[syzbot] [jfs?] [xfs?] [bcachefs?] INFO: task hung in sb_start_write (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: a5806cd506af Linux 6.15-rc7
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11923f68580000
kernel config: https://syzkaller.appspot.com/x/.config?x=3340af1a8845dd35
dashboard link: https://syzkaller.appspot.com/bug?extid=b3fba2e269970207b61d
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/652000eacd92/disk-a5806cd5.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2b445a74e31e/vmlinux-a5806cd5.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0a4ef01f165f/bzImage-a5806cd5.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b3fba2...@syzkaller.appspotmail.com

INFO: task syz.9.533:10335 blocked for more than 143 seconds.
Not tainted 6.15.0-rc7-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.533 state:D stack:24344 pid:10335 tgid:10334 ppid:7718 task_flags:0x400140 flags:0x00000004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x168f/0x4c70 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6860
percpu_rwsem_wait+0x2ab/0x300 kernel/locking/percpu-rwsem.c:162
__percpu_down_read+0xe3/0x120 kernel/locking/percpu-rwsem.c:177
percpu_down_read include/linux/percpu-rwsem.h:66 [inline]
__sb_start_write include/linux/fs.h:1783 [inline]
sb_start_write+0x185/0x1c0 include/linux/fs.h:1919
mnt_want_write+0x41/0x90 fs/namespace.c:556
open_last_lookups fs/namei.c:3789 [inline]
path_openat+0x85d/0x3830 fs/namei.c:4036
do_filp_open+0x1fa/0x410 fs/namei.c:4066
do_sys_openat2+0x121/0x1c0 fs/open.c:1429
do_sys_open fs/open.c:1444 [inline]
__do_sys_openat fs/open.c:1460 [inline]
__se_sys_openat fs/open.c:1455 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1455
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8e2a18e969
RSP: 002b:00007f8e2b0be038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f8e2a3b5fa0 RCX: 00007f8e2a18e969
RDX: 000000000000275a RSI: 0000200000000100 RDI: ffffffffffffff9c
RBP: 00007f8e2a210ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f8e2a3b5fa0 R15: 00007fffe529a348
</TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6764
5 locks held by kworker/u8:2/36:
2 locks held by kworker/u8:6/1089:
2 locks held by getty/5583:
#0: ffff88803055e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002ffe2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
1 lock held by udevd/9862:
2 locks held by udevd/10189:
#0: ffff888022a2e3a0 (&sb->s_type->i_mutex_key#7){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:877 [inline]
#0: ffff888022a2e3a0 (&sb->s_type->i_mutex_key#7){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 block/fops.c:808
#1: ffff8880b88399d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:605
1 lock held by syz.9.533/10335:
#0: ffff88802f0e0420 (sb_writers#25){++++}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:556
3 locks held by syz-executor/12892:
#0: ffff8880b89399d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:605
#1: ffff8880b8923b08 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x39e/0x6d0 kernel/sched/psi.c:987
#2: ffff88807a093758 (&sb->s_type->i_lock_key#9){+.+.}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline]
#2: ffff88807a093758 (&sb->s_type->i_lock_key#9){+.+.}-{3:3}, at: lock_for_kill+0x84/0x210 fs/dcache.c:705
2 locks held by syz.2.1023/13285:
2 locks held by dhcpcd-run-hook/13307:
#0: ffff8880b89399d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:605
#1: ffff8880b8923b08 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x39e/0x6d0 kernel/sched/psi.c:987

