INFO: task hung in bdev

Based on kernel commit 58c1eb84e977:

Root Cause Analysis

1. Functions, Structs, and Files Involved

fs/ext4/ioctl.c: ext4_ioctl_shutdown() and ext4_force_shutdown().
block/bdev.c: bdev_freeze() and bdev_thaw(), operating on struct block_device (bdev->bd_fsfreeze_mutex, bdev->bd_fsfreeze_count, and bdev->bd_holder_ops).
fs/super.c: fs_bdev_freeze(), fs_super_freeze(), freeze_super(), super_lock(), and sb_wait_write(), operating on struct super_block (sb->s_umount and sb->s_writers.rw_sem[]).
kernel/locking/percpu-rwsem.c: percpu_down_write().

2. Technical Mechanism and Trigger Conditions

Shutdown Ioctl Flow (EXT4_IOC_SHUTDOWN): In fs/ext4/ioctl.c:818-831, ext4_force_shutdown() processes requests to shut down an ext4 filesystem:
```
int ext4_force_shutdown(struct super_block *sb, u32 flags)
{
    ...
    if (ext4_forced_shutdown(sb))
        return 0;
    ...
    switch (flags) {
    case EXT4_GOING_FLAGS_DEFAULT:
        ret = bdev_freeze(sb->s_bdev);
        if (ret)
            return ret;
        set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags);
        bdev_thaw(sb->s_bdev);
        break;
```
Notice that:
- ext4_forced_shutdown(sb) checks whether EXT4_FLAGS_SHUTDOWN is set in sbi->s_ext4_flags.
- Under EXT4_GOING_FLAGS_DEFAULT, EXT4_FLAGS_SHUTDOWN is not set before calling bdev_freeze(); it is only set after bdev_freeze() successfully returns, after which bdev_thaw() is immediately executed.
Block Device Freeze Serialization: In block/bdev.c:304, bdev_freeze() starts by locking the block device's freeze mutex:
```
int bdev_freeze(struct block_device *bdev)
{
    ...
    mutex_lock(&bdev->bd_fsfreeze_mutex);
    ...
    if (bdev->bd_holder_ops && bdev->bd_holder_ops->freeze) {
        error = bdev->bd_holder_ops->freeze(bdev); // -> fs_bdev_freeze()
    ...
    mutex_unlock(&bdev->bd_fsfreeze_mutex);
    return error;
}
```
Because EXT4_FLAGS_SHUTDOWN is only set after bdev_freeze() returns:
- When multiple threads issue EXT4_IOC_SHUTDOWN concurrently (as seen in syz.5.238/6027 and syz.5.238/6042 from process tgid:6020), both threads see ext4_forced_shutdown(sb) == false.
- Thread 6027 acquires &bdev->bd_fsfreeze_mutex.
- Thread 6042 attempts mutex_lock(&bdev->bd_fsfreeze_mutex) and is placed into uninterruptible sleep (TASK_UNINTERRUPTIBLE / state:D).
Heavyweight Operations under bd_fsfreeze_mutex: While holding &bdev->bd_fsfreeze_mutex, bdev_freeze() invokes fs_bdev_freeze(), which runs freeze_super() on the filesystem:
- freeze_super() takes sb->s_umount exclusively via super_lock_excl().
- It marks sb->s_writers.frozen = SB_FREEZE_WRITE, drops s_umount, and invokes sb_wait_write(sb, SB_FREEZE_WRITE).
- sb_wait_write() calls percpu_down_write(), which invokes rwsem_acquire() and enters RCU synchronization (rcu_sync_enter() -> synchronize_rcu()) before waiting for active readers to drain.
- Sibling threads (e.g., 6028 and 6043) concurrently attempting operations on the superblock acquire s_umount (via super_lock()), while concurrent system activity (cleanup_net calling synchronize_rcu_expedited) further contends on RCU grace period processing.
- Once writers drain, freeze_super() must reacquire s_umount exclusively via __super_lock_excl(), then proceed to drain pagefault writers (SB_FREEZE_PAGEFAULT), call sync_filesystem(sb), and drain filesystem internal writers (SB_FREEZE_FS).
Hung Task Manifestation: Because thread 6027 holds bdev->bd_fsfreeze_mutex across the entire freeze_super() procedure while thread 6042 is waiting on mutex_lock(&bdev->bd_fsfreeze_mutex), thread 6042 remains continuously asleep without any context switches for over 144 seconds (hung_task_timeout_secs). khungtaskd detects this and emits the hung task warning.

