[syzbot] [f2fs?] INFO: task hung in f2fs_release_file (3)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 7d0a66e4bb90 Linux 6.18
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14a682b4580000
kernel config: https://syzkaller.appspot.com/x/.config?x=38a0c4cddc846161
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13492192580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12a682b4580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0ea732cc9ee6/disk-7d0a66e4.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/7956b4b2019e/vmlinux-7d0a66e4.xz
kernel image: https://storage.googleapis.com/syzbot-assets/2e344e8da33c/bzImage-7d0a66e4.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/40c651c753a5/mount_0.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=1030a512580000)

Bisection is inconclusive: the first bad commit could be any of:

2aac2538a97d f2fs: do sanity check on xattr node footer in f2fs_get_xnode_page()
1788971e0bfa f2fs: introduce FAULT_INCONSISTENT_FOOTER
1cf6b5670af1 f2fs: do sanity check on inode footer in f2fs_get_inode_page()
986c50f6bca1 f2fs: fix to avoid accessing uninitialized curseg
c2ecba026586 f2fs: control nat_bits feature via mount option
19426c4988aa Revert "f2fs: rebuild nat_bits during umount"

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=1214e512580000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+4235e4...@syzkaller.appspotmail.com

INFO: task syz.0.17:6101 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:25160 pid:6101 tgid:6101 ppid:5984 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x16f3/0x4c20 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7307
rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
__rt_mutex_slowlock_locked+0x1e04/0x25e0 kernel/locking/rtmutex.c:1760
rt_mutex_slowlock+0xb5/0x160 kernel/locking/rtmutex.c:1800
__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244
inode_lock include/linux/fs.h:980 [inline]
f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
__fput+0x45b/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0xfa0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7059d0f749
RSP: 002b:00007ffef7d9ee78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f7059f67da0 RCX: 00007f7059d0f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f7059f67da0 R08: 0000000000000000 R09: 00000006f7d9f16f
R10: 00007f7059f67cb0 R11: 0000000000000246 R12: 000000000002e2cb
R13: 00007ffef7d9ef70 R14: ffffffffffffffff R15: 00007ffef7d9ef90
</TASK>
INFO: task syz.0.17:6102 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.17 state:D stack:24216 pid:6102 tgid:6101 ppid:5984 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x16f3/0x4c20 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7026
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5eb/0xac0 fs/f2fs/namei.c:603
vfs_unlink+0x39a/0x660 fs/namei.c:4673
do_unlinkat+0x345/0x570 fs/namei.c:4737
__do_sys_unlinkat fs/namei.c:4778 [inline]
__se_sys_unlinkat fs/namei.c:4771 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:4771
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7059d0f749
RSP: 002b:00007f705937e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f7059f65fa0 RCX: 00007f7059d0f749
RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c
RBP: 00007f7059d93f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7059f66038 R14: 00007f7059f65fa0 R15: 00007ffef7d9ed18
</TASK>

