking/rwsem.c:1261 [inline]
 __down_read kernel/locking/rwsem.c:1274 [inline]
 down_read+0x94/0x2d0 kernel/locking/rwsem.c:1522
 nilfs_transaction_begin+0x360/0x700 fs/nilfs2/segment.c:223
 nilfs_mkdir+0xd3/0x340 fs/nilfs2/namei.c:228
 vfs_mkdir+0x386/0x570 fs/namei.c:4157
 do_mkdirat+0x1d8/0x440 fs/namei.c:4182
 __do_sys_mkdirat fs/namei.c:4197 [inline]
 __se_sys_mkdirat fs/namei.c:4195 [inline]
 __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4195
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb0b1d9cfc7
RSP: 002b:00007fb0b2cd9e58 EFLAGS: 00000246
 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fb0b2cd9ee0 RCX: 00007fb0b1d9cfc7
RDX: 00000000000001ff RSI: 0000200000000340 RDI: 00000000ffffff9c

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/31 14:34 linux-6.1.y d64a499eea6b 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-linux-6-1-kasan INFO: task hung in nilfs_transaction_begin
2026/08/31 11:57 linux-6.1.y d64a499eea6b 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in nilfs_transaction_begin
* Struck through repros no longer work on HEAD.