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
watchdog+0xfee/0x1030 kernel/hung_task.c:437
kthread+0x711/0x8a0 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 13310 Comm: rm Not tainted 6.15.0-rc7-syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:file_ref_inc include/linux/file_ref.h:121 [inline]
RIP: 0010:get_file include/linux/fs.h:1133 [inline]
RIP: 0010:__mmap_new_file_vma mm/vma.c:2352 [inline]
RIP: 0010:__mmap_new_vma mm/vma.c:2417 [inline]
RIP: 0010:__mmap_region mm/vma.c:2519 [inline]
RIP: 0010:mmap_region+0xf23/0x1e50 mm/vma.c:2597
Code: 24 18 01 00 00 48 89 44 24 50 49 8d be 60 01 00 00 be 08 00 00 00 e8 1c 3f 0e 00 41 bf 01 00 00 00 f0 4d 0f c1 be 60 01 00 00 <31> ff 4c 89 fe e8 83 6c ae ff 4d 85 ff 78 74 e8 99 67 ae ff 4c 8b
RSP: 0018:ffffc9000418f2c0 EFLAGS: 00000202
RAX: ffffc9000418f301 RBX: ffff88806733f2a0 RCX: ffffffff82118924
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88807e407820
RBP: ffffc9000418f730 R08: ffff88807e407827 R09: 1ffff1100fc80f04
R10: dffffc0000000000 R11: ffffed100fc80f05 R12: ffff88806733f280
R13: ffffc9000418f3d0 R14: ffff88807e4076c0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881261f6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055aa8d186008 CR3: 000000007f374000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_mmap+0xc68/0x1100 mm/mmap.c:561
vm_mmap_pgoff+0x31b/0x4c0 mm/util.c:579
elf_map fs/binfmt_elf.c:387 [inline]
elf_load+0x140/0x6c0 fs/binfmt_elf.c:414
load_elf_interp+0x469/0xaf0 fs/binfmt_elf.c:681
load_elf_binary+0x19d2/0x27a0 fs/binfmt_elf.c:1246
search_binary_handler fs/exec.c:1778 [inline]
exec_binprm fs/exec.c:1810 [inline]
bprm_execve+0x999/0x1440 fs/exec.c:1862
do_execveat_common+0x510/0x6a0 fs/exec.c:1968
do_execve fs/exec.c:2042 [inline]
__do_sys_execve fs/exec.c:2118 [inline]
__se_sys_execve fs/exec.c:2113 [inline]
__x64_sys_execve+0x94/0xb0 fs/exec.c:2113
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6e5ef70107
Code: Unable to access opcode bytes at 0x7f6e5ef700dd.
RSP: 002b:00007fff92965db8 EFLAGS: 00000246 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00005577b8e42fe0 RCX: 00007f6e5ef70107
RDX: 00005577b8e43000 RSI: 00005577b8e42fe0 RDI: 00005577b8e43088
RBP: 00005577b8e43088 R08: 00007fff92968e28 R09: 0000000000000000
R10: 0000000000000008 R11: 0000000000000246 R12: 00005577b8e43000
R13: 00007f6e5f135e8b R14: 00005577b8e43000 R15: 0000000000000000
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: f9a2394a2348 Merge tag 'mm-hotfixes-stable-2026-08-06-18-4..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1379cfb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=98da55a882774dfe
dashboard link: https://syzkaller.appspot.com/bug?extid=b3fba2e269970207b61d
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=14b9d7b9580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b3fba2...@syzkaller.appspotmail.com

INFO: task syz-executor328:5959 blocked for more than 15 seconds.
Not tainted syzkaller #0

"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz-executor328 state:D stack:28328 pid:5959 tgid:5959 ppid:5947 task_flags:0x400040 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x16dc/0x5500 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7326
percpu_rwsem_wait+0x32d/0x4a0 kernel/locking/percpu-rwsem.c:164
__percpu_down_read+0xf8/0x140 kernel/locking/percpu-rwsem.c:180
percpu_down_read_internal include/linux/percpu-rwsem.h:67 [inline]
percpu_down_read_freezable include/linux/percpu-rwsem.h:83 [inline]
__sb_start_write include/linux/fs/super.h:19 [inline]
sb_start_write+0x18e/0x1c0 include/linux/fs/super.h:125
mnt_want_write+0x41/0x90 fs/namespace.c:494
do_tmpfile+0x6c/0x240 fs/namei.c:4817
path_openat+0x3095/0x3850 fs/namei.c:4854
do_file_open+0x23e/0x4a0 fs/namei.c:4892
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3fb490aaf7
RSP: 002b:00007fff7f2f6f10 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000555578a51400 RCX: 00007f3fb490aaf7
RDX: 0000000000410001 RSI: 00007f3fb494a764 RDI: ffffffffffffff9c
RBP: 00007f3fb494a764 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000001b6 R11: 0000000000000202 R12: 00007fff7f2f70d8
R13: 0000000000000002 R14: 00007f3fb4970c80 R15: 0000000000000002