Showing all locks held in the system:
3 locks held by kworker/0:1/10:
#0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc900000f7ba0 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc900000f7ba0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
1 lock held by khungtaskd/38:
#0: ffffffff8d5aa880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aa880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aa880 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:2/43:
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90000b47ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90000b47ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffff888036f820d0 (&type->s_umount_key#54){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:562
3 locks held by kworker/u8:3/57:
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc9000123fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc9000123fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffff88803dffa0d0 (&type->s_umount_key#54){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:562
3 locks held by kworker/u8:4/69:
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc9000155fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc9000155fba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffff88802416e0d0 (&type->s_umount_key#54){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:562
3 locks held by kworker/u8:5/172:
#0: ffff88814cbaf138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88814cbaf138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90003a6fba0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90003a6fba0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#2: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x119/0x15a0 net/ipv6/addrconf.c:4194
3 locks held by kworker/u8:7/1400:
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90005437ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90005437ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffff888028d100d0 (&type->s_umount_key#54){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:562
3 locks held by kworker/u8:8/1477:
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff888142e88938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90005777ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90005777ba0 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffff88803a6740d0 (&type->s_umount_key#54){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:562
3 locks held by kworker/u8:9/4073:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc9000ebf7ba0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc9000ebf7ba0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303
2 locks held by getty/5558:
#0: ffff88823bf388a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e762e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222
3 locks held by kworker/1:3/5860:
4 locks held by kworker/0:4/6093:
1 lock held by syz.0.17/6101:
#0: ffff8880494f9478 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff8880494f9478 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.0.17/6102:
#0: ffff88803a674480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880494f8af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff8880494f8af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1c7/0x570 fs/namei.c:4724
#2: ffff8880494f9478 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#2: ffff8880494f9478 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: vfs_unlink+0xf2/0x660 fs/namei.c:4662
4 locks held by f2fs_ckpt-7:0/6122:
1 lock held by syz.1.18/6166:
#0: ffff8880494fba78 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff8880494fba78 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.1.18/6167:
#0: ffff888028d10480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880494fb0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff8880494fb0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1c7/0x570 fs/namei.c:4724
#2: ffff8880494fba78 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#2: ffff8880494fba78 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: vfs_unlink+0xf2/0x660 fs/namei.c:4662
2 locks held by f2fs_ckpt-7:1/6171:
1 lock held by syz.2.19/6193:
#0: ffff8880494fe078 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff8880494fe078 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.2.19/6194:
#0: ffff88803dffa480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880494fd6f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff8880494fd6f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1c7/0x570 fs/namei.c:4724
#2: ffff8880494fe078 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#2: ffff8880494fe078 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: vfs_unlink+0xf2/0x660 fs/namei.c:4662
3 locks held by f2fs_ckpt-7:2/6198:
1 lock held by syz.3.20/6226:
#0: ffff888058db8178 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff888058db8178 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.3.20/6227:
#0: ffff88802416e480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880494ff378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff8880494ff378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1c7/0x570 fs/namei.c:4724
#2: ffff888058db8178 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#2: ffff888058db8178 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: vfs_unlink+0xf2/0x660 fs/namei.c:4662
3 locks held by f2fs_ckpt-7:3/6232:
1 lock held by syz.4.21/6262:
#0: ffff888058db8af8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff888058db8af8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.4.21/6263:
#0: ffff888036f82480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888049582778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff888049582778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1c7/0x570 fs/namei.c:4724
#2: ffff888058db8af8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#2: ffff888058db8af8 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: vfs_unlink+0xf2/0x660 fs/namei.c:4662
4 locks held by f2fs_ckpt-7:4/6267:
1 lock held by syz.5.22/6297:
#0: ffff888049584d78 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff888049584d78 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.5.22/6298:
#0: ffff888023d72480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880495843f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff8880495843f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1c7/0x570 fs/namei.c:4724
#2: ffff888049584d78 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#2: ffff888049584d78 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: vfs_unlink+0xf2/0x660 fs/namei.c:4662
2 locks held by f2fs_ckpt-7:5/6302:
1 lock held by syz.6.23/6339:
#0: ffff888058dba778 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff888058dba778 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.6.23/6340:
#0: ffff88803128e480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058db9df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff888058db9df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1c7/0x570 fs/namei.c:4724
#2: ffff888058dba778 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#2: ffff888058dba778 (&sb->s_type->i_mutex_key#20){+.+.}-{4:4}, at: vfs_unlink+0xf2/0x660 fs/namei.c:4662
5 locks held by f2fs_ckpt-7:6/6344:
1 lock held by syz-executor/6347:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf60/0xfa0 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6093 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_power_efficient neigh_periodic_work
RIP: 0010:check_preemption_disabled+0x12/0x120 lib/smp_processor_id.c:13
Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 53 48 83 ec 10 65 48 8b 05 ce f4 e1 06 <48> 89 44 24 08 65 8b 05 d6 f4 e1 06 65 8b 0d cb f4 e1 06 f7 c1 ff
RSP: 0018:ffffc9000402f7c8 EFLAGS: 00000082
RAX: 36eecfcdf4ec5100 RBX: 0000000000000000 RCX: 36eecfcdf4ec5100
RDX: 0000000000000000 RSI: ffffffff8cf66051 RDI: ffffffff8b3de060
RBP: ffffffff81849131 R08: 0000000000000000 R09: ffffffff81849131
R10: dffffc0000000000 R11: fffffbfff1dac92f R12: 0000000000000002
R13: ffffffff8d5aa880 R14: 0000000000000000 R15: 0000000000000246
FS: 0000000000000000(0000) GS:ffff888126df4000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f96172835c0 CR3: 000000003c65c000 CR4: 00000000003526f0
Call Trace:
<TASK>
lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline]
lock_acquire+0x130/0x360 kernel/locking/lockdep.c:5870
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:867 [inline]
__local_bh_disable_ip+0x2fb/0x540 kernel/softirq.c:174
local_bh_disable include/linux/bottom_half.h:20 [inline]
write_lock_bh include/linux/rwlock_rt.h:98 [inline]
neigh_periodic_work+0xc5c/0xe90 net/core/neighbour.c:1042
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:998
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:998


