INFO: task jfsCommit:127 blocked in I/O wait for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jfsCommit state:D stack:27688 pid:127 tgid:127 ppid:2 task_flags:0x200040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7362
io_schedule+0x80/0xe0 kernel/sched/core.c:8190
__lock_metapage fs/jfs/jfs_metapage.c:52 [inline]
lock_metapage+0x1fe/0x400 fs/jfs/jfs_metapage.c:66
__get_metapage+0x47a/0xdf0 fs/jfs/jfs_metapage.c:749
diIAGRead+0xce/0x140 fs/jfs/jfs_imap.c:2672
diFree+0x9ce/0x2cc0 fs/jfs/jfs_imap.c:959
jfs_evict_inode+0x324/0x430 fs/jfs/inode.c:162
evict+0x624/0xb50 fs/inode.c:822
txLazyCommit fs/jfs/jfs_txnmgr.c:2666 [inline]
jfs_lazycommit+0x3f3/0xa20 fs/jfs/jfs_txnmgr.c:2735
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task syz-executor:5694 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:22072 pid:5694 tgid:5694 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7362
jfs_flush_journal+0x719/0xf50 fs/jfs/jfs_logmgr.c:1561
jfs_sync_fs+0x7d/0xa0 fs/jfs/super.c:650
sync_filesystem+0x1d1/0x250 fs/sync.c:66
generic_shutdown_super+0x77/0x2d0 fs/super.c:748
kill_block_super+0x44/0xa0 fs/super.c:1918
deactivate_locked_super+0xbc/0x110 fs/super.c:603
cleanup_mnt+0x3d3/0x460 fs/namespace.c:1317
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2d85caf397
RSP: 002b:00007ffe35252e98 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007f2d85d44474 RCX: 00007f2d85caf397
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffe35252f50
RBP: 00007ffe35252f50 R08: 00007ffe35253f50 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe35253fe0
R13: 00007f2d85d44474 R14: 00000000000342d7 R15: 00007ffe35254020
Showing all locks held in the system:
locks held by khungtaskd/38: 1, last CPU#1:
#0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6837
locks held by jfsCommit/127: 2, on CPU#1:
#0: ffff888041c98900 (&(imap->im_aglock[index])){+.+.}-{4:4}, at: diFree+0x2da/0x2cc0 fs/jfs/jfs_imap.c:889
#1: ffff888061c41e60 (&jfs_ip->rdwrlock/1){++++}-{4:4}, at: diFree+0x2f8/0x2cc0 fs/jfs/jfs_imap.c:894
locks held by jfsCommit/128: 2, on CPU#1:
#0: ffff8880438b8900 (&(imap->im_aglock[index])){+.+.}-{4:4}, at: diFree+0x2da/0x2cc0 fs/jfs/jfs_imap.c:889
#1: ffff8880669094b8 (&jfs_ip->rdwrlock/1){++++}-{4:4}, at: diFree+0x2f8/0x2cc0 fs/jfs/jfs_imap.c:894
locks held by kworker/u8:86/1939: 9, last CPU#0:
#0: ffff888033a92138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff888033a92138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff888033a92138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff888033a92138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc90008067c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90008067c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90008067c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc90008067c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffffffff8f5d1cf8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
#2: ffffffff8f5d1cf8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x123/0x16e0 net/ipv6/addrconf.c:4230
#3: ffff88807b0a0628 (&idev->mc_lock){+.+.}-{4:4}, at: __ipv6_dev_mc_inc+0x4e/0xaf0 net/ipv6/mcast.c:963
#4: ffffffff8e0594c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#5: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#6: ffff88802acfc3b0 (&macsec_netdev_addr_lock_key/1){+...}-{3:3}, at: netif_addr_lock_bh include/linux/netdevice.h:5009 [inline]
#6: ffff88802acfc3b0 (&macsec_netdev_addr_lock_key/1){+...}-{3:3}, at: __dev_mc_add net/core/dev_addr_lists.c:997 [inline]
#6: ffff88802acfc3b0 (&macsec_netdev_addr_lock_key/1){+...}-{3:3}, at: dev_mc_add+0x6c/0x140 net/core/dev_addr_lists.c:1016
#7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock_nested+0x1e0/0x400 kernel/locking/spinlock_rt.c:65
#8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
#8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
locks held by kworker/u8:98/1951: 7, on CPU#0:
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc900081d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc900081d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc900081d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc900081d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffff88802b458310 (&devlink->lock_key#20){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 drivers/net/netdevsim/dev.c:834
#3: ffff8880611bf920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff8880611bf920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:787 [inline]
#3: ffff8880611bf920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 drivers/net/netdevsim/dev.c:847
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
#5: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#6: ffff888026875858 (&fq->mq_flush_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#6: ffff888026875858 (&fq->mq_flush_lock){+.+.}-{3:3}, at: flush_end_io+0xb8/0xec0 block/blk-flush.c:212