ID	Workflow	Result	Correct	Bug	Created	Started	Finished	Revision
4c0e1122	assessment-security	DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌	❓	INFO: task hung in bdev_freeze	2026/11/07 18:20	2026/11/07 18:20	2026/11/07 18:35	5cecaf1f

assessment-security

DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ❌ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌

❓

INFO: task hung in bdev_freeze

2026/11/07 18:20

2026/11/07 18:35

5cecaf1f

Title	Replies (including bot)	Last reply
[syzbot] [block?] [ext4?] INFO: task hung in bdev_freeze	0 (1)	2026/11/09 15:31

Title

Replies (including bot)

Last reply

[syzbot] [block?] [ext4?] INFO: task hung in bdev_freeze

0 (1)

2026/11/09 15:31

INFO: task syz.1.3811:25659 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.3811 state:D stack:0 pid:25659 tgid:25638 ppid:20649 task_flags:0x400140 flags:0x00800001 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:792 (T) context_switch kernel/sched/core.c:5583 [inline] __schedule+0x1368/0x2b50 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7474 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x5d8/0x10b8 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 bdev_freeze+0x38/0x2e8 block/bdev.c:304 ext4_force_shutdown+0x288/0x5ac fs/ext4/ioctl.c:826 ext4_ioctl_shutdown fs/ext4/ioctl.c:868 [inline] __ext4_ioctl fs/ext4/ioctl.c:1888 [inline] ext4_ioctl+0x21dc/0x4430 fs/ext4/ioctl.c:1932 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 INFO: task syz.1.3811:25660 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.3811 state:D stack:0 pid:25660 tgid:25638 ppid:20649 task_flags:0x400040 flags:0x00800001 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:792 (T) context_switch kernel/sched/core.c:5583 [inline] __schedule+0x1368/0x2b50 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7474 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7531 rwsem_down_read_slowpath+0x544/0x7f8 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0xa0/0x2bc kernel/locking/rwsem.c:1576 __super_lock fs/super.c:62 [inline] super_lock+0x258/0x344 fs/super.c:124 user_get_super+0xb8/0x1bc fs/super.c:1022 quotactl_block fs/quota/quota.c:889 [inline] __do_sys_quotactl fs/quota/quota.c:955 [inline] __se_sys_quotactl fs/quota/quota.c:917 [inline] __arm64_sys_quotactl+0x4c8/0x90c fs/quota/quota.c:917 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 INFO: task syz.0.3808:25667 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.3808 state:D stack:0 pid:25667 tgid:25642 ppid:21229 task_flags:0x400140 flags:0x00800001 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:792 (T) context_switch kernel/sched/core.c:5583 [inline] __schedule+0x1368/0x2b50 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7474 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x5d8/0x10b8 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 bdev_freeze+0x38/0x2e8 block/bdev.c:304 ext4_force_shutdown+0x288/0x5ac fs/ext4/ioctl.c:826 ext4_ioctl_shutdown fs/ext4/ioctl.c:868 [inline] __ext4_ioctl fs/ext4/ioctl.c:1888 [inline] ext4_ioctl+0x21dc/0x4430 fs/ext4/ioctl.c:1932 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 INFO: task syz.2.3812:25664 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.3812 state:D stack:0 pid:25664 tgid:25645 ppid:21748 task_flags:0x400140 flags:0x00800001 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:792 (T) context_switch kernel/sched/core.c:5583 [inline] __schedule+0x1368/0x2b50 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7474 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x5d8/0x10b8 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 bdev_freeze+0x38/0x2e8 block/bdev.c:304 ext4_force_shutdown+0x288/0x5ac fs/ext4/ioctl.c:826 ext4_ioctl_shutdown fs/ext4/ioctl.c:868 [inline] __ext4_ioctl fs/ext4/ioctl.c:1888 [inline] ext4_ioctl+0x21dc/0x4430 fs/ext4/ioctl.c:1932 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 INFO: task syz.2.3812:25665 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.3812 state:D stack:0 pid:25665 tgid:25645 ppid:21748 task_flags:0x400040 flags:0x00800001 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:792 (T) context_switch kernel/sched/core.c:5583 [inline] __schedule+0x1368/0x2b50 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7474 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7531 rwsem_down_read_slowpath+0x544/0x7f8 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0xa0/0x2bc kernel/locking/rwsem.c:1576 __super_lock fs/super.c:62 [inline] super_lock+0x258/0x344 fs/super.c:124 user_get_super+0xb8/0x1bc fs/super.c:1022 quotactl_block fs/quota/quota.c:889 [inline] __do_sys_quotactl fs/quota/quota.c:955 [inline] __se_sys_quotactl fs/quota/quota.c:917 [inline] __arm64_sys_quotactl+0x4c8/0x90c fs/quota/quota.c:917 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 INFO: task kmmpd-loop1:25649 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kmmpd-loop1 state:D stack:0 pid:25649 tgid:25649 ppid:2 task_flags:0x208040 flags:0x00000010 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:792 (T) context_switch kernel/sched/core.c:5583 [inline] __schedule+0x1368/0x2b50 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7474 percpu_rwsem_wait+0x2a0/0x2f8 kernel/locking/percpu-rwsem.c:164 __percpu_down_read+0x84/0xb4 kernel/locking/percpu-rwsem.c:180 percpu_down_read_internal include/linux/percpu-rwsem.h:67 [inline] percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline] __sb_start_write include/linux/fs/super.h:19 [inline] sb_start_write include/linux/fs/super.h:125 [inline] class_super_write_constructor include/linux/fs/super.h:130 [inline] write_mmp_block+0x358/0x3e4 fs/ext4/mmp.c:63 kmmpd+0x2fc/0x938 fs/ext4/mmp.c:173 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854 INFO: task kmmpd-loop2:25651 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kmmpd-loop2 state:D stack:0 pid:25651 tgid:25651 ppid:2 task_flags:0x208040 flags:0x00000010 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:792 (T) context_switch kernel/sched/core.c:5583 [inline] __schedule+0x1368/0x2b50 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7474 percpu_rwsem_wait+0x2a0/0x2f8 kernel/locking/percpu-rwsem.c:164 __percpu_down_read+0x84/0xb4 kernel/locking/percpu-rwsem.c:180 percpu_down_read_internal include/linux/percpu-rwsem.h:67 [inline] percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline] __sb_start_write include/linux/fs/super.h:19 [inline] sb_start_write include/linux/fs/super.h:125 [inline] class_super_write_constructor include/linux/fs/super.h:130 [inline] write_mmp_block+0x358/0x3e4 fs/ext4/mmp.c:63 kmmpd+0x2fc/0x938 fs/ext4/mmp.c:173 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854 INFO: task syz.3.3813:25671 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.3813 state:D stack:0 pid:25671 tgid:25657 ppid:22407 task_flags:0x400140 flags:0x00000001 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:792 (T) context_switch kernel/sched/core.c:5583 [inline] __schedule+0x1368/0x2b50 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7474 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x5d8/0x10b8 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 bdev_freeze+0x38/0x2e8 block/bdev.c:304 ext4_force_shutdown+0x288/0x5ac fs/ext4/ioctl.c:826 ext4_ioctl_shutdown fs/ext4/ioctl.c:868 [inline] __ext4_ioctl fs/ext4/ioctl.c:1888 [inline] ext4_ioctl+0x21dc/0x4430 fs/ext4/ioctl.c:1932 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:797 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:816 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606 Showing all locks held in the system: locks held by kworker/u8:0/12: 2, on CPU#1: #0: ffff0000c004c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c004c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff80008fa47c20 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff80008fa47c20 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 locks held by khungtaskd/31: 1, last CPU#1: #0: ffff800089aa56a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff800089aa56a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff800089aa56a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x4c/0x188 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/40: 3, last CPU#1: #0: ffff0000c004b948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c004b948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff800090f97c20 ((work_completion)(&(&par->cursor_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff800090f97c20 ((work_completion)(&(&par->cursor_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 #2: ffff800089a9ada0 (console_lock){+.+.}-{0:0}, at: fb_flashcursor+0x28/0x398 drivers/video/fbdev/core/fbcon.c:403 locks held by kworker/u8:3/42: 3, on CPU#0: #0: ffff0000c004c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c004c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff800090fb7c20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff800090fb7c20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 #2: ffff80008abcf5a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 locks held by kworker/u8:4/63: 3, on CPU#0: #0: ffff0000c3d1e148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c3d1e148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff800092147c20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff800092147c20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 #2: ffff80008abcf5a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 locks held by kworker/u8:12/3416: 2, on CPU#0: #0: ffff0000c004c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c004c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff80009c0f7c20 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff80009c0f7c20 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 locks held by getty/4496: 2, on CPU#0: #0: ffff0000cd6e50a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff8000932bb2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x350/0xffc drivers/tty/n_tty.c:2211 locks held by kworker/1:2/4689: 3, on CPU#1: #0: ffff0000c002ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c002ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff80009a037c20 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff80009a037c20 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 #2: ffff80008abcf5a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 locks held by kworker/1:3/4758: 3, last CPU#1: #0: ffff0000c002ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c002ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff800099ee7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff800099ee7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 #2: ffff0000cde94258 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x198/0x320 drivers/net/netdevsim/fib.c:1490 locks held by kworker/1:4/4869: 3, on CPU#1: #0: ffff0000c002ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c002ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff8000966c7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff8000966c7c20 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 #2: ffff0000c8af0258 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x198/0x320 drivers/net/netdevsim/fib.c:1490 locks held by kworker/1:5/5032: 4, on CPU#1: #0: ffff0000c002ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #0: ffff0000c002ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x8c8/0x1250 kernel/workqueue.c:3578 #1: ffff80009b147c20 ((work_completion)(&helper->damage_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3470 [inline] #1: ffff80009b147c20 ((work_completion)(&helper->damage_work)){+.