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
For information about bisection process see: https://goo.gl/tpsmEJ#bisection

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] f2fs: fix hung task in block_operations during checkpoint
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

f2fs_sync_inode_meta() can return 0 (success) even when
f2fs_update_inode_page() fails and triggers f2fs_stop_checkpoint().
This happens because the error flag check only occurs at the start
of each loop iteration, not after f2fs_update_inode_page() returns.

When I/O errors occur:
1. f2fs_update_inode_page() retries 8 times then calls
f2fs_stop_checkpoint(), which sets CP_ERROR_FLAG
2. f2fs_sync_inode_meta() returns 0 without checking the error flag
3. block_operations() sees success and loops back to retry_flush_quotas
4. Dirty inodes remain on list (sync failed), loop repeats forever
5. Checkpoint never completes, waiters block indefinitely

This causes hung tasks when operations like unlink wait for checkpoint
completion while holding locks that other tasks need.

Fix by checking f2fs_cp_error() after processing each inode in
f2fs_sync_inode_meta() to detect errors from f2fs_update_inode_page().

Reported-by: syzbot+4235e4...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
fs/f2fs/checkpoint.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index bbe07e3a6c75..5376bb10d650 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -1155,6 +1155,8 @@ static int f2fs_sync_inode_meta(struct f2fs_sb_info *sbi)
if (is_inode_flag_set(inode, FI_DIRTY_INODE))
f2fs_update_inode_page(inode);
iput(inode);
+ if (unlikely(f2fs_cp_error(sbi)))
+ return -EIO;
}
}
return 0;
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
kernel BUG in ip6_pol_route

------------[ cut here ]------------
kernel BUG at net/ipv6/route.c:1473!
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 31 Comm: kworker/1:0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