locks held by kworker/u8:99/1952: 2, on CPU#0:
#0: ffff88813ff64138 ((wq_completion)eve
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc900081f7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc900081f7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc900081f7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc900081f7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
locks held by kworker/u8:101/1954: 9, last CPU#0:
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc90008247c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90008247c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90008247c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc90008247c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffff8880338ec310 (&devlink->lock_key#16){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 drivers/net/netdevsim/dev.c:834
#3: ffff8880603f8920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff8880603f8920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:787 [inline]
#3: ffff8880603f8920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 drivers/net/netdevsim/dev.c:847
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
#5: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#6: ffff888026875858 (&fq->mq_flush_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#6: ffff888026875858 (&fq->mq_flush_lock){+.+.}-{3:3}, at: mq_flush_data_end_io+0x2d6/0x4c0 block/blk-flush.c:357
#7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#7: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
#8: ffff8880b863c320 (&rq->__lock){-...}-{2:2}, at: finish_lock_switch kernel/sched/core.c:5248 [inline]
#8: ffff8880b863c320 (&rq->__lock){-...}-{2:2}, at: finish_task_switch+0x159/0xc60 kernel/sched/core.c:5369
locks held by kworker/u8:111/1964: 2, on CPU#0:
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88813ff64138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc90008387c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90008387c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90008387c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc90008387c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
locks held by getty/5441: 2, on CPU#0:
#0: ffff888036fc00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900044cb2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
locks held by syz-executor/5694: 1, on CPU#1:
#0: ffff8880661c00e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff8880661c00e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff8880661c00e0 (&type->s_umount_key#67){++++}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:631
locks held by kworker/0:6/5805: 13, last CPU#0:
#0: ffff888033a0d938 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff888033a0d938 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff888033a0d938 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff888033a0d938 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc900061e7c40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc900061e7c40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc900061e7c40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc900061e7c40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffff88804147a628 (&idev->mc_lock){+.+.}-{4:4}, at: mld_ifc_work+0x2d/0xd60 net/ipv6/mcast.c:2738
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: mld_sendpack+0x206/0xe10 net/ipv6/mcast.c:1862
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#4: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: ip6_output+0x11e/0x540 net/ipv6/ip6_output.c:236
#5: ffffffff8e0594c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#6: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#7: ffffffff8e1c3b20 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#7: ffffffff8e1c3b20 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline]
#7: ffffffff8e1c3b20 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x294/0x3880 net/core/dev.c:4844
#8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#8: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: br_dev_xmit+0x189/0x19d0 net/bridge/br_device.c:52
#9: ffff88803f81da38 (&br->multicast_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#9: ffff88803f81da38 (&br->multicast_lock){+...}-{3:3}, at: br_multicast_add_group net/bridge/br_multicast.c:1570 [inline]
#9: ffff88803f81da38 (&br->multicast_lock){+...}-{3:3}, at: br_ip6_multicast_add_group net/bridge/br_multicast.c:1623 [inline]
#9: ffff88803f81da38 (&br->multicast_lock){+...}-{3:3}, at: br_ip6_multicast_mld2_report net/bridge/br_multicast.c:3109 [inline]
#9: ffff88803f81da38 (&br->multicast_lock){+...}-{3:3}, at: br_multicast_ipv6_rcv net/bridge/br_multicast.c:4049 [inline]
#9: ffff88803f81da38 (&br->multicast_lock){+...}-{3:3}, at: br_multicast_rcv+0x3c2b/0x77c0 net/bridge/br_multicast.c:4107