+.}-{0:0}, at: process_scheduled_works+0x8d0/0x1250 kernel/workqueue.c:3578 #2: ffff0000c6fc6270 (&helper->lock){+.+.}-{4:4}, at: drm_fb_helper_fb_dirty drivers/gpu/drm/clients/drm_fbdev_helper.c:295 [inline] #2: ffff0000c6fc6270 (&helper->lock){+.+.}-{4:4}, at: drm_fb_helper_damage_work+0x120/0xbc0 drivers/gpu/drm/clients/drm_fbdev_helper.c:336 #3: ffff0000c6f80128 (&dev->master_mutex){+.+.}-{4:4}, at: drm_master_internal_acquire+0x24/0x78 drivers/gpu/drm/drm_auth.c:435 locks held by syz.1.3811/25641: 5, last CPU#1: #0: ffff0000c14946a0 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 #1: ffff0000c9688478 (sb_writers#3){++++}-{0:0}, at: sb_wait_write fs/super.c:1977 [inline] #1: ffff0000c9688478 (sb_writers#3){++++}-{0:0}, at: freeze_super+0x498/0xf6c fs/super.c:2241 #2: ffff0000c9688100 (&type->s_umount_key#32){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline] #2: ffff0000c9688100 (&type->s_umount_key#32){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline] #2: ffff0000c9688100 (&type->s_umount_key#32){++++}-{4:4}, at: freeze_super+0x4a0/0xf6c fs/super.c:2242 #3: ffff0000c9688570 (sb_pagefaults){++++}-{0:0}, at: sb_wait_write fs/super.c:1977 [inline] #3: ffff0000c9688570 (sb_pagefaults){++++}-{0:0}, at: freeze_super+0x4b8/0xf6c fs/super.c:2246 #4: ffff0000c9688668 (sb_internal){++++}-{0:0}, at: sb_wait_write fs/super.c:1977 [inline] #4: ffff0000c9688668 (sb_internal){++++}-{0:0}, at: freeze_super+0x780/0xf6c fs/super.c:2260 locks held by syz.1.3811/25659: 1, on CPU#1: #0: ffff0000c14946a0 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 locks held by syz.1.3811/25660: 1, on CPU#1: #0: ffff0000c9688100 (&type->s_umount_key#32){++++}-{4:4}, at: __super_lock fs/super.c:62 [inline] #0: ffff0000c9688100 (&type->s_umount_key#32){++++}-{4:4}, at: super_lock+0x258/0x344 fs/super.c:124 locks held by syz.0.3808/25644: 2, last CPU#1: #0: ffff0000c1495220 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 #1: ffff0000f0a58478 (sb_writers#3){++++}-{0:0}, at: sb_wait_write fs/super.c:1977 [inline] #1: ffff0000f0a58478 (sb_writers#3){++++}-{0:0}, at: freeze_super+0x498/0xf6c fs/super.c:2241 locks held by syz.0.3808/25667: 1, on CPU#1: #0: ffff0000c1495220 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 locks held by syz.0.3808/25668: 1, last CPU#1: #0: ffff0000f0a58100 (&type->s_umount_key#32){++++}-{4:4}, at: __super_lock fs/super.c:62 [inline] #0: ffff0000f0a58100 (&type->s_umount_key#32){++++}-{4:4}, at: super_lock+0x258/0x344 fs/super.c:124 locks held by syz.2.3812/25646: 4, last CPU#0: #0: ffff0000c1493b20 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 #1: ffff0000ea2de478 (sb_writers#3){++++}-{0:0}, at: sb_wait_write fs/super.c:1977 [inline] #1: ffff0000ea2de478 (sb_writers#3){++++}-{0:0}, at: freeze_super+0x498/0xf6c fs/super.c:2241 #2: ffff0000ea2de100 (&type->s_umount_key#32){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline] #2: ffff0000ea2de100 (&type->s_umount_key#32){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline] #2: ffff0000ea2de100 (&type->s_umount_key#32){++++}-{4:4}, at: freeze_super+0x4a0/0xf6c fs/super.c:2242 #3: ffff0000ea2de570 (sb_pagefaults){++++}-{0:0}, at: sb_wait_write fs/super.c:1977 [inline] #3: ffff0000ea2de570 (sb_pagefaults){++++}-{0:0}, at: freeze_super+0x4b8/0xf6c fs/super.c:2246 locks held by syz.2.3812/25664: 1, on CPU#0: #0: ffff0000c1493b20 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 locks held by syz.2.3812/25665: 1, on CPU#0: #0: ffff0000ea2de100 (&type->s_umount_key#32){++++}-{4:4}, at: __super_lock fs/super.c:62 [inline] #0: ffff0000ea2de100 (&type->s_umount_key#32){++++}-{4:4}, at: super_lock+0x258/0x344 fs/super.c:124 locks held by kmmpd-loop1/25649: 1, on CPU#1: #0: ffff0000c9688478 (sb_writers#3){++++}-{0:0}, at: kmmpd+0x2fc/0x938 fs/ext4/mmp.c:173 locks held by kmmpd-loop2/25651: 1, on CPU#1: #0: ffff0000ea2de478 (sb_writers#3){++++}-{0:0}, at: kmmpd+0x2fc/0x938 fs/ext4/mmp.c:173 locks held by syz.3.3813/25658: 2, last CPU#0: #0: ffff0000c1492fa0 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 #1: ffff0000eab62478 (sb_writers#3){++++}-{0:0}, at: sb_wait_write fs/super.c:1977 [inline] #1: ffff0000eab62478 (sb_writers#3){++++}-{0:0}, at: freeze_super+0x498/0xf6c fs/super.c:2241 locks held by syz.3.3813/25671: 1, on CPU#0: #0: ffff0000c1492fa0 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 locks held by syz.3.3813/25672: 1, last CPU#0: #0: ffff0000eab62478 (sb_writers#3){++++}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff0000eab62478 (sb_writers#3){++++}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff0000eab62478 (sb_writers#3){++++}-{0:0}, at: rcuwait_wake_up+0x38/0x25c kernel/exit.c:322 locks held by syz.4.3814/25662: 2, last CPU#0: #0: ffff0000c1492420 (&bdev->bd_fsfreeze_mutex){+.+.}-{4:4}, at: bdev_freeze+0x38/0x2e8 block/bdev.c:304 #1: ffff0000da54c478 (sb_writers#3){++++}-{0:0}, at: sb_wait_write fs/super.c:1977 [inline] #1: ffff0000da54c478 (sb_writers#3){++++}-{0:0}, at: freeze_super+0x498/0xf6c fs/super.c:2241 locks held by syz-executor/25983: 1, on CPU#1: #0: ffff80008abcf5a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 locks held by syz-executor/26125: 7, on CPU#0: #0: ffff0000d11a0478 (sb_writers#6){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff0000d11a0478 (sb_writers#6){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000c9acb880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 #2: ffff0000ca4c5008 (kn->active#55){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff0000ca4c5008 (kn->active#55){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1f0/0x3b8 fs/kernfs/file.c:337 #3: ffff80008a3ad460 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd8/0x2d4 drivers/net/netdevsim/bus.c:233 #4: ffff0000da8f3128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff0000da8f3128 (&dev->mutex){....}-{4:4}, at: __device_driver_lock+0x94/0xcc drivers/base/dd.c:1046 #5: ffff0000da8f2258 (&devlink->lock_key#14){+.+.}-{4:4}, at: devl_lock+0x24/0x34 net/devlink/core.c:314 #6: ffff80008abcf5a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 locks held by syz-executor/26181: 3, on CPU#0: #0: ffff8000898bbaf8 (&ops->srcu#2){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline] #0: ffff8000898bbaf8 (&ops->srcu#2){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:320 [inline] #0: ffff8000898bbaf8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x17c/0x26c net/core/rtnetlink.c:602 #1: ffff80008abcf5a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffff80008abcf5a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock+0x38/0x10c net/core/rtnetlink.c:366 #2: ffff80008994a5a0 (wq_pool_mutex){+.+.}-{4:4}, at: __alloc_workqueue+0xa84/0x121c kernel/workqueue.c:6201 locks held by syz-executor/26191: 1, on CPU#0: #0: ffff80008abcf5a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 =============================================

Crashes (2):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2026/11/09 15:30	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	58c1eb84e977	5cecaf1f	.config	console log	report	syz / log	C		[disk image] [vmlinux] [kernel image] [mounted in repro (clean fs)]	ci-upstream-gce-arm64	INFO: task hung in bdev_freeze
2026/11/07 18:20	git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci	58c1eb84e977	5cecaf1f	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-gce-arm64	INFO: task hung in bdev_freeze

Crashes (2):

Assets (help?)