Workqueue: wg-kex-wg0 wg_packet_handshake_receive_worker
RIP: 0010:rt6_make_pcpu_route net/ipv6/route.c:1473 [inline]
RIP: 0010:ip6_pol_route+0x117d/0x1180 net/ipv6/route.c:2305
Code: a7 f8 e9 f4 fa ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 03 fb ff ff 48 89 df e8 ce 64 a7 f8 e9 f6 fa ff ff e8 14 05 45 f8 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e
RSP: 0018:ffffc90000a5f0a0 EFLAGS: 00010293
RAX: ffffffff897b2cfc RBX: ffff888126e52000 RCX: ffff88801be9dac0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000a5f1b0 R08: ffffe8ffffd762cf R09: 1ffffd1ffffaec59
R10: dffffc0000000000 R11: fffff91ffffaec5a R12: ffff888035c06780
R13: ffffffff897b1ce2 R14: dffffc0000000000 R15: 0000607ed8f242c8
FS: 0000000000000000(0000) GS:ffff888126e52000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007ff9378335c0 CR3: 00000000379f0000 CR4: 00000000003526f0
Call Trace:
<TASK>
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x1fc/0x6f0 net/ipv6/fib6_rules.c:120
ip6_route_output_flags_noref net/ipv6/route.c:2684 [inline]
ip6_route_output_flags+0x364/0x5d0 net/ipv6/route.c:2696
ip6_dst_lookup_tail+0x299/0x1510 net/ipv6/ip6_output.c:1169
ip6_dst_lookup_flow+0x47/0xe0 net/ipv6/ip6_output.c:1272
send6+0x4ce/0x8d0 drivers/net/wireguard/socket.c:139
wg_socket_send_skb_to_peer+0x128/0x200 drivers/net/wireguard/socket.c:178
wg_packet_send_handshake_response+0x195/0x2d0 drivers/net/wireguard/send.c:103
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:rt6_make_pcpu_route net/ipv6/route.c:1473 [inline]
RIP: 0010:ip6_pol_route+0x117d/0x1180 net/ipv6/route.c:2305
Code: a7 f8 e9 f4 fa ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 03 fb ff ff 48 89 df e8 ce 64 a7 f8 e9 f6 fa ff ff e8 14 05 45 f8 90 <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e
RSP: 0018:ffffc90000a5f0a0 EFLAGS: 00010293
RAX: ffffffff897b2cfc RBX: ffff888126e52000 RCX: ffff88801be9dac0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000a5f1b0 R08: ffffe8ffffd762cf R09: 1ffffd1ffffaec59
R10: dffffc0000000000 R11: fffff91ffffaec5a R12: ffff888035c06780
R13: ffffffff897b1ce2 R14: dffffc0000000000 R15: 0000607ed8f242c8
FS: 0000000000000000(0000) GS:ffff888126e52000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055630cf94a38 CR3: 00000000273ba000 CR4: 00000000003526f0


Tested on:

commit: 3af870ae nfs/localio: fix regression due to out-of-ord..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12e3fcc2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=83a7cfc766b11a4f

dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=17868992580000

[syzbot]

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

INFO: task hung in f2fs_release_file

INFO: task syz.0.17:6702 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:24920 pid:6702 tgid:6702 ppid:6608 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7241

rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]

__rt_mutex_slowlock_locked+0x1dfe/0x25e0 kernel/locking/rtmutex.c:1760

rt_mutex_slowlock+0xb5/0x160 kernel/locking/rtmutex.c:1800
__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244

inode_lock include/linux/fs.h:1027 [inline]

f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
__fput+0x45b/0xa80 fs/file_table.c:468

task_work_run+0x1d4/0x260 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x2e3/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0b2ee4f749
RSP: 002b:00007ffcf2baa8c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f0b2f0a7da0 RCX: 00007f0b2ee4f749

RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003

RBP: 00007f0b2f0a7da0 R08: 0000000000000000 R09: 00000006f2baabbf
R10: 00007f0b2f0a7cb0 R11: 0000000000000246 R12: 00000000000278cd
R13: 00007ffcf2baa9c0 R14: ffffffffffffffff R15: 00007ffcf2baa9e0
</TASK>
INFO: task syz.0.17:6703 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:24488 pid:6703 tgid:6702 ppid:6608 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960

schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1

f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0b2ee4f749
RSP: 002b:00007f0b2e4be038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f0b2f0a5fa0 RCX: 00007f0b2ee4f749

RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c

RBP: 00007f0b2eed3f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f0b2f0a6038 R14: 00007f0b2f0a5fa0 R15: 00007ffcf2baa768

</TASK>

Showing all locks held in the system:

3 locks held by kworker/u8:1/13:
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90000127b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90000127b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88801f3ea0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563

1 lock held by khungtaskd/38:

#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:3/58:
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000124fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000124fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88803ac280d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:4/76:
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000155fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000155fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888028a020d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:11/1428:
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000572fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000572fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff8880395180d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:16/4387:
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140463938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000eb47b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000eb47b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888033fea0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
2 locks held by getty/5564:
#0: ffff88814ead00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243