#10: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#10: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#10: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#10: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
#11: ffffffff8e0594c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#12: ffffffff8f950458 (deferred_lock){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
#12: ffffffff8f950458 (deferred_lock){+...}-{3:3}, at: switchdev_deferred_enqueue+0x151/0x260 net/switchdev/switchdev.c:124
locks held by kworker/1:5/5812: 3, on CPU#1:
#0: ffff88813ff27938 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813ff27938 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813ff27938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88813ff27938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc900062d7c40 (deferred_process_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc900062d7c40 (deferred_process_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc900062d7c40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc900062d7c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffffffff8f5d1cf8 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
locks held by syz-executor/6950: 2, on CPU#0:
#0: ffff88804e34c0e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff88804e34c0e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff88804e34c0e0 (&type->s_umount_key#67){++++}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:631
#1: ffffffff8e66d598 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xad/0x530 fs/jfs/jfs_logmgr.c:1441
locks held by syz-executor/6961: 1, on CPU#0:
#0: ffff88802cff20e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff88802cff20e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff88802cff20e0 (&type->s_umount_key#67){++++}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:631
locks held by syz-executor/7080: 2, on CPU#0:
#0: ffff88804fbec0e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff88804fbec0e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff88804fbec0e0 (&type->s_umount_key#67){++++}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:631
#1: ffffffff8e66d598 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xad/0x530 fs/jfs/jfs_logmgr.c:1441
locks held by syz-executor/7121: 2, on CPU#1:
#0: ffff88805acea0e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff88805acea0e0 (&type->s_umount_key#67){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff88805acea0e0 (&type->s_umount_key#67){++++}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:631
#1: ffffffff8e66d598 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xad/0x530 fs/jfs/jfs_logmgr.c:1441
locks held by syz-executor/8001: 1, last CPU#0:
#0: ffff888066a2e138 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
#0: ffff888066a2e138 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 net/socket.c:734
locks held by syz-executor/8002: 2, on CPU#1:
#0: ffff8880585620e0 (&type->s_umount_key#114){+.+.}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff8880585620e0 (&type->s_umount_key#114){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff8880585620e0 (&type->s_umount_key#114){+.+.}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:631
#1: ffff88802ce90080 (&nilfs->ns_sem){++++}-{4:4}, at: nilfs_put_super+0x90/0x150 fs/nilfs2/super.c:512
locks held by udevd/8765: 5, last CPU#0:
#0: ffff8880374a8510 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:494
#1: ffff888033905610 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline]
#1: ffff888033905610 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3785 [inline]
#1: ffff888033905610 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: __start_renaming+0x148/0x410 fs/namei.c:3878
#2: ffff8880406af410 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
#2: ffff8880406af410 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: lock_two_nondirectories+0xe7/0x180 fs/inode.c:1254
#3: ffff88804e27ce90 (&sb->s_type->i_mutex_key#14/4){+.+.}-{4:4}, at: vfs_rename+0x696/0xef0 fs/namei.c:6168
#4: ffff888033905378 (&simple_offset_lock_class){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#4: ffff888033905378 (&simple_offset_lock_class){+.+.}-{3:3}, at: mtree_store_range+0x19d/0x250 lib/maple_tree.c:5858
locks held by syz.2.217/8823: 3, last CPU#0:
#0: ffff88801aeb8510 (sb_writers#5){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff88801aeb8510 (sb_writers#5){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88804109c710 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
#1: ffff88804109c710 (&sb->s_type->i_mutex_key#14){+.+.}-{4:4}, at: shmem_file_write_iter+0x82/0x120 mm/shmem.c:3430
#2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
locks held by modprobe/8831: 1, last CPU#0:
#0: ffff88804069ba30 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline]