</TASK>

Showing all locks held in the system:

1 lock held by khungtaskd/38:
#0: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5356:
#0: ffff88803688d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003cc62e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
1 lock held by syz-executor328/5959:
#0: ffff888035a88500 (sb_writers#4){++++}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:494

=============================================

NMI backtrace for cpu 1

CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:

NMI backtrace for cpu 0

CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: cb 6e 02 e9 13 cf 03 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 44 24 00 fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8de07de0 EFLAGS: 00000242
RAX: 000000000009a1e9 RBX: ffffffff81998590 RCX: 0000000080000001
RDX: 0000000000000001 RSI: ffffffff8d887e30 RDI: ffffffff8bca6d80
RBP: ffffffff8de07eb8 R08: ffff8880b8633d5b R09: 1ffff110170c67ab
R10: dffffc0000000000 R11: ffffed10170c67ac R12: 0000000000000000
R13: 1ffffffff1bdede8 R14: 1ffffffff1bc0fc4 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff888125c36000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000563216b981d0 CR3: 000000000dfb0000 CR4: 00000000003526f0
Call Trace:
<TASK>
arch_safe_halt arch/x86/kernel/process.c:767 [inline]
default_idle+0x9/0x20 arch/x86/kernel/process.c:768
default_idle_call+0x72/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:199 [inline]
do_idle+0x2e0/0x540 kernel/sched/idle.c:355
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:454
rest_init+0x2de/0x300 init/main.c:717
start_kernel+0x392/0x3e0 init/main.c:1175
x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310
x86_64_start_kernel+0x137/0x1b0 arch/x86/kernel/head64.c:291
common_startup_64+0x13e/0x157
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

[Christian Brauner]

The reproducer freezes the root filesystem with FIFREEZE and then opens
O_TMPFILE on it from a child. Excellent. In addition to that it also
lowers hung_task_timeout_secs to 15 before freezing and only thaws after
60 seconds... Nothing is stuck and the machine recovers.

The older crashes look like the same thing. So the fuzzer freezes a
filesystem and some other program writes to it. That also explains why
there's only ever the one blocked task and nothing else in the system
holding anything.

So maybe gate that ioctl for syzkaller?

And the LLM thing that is attached to the report is wrong.

#syz invalid

[Aleksandr Nogikh]

Thanks for sharing the analysis!

>
> The older crashes look like the same thing. So the fuzzer freezes a
> filesystem and some other program writes to it. That also explains why
> there's only ever the one blocked task and nothing else in the system
> holding anything.
>
> So maybe gate that ioctl for syzkaller?

Normally, we prohibit using FIFREEZE during fuzzing, so the original
finding shouldn't have been caused by it.

But the C reproducer was indeed generated by an LLM, which was not
subject to such restrictions.
I've filed the issue and we'll find a way to address it.

>
> And the LLM thing that is attached to the report is wrong.
>
> #syz invalid
>

FWIW it's better to just keep such bugs open.
"syz invalid" indicates that the issue is a rare or already addressed
false positive and is no longer relevant. In this case, however,
syzbot keeps observing the crash daily, so it will try to re-report it
the next time it observes it.

Something like "#syz set prio: low" and/or "#syz set no-reminders"
would have been a better fit here:
https://github.com/google/syzkaller/blob/master/docs/syzbot.md#bug-labels

--
Aleksandr