From: syzbot <syzbot+4235e4d7b6fd75704528@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [f2fs?] INFO: task hung in f2fs_release_file (3)
Date: Sat, 06 Dec 2025 03:00:02 -0800 [thread overview]
Message-ID: <69340cb2.a70a0220.38f243.0023.GAE@google.com> (raw)
In-Reply-To: <20251206103410.2311875-1-kartikey406@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in f2fs_release_file
INFO: task syz.0.17:6630 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:26840 pid:6630 tgid:6630 ppid:6466 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7241
rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
__rt_mutex_slowlock_locked+0x1dfe/0x25e0 kernel/locking/rtmutex.c:1760
rt_mutex_slowlock+0xb5/0x160 kernel/locking/rtmutex.c:1800
__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244
inode_lock include/linux/fs.h:1027 [inline]
f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
__fput+0x45b/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x2e3/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f255a87f749
RSP: 002b:00007ffd480f4778 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f255aad7da0 RCX: 00007f255a87f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f255aad7da0 R08: 0000000000000000 R09: 00000006480f4a6f
R10: 00007f255aad7cb0 R11: 0000000000000246 R12: 0000000000027f51
R13: 00007ffd480f4870 R14: ffffffffffffffff R15: 00007ffd480f4890
</TASK>
INFO: task syz.0.17:6631 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:23840 pid:6631 tgid:6630 ppid:6466 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f255a87f749
RSP: 002b:00007f2559ee6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f255aad5fa0 RCX: 00007f255a87f749
RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c
RBP: 00007f255a903f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f255aad6038 R14: 00007f255aad5fa0 R15: 00007ffd480f4618
</TASK>
INFO: task syz.1.18:6657 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18 state:D stack:26840 pid:6657 tgid:6657 ppid:6637 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7241
rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
__rt_mutex_slowlock_locked+0x1dfe/0x25e0 kernel/locking/rtmutex.c:1760
rt_mutex_slowlock+0xb5/0x160 kernel/locking/rtmutex.c:1800
__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244
inode_lock include/linux/fs.h:1027 [inline]
f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
__fput+0x45b/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x2e3/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0733fcf749
RSP: 002b:00007ffd49167788 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f0734227da0 RCX: 00007f0733fcf749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f0734227da0 R08: 0000000000000000 R09: 0000000649167a7f
R10: 00007f0734227cb0 R11: 0000000000000246 R12: 000000000002c7c8
R13: 00007ffd49167880 R14: ffffffffffffffff R15: 00007ffd491678a0
</TASK>
INFO: task syz.1.18:6658 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.18 state:D stack:24488 pid:6658 tgid:6657 ppid:6637 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0733fcf749
RSP: 002b:00007f0733636038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f0734225fa0 RCX: 00007f0733fcf749
RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c
RBP: 00007f0734053f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0734226038 R14: 00007f0734225fa0 R15: 00007ffd49167628
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/38:
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:3/50:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90000bc7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90000bc7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff8880339a40d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:5/153:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90003a97b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90003a97b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888057e3a0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:8/1098:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90004c7fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90004c7fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88802ac120d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:16/3502:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000d517b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000d517b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88805f73a0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
2 locks held by getty/5564:
#0: ffff88814ded00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222
1 lock held by syz.0.17/6630:
#0: ffff888058488178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888058488178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.0.17/6631:
#0: ffff888057e3a480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058571478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888058571478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888058571478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888058571478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888058488178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888058488178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:0/6635:
1 lock held by syz.1.18/6657:
#0: ffff8880585730f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880585730f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.1.18/6658:
#0: ffff88805f73a480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058572778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888058572778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888058572778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888058572778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880585730f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880585730f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:1/6665:
1 lock held by syz.2.19/6689:
#0: ffff88805848b0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805848b0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.2.19/6690:
#0: ffff88802ac12480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805848a778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805848a778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805848a778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805848a778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805848b0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805848b0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:2/6694:
1 lock held by syz.3.20/6718:
#0: ffff88805848d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805848d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.3.20/6719:
#0: ffff888037b64480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805848cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805848cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805848cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805848cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805848d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805848d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:3/6723:
1 lock held by syz.4.21/6753:
#0: ffff8880585756f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880585756f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.4.21/6754:
#0: ffff8880339a4480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058574d78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888058574d78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888058574d78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888058574d78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880585756f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880585756f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
5 locks held by f2fs_ckpt-7:4/6764:
3 locks held by kworker/u8:18/6790:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90004e2fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90004e2fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888037b640d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
1 lock held by syz.5.22/6795:
#0: ffff88805d948178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805d948178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.5.22/6796:
#0: ffff8880346ea480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058577378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888058577378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888058577378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888058577378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805d948178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805d948178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:5/6800:
1 lock held by syz.6.23/6836:
#0: ffff88805da38178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805da38178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.6.23/6837:
#0: ffff888035b9c480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805848f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805848f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805848f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805848f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805da38178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805da38178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:6/6841:
1 lock held by syz.7.24/6882:
#0: ffff88805da3a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805da3a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.7.24/6883:
#0: ffff88805baf2480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805da39df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805da39df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805da39df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805da39df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805da3a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805da3a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:7/6889:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3c/0xf80 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6889 Comm: f2fs_ckpt-7:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:check_preemption_disabled+0x12/0x120 lib/smp_processor_id.c:13
Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 53 48 83 ec 10 65 48 8b 05 1e f2 e5 06 <48> 89 44 24 08 65 8b 05 26 f2 e5 06 65 8b 0d 1b f2 e5 06 f7 c1 ff
RSP: 0018:ffffc900052df610 EFLAGS: 00000082
RAX: 6dac46a9b706f000 RBX: 00000000ffffffff RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffffffff8ce10cff RDI: ffffffff8b3ede60
RBP: 00000000ffffffff R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000a5bec0 R12: 0000000000000046
R13: ffff888024e55ac0 R14: ffff8880348bc360 R15: ffff888024e55ac0
FS: 0000000000000000(0000) GS:ffff888126e52000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0178684f98 CR3: 000000000d3a8000 CR4: 00000000003526f0
Call Trace:
<TASK>
lockdep_recursion_inc kernel/locking/lockdep.c:465 [inline]
lock_is_held_type+0x79/0x190 kernel/locking/lockdep.c:5939
lock_is_held include/linux/lockdep.h:249 [inline]
try_to_take_rt_mutex+0x4f/0xac0 kernel/locking/rtmutex.c:1090
__rt_mutex_slowtrylock kernel/locking/rtmutex.c:1360 [inline]
rt_mutex_slowtrylock kernel/locking/rtmutex.c:1393 [inline]
rt_mutex_try_acquire kernel/locking/rtmutex.c:320 [inline]
__rt_mutex_lock kernel/locking/rtmutex.c:1812 [inline]
rwbase_write_lock+0xce/0x750 kernel/locking/rwbase_rt.c:244
f2fs_down_write fs/f2fs/f2fs.h:2294 [inline]
f2fs_lock_all fs/f2fs/f2fs.h:2374 [inline]
block_operations fs/f2fs/checkpoint.c:1221 [inline]
f2fs_write_checkpoint+0x566/0x26a0 fs/f2fs/checkpoint.c:1689
__write_checkpoint_sync fs/f2fs/checkpoint.c:1813 [inline]
__checkpoint_and_complete_reqs+0xdf/0x3d0 fs/f2fs/checkpoint.c:1832
issue_checkpoint_thread+0xd9/0x260 fs/f2fs/checkpoint.c:1864
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Tested on:
commit: 416f99c3 Merge tag 'driver-core-6.19-rc1' of git://git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=105746c2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8c04d4527fc98ffa
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=150cbc1a580000
next parent reply other threads:[~2025-12-06 11:00 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20251206103410.2311875-1-kartikey406@gmail.com>
2025-12-06 11:00 ` syzbot [this message]
[not found] <20251206085043.2309241-1-kartikey406@gmail.com>
2025-12-06 9:42 ` [syzbot] [f2fs?] INFO: task hung in f2fs_release_file (3) syzbot
[not found] <20251206080323.2307755-1-kartikey406@gmail.com>
2025-12-06 8:44 ` syzbot
[not found] <20251206065547.2305782-1-kartikey406@gmail.com>
2025-12-06 7:14 ` syzbot
[not found] <20251206062639.2237171-1-kartikey406@gmail.com>
2025-12-06 6:49 ` syzbot
[not found] <20251206053425.2146746-1-kartikey406@gmail.com>
2025-12-06 5:59 ` syzbot
[not found] <20251206044704.2056266-1-kartikey406@gmail.com>
2025-12-06 5:24 ` syzbot
[not found] <20251206023055.2014032-1-kartikey406@gmail.com>
2025-12-06 3:07 ` syzbot
[not found] <20251206015802.1917017-1-kartikey406@gmail.com>
2025-12-06 2:28 ` syzbot
2025-12-05 19:05 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69340cb2.a70a0220.38f243.0023.GAE@google.com \
--to=syzbot+4235e4d7b6fd75704528@syzkaller.appspotmail.com \
--cc=kartikey406@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.