#0: ffff88804069ba30 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323
locks held by dhcpcd-run-hook/8832: 1, last CPU#0:
#0: ffff8880406991b0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
#0: ffff8880406991b0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1e0/0x4e0 mm/util.c:579
locks held by modprobe/8833: 4, last CPU#0:
#0: ffff88804002b448 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:310
#1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 mm/pgtable-generic.c:290
#2: ffff888038f5ac58 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff888038f5ac58 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 1954 Comm: kworker/u8:101 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:__bfs kernel/locking/lockdep.c:-1 [inline]
RIP: 0010:__bfs_backwards kernel/locking/lockdep.c:1876 [inline]
RIP: 0010:check_irq_usage kernel/locking/lockdep.c:2812 [inline]
RIP: 0010:check_prev_add kernel/locking/lockdep.c:3185 [inline]
RIP: 0010:check_prevs_add kernel/locking/lockdep.c:3300 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3924 [inline]
RIP: 0010:__lock_acquire+0x19da/0x2e40 kernel/locking/lockdep.c:5254
Code: 89 c1 81 e1 ff 0f 00 00 89 0d 16 a8 09 14 2b 05 0c a8 09 14 25 ff 0f 00 00 39 05 cd a7 08 12 73 06 89 05 c5 a7 08 12 48 8b 02 <49> 89 d8 4c 39 e8 0f 84 30 fe ff ff 4c 89 78 30 48 8b 00 4c 39 e8
RSP: 0018:ffffc90008247020 EFLAGS: 00000002
RAX: ffffffff9631dc58 RBX: 00000000000003cd RCX: 0000000000000418
RDX: ffffffff9631d8d8 RSI: ffff88802c0bacc0 RDI: ffff88802c0b9f40
RBP: 93a4c6ca8492bd29 R08: 00000000000003cd R09: 0000000000000020
R10: 0000000000000000 R11: ffffffff81a22610 R12: 0000000000000417
R13: ffffffff934dfba0 R14: ffff88802c0bacc0 R15: ffffffff96472bf8
FS: 0000000000000000(0000) GS:ffff888125bd4000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005622f8a26e28 CR3: 000000005c58e000 CR4: 00000000003526f0
Call Trace:
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
seqcount_lockdep_reader_access+0x55/0x100 include/linux/seqlock.h:73
ktime_get+0x45/0x220 kernel/time/timekeeping.c:1002
clockevents_program_event+0x290/0x630 kernel/time/clockevents.c:363
hrtimer_rearm kernel/time/hrtimer.c:2169 [inline]
__hrtimer_rearm_deferred+0x37e/0x4d0 kernel/time/hrtimer.c:2189
hrtimer_rearm_deferred_tif include/linux/hrtimer_rearm.h:58 [inline]
hrtimer_rearm_deferred include/linux/hrtimer_rearm.h:67 [inline]
irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:505 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:542 [inline]
irqentry_exit+0x8d3/0x910 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:finish_task_switch+0x413/0xc60 kernel/sched/core.c:5371
Code: 04 00 00 41 c7 84 24 20 0e 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 07 c3 c3 09 e8 f2 0a 39 00 fb 4c 8b 65 c8 <49> 8d bc 24 f8 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc90008247460 EFLAGS: 00000206
RAX: 00000000002fbd84 RBX: ffff8880b863d0e0 RCX: 8000000000000001
RDX: 0000000000000002 RSI: ffffffff8d8ca278 RDI: ffffffff8bcc2280
RBP: ffffc900082474b0 R08: ffffffff8fb1e17f R09: 1ffffffff1f63c2f
R10: dffffc0000000000 R11: fffffbfff1f63c30 R12: ffff88802c0b9f40
R13: ffff8880b863d0a8 R14: dffffc0000000000 R15: 1ffff110170c7a1c
context_switch kernel/sched/core.c:5523 [inline]
__schedule+0x16e1/0x5700 kernel/sched/core.c:7270
preempt_schedule_irq+0x4b/0x90 kernel/sched/core.c:7592
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x14f/0x910 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:mod_delayed_work_on+0x16a/0x190 kernel/workqueue.c:2708
Code: 01 00 f0 83 44 24 fc 00 e9 62 ff ff ff e8 fe 43 38 00 e8 19 af c7 09 48 85 db 74 aa e8 ef 43 38 00 fb 65 48 8b 05 4e 8a 16 11 <48> 3b 44 24 28 75 19 0f b6 44 24 07 48 83 c4 30 5b 41 5c 41 5d 41
RSP: 0000:ffffc900082477d0 EFLAGS: 00000246
RAX: f77366a7cff15600 RBX: 0000000000000200 RCX: ffff88802c0b9f40
RDX: 0000000000000000 RSI: 0000000000000100 RDI: 0000000000000100
RBP: 0000000000000008 R08: 0000000000000100 R09: 0000000000000100
R10: dffffc0000000000 R11: fffffbfff1f63c30 R12: ffff88801da8ec00
R13: 0000000000000000 R14: 0000000000000000 R15: ffff888026875801
kblockd_mod_delayed_work_on+0x29/0x40 block/blk-core.c:1165
mq_flush_data_end_io+0x355/0x4c0 block/blk-flush.c:364
__blk_mq_end_request+0x493/0x650 block/blk-mq.c:1137
blk_complete_reqs block/blk-mq.c:1222 [inline]
blk_done_softirq+0x10a/0x160 block/blk-mq.c:1227
handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
__local_bh_enable_ip+0x16f/0x2b0 kernel/softirq.c:325
local_bh_enable include/linux/bottom_half.h:33 [inline]
__alloc_skb+0x1b1/0x7a0 net/core/skbuff.c:699
alloc_skb include/linux/skbuff.h:1384 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:744 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:801 [inline]
nsim_dev_trap_report_work+0x2b1/0xcb0 drivers/net/netdevsim/dev.c:847
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245