#1: ffffc90003e762e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222

1 lock held by syz.0.17/6702:
#0: ffff88805c1e9df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805c1e9df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.0.17/6703:
#0: ffff888039518480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805c1e9478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805c1e9478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805c1e9478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805c1e9478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805c1e9df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805c1e9df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:0/6725:
1 lock held by syz.1.19/6788:
#0: ffff88805c1ecd78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805c1ecd78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.1.19/6789:
#0: ffff888033fea480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805c1ec3f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805c1ec3f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805c1ec3f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805c1ec3f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805c1ecd78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805c1ecd78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:1/6794:
1 lock held by syz.2.20/6816:
#0: ffff88805c1ef378 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805c1ef378 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.2.20/6817:
#0: ffff88801f3ea480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805c1ee9f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805c1ee9f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805c1ee9f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805c1ee9f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805c1ef378 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805c1ef378 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:2/6821:
1 lock held by syz.3.21/6842:
#0: ffff88805c271df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805c271df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.3.21/6843:
#0: ffff88803ac28480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805c271478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805c271478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805c271478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805c271478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805c271df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805c271df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:3/6847:
1 lock held by syz.4.22/6880:
#0: ffff88805c079df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805c079df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.4.22/6881:
#0: ffff888028a02480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805c079478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805c079478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805c079478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805c079478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805c079df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805c079df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
4 locks held by f2fs_ckpt-7:4/6888:
1 lock held by syz.5.23/6922:
#0: ffff88805c07a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805c07a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063

3 locks held by syz.5.23/6923:

#0: ffff88801f348480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805c273a78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805c273a78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805c273a78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805c273a78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805c07a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805c07a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
5 locks held by f2fs_ckpt-7:5/6928:
1 lock held by syz.6.24/6962:
#0: ffff88805c276078 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805c276078 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.6.24/6963:
#0: ffff888032e96480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805c2756f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805c2756f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805c2756f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805c2756f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805c276078 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805c276078 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:6/6967:
3 locks held by syz.7.25/7007:

=============================================

NMI backtrace for cpu 0

CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]

watchdog+0xf3c/0xf80 kernel/hung_task.c:495

kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>

Sending NMI from CPU 0 to CPUs 1:

NMI backtrace for cpu 1

CPU: 1 UID: 0 PID: 6967 Comm: f2fs_ckpt-7:6 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

RIP: 0010:mark_lock+0xf/0x190 kernel/locking/lockdep.c:4722
Code: 24 e9 b6 fd ff ff 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 41 55 41 54 53 8b 46 20 89 c1 <81> e1 00 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45
RSP: 0018:ffffc90004ecf5c8 EFLAGS: 00000006
RAX: 0000000000040c13 RBX: ffff88802557bc80 RCX: 0000000000040c13
RDX: 0000000000000006 RSI: ffff88802557c838 RDI: ffff88802557bc80
RBP: ffffc90004ecf6d0 R08: ffffffff8eda5877 R09: 1ffffffff1db4b0e
R10: dffffc0000000000 R11: fffffbfff1db4b0f R12: ffff88802557c888
R13: 0000000000000a02 R14: ffff88802557c838 R15: 0000000000000001

FS: 0000000000000000(0000) GS:ffff888126e52000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f190c4a5000 CR3: 000000003af82000 CR4: 00000000003526f0
Call Trace:
<TASK>
mark_held_locks kernel/locking/lockdep.c:4325 [inline]
__trace_hardirqs_on_caller kernel/locking/lockdep.c:4351 [inline]
lockdep_hardirqs_on_prepare+0x191/0x290 kernel/locking/lockdep.c:4410
trace_hardirqs_on+0x28/0x40 kernel/trace/trace_preemptirq.c:78
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock_irqrestore+0x85/0x110 kernel/locking/spinlock.c:194
raw_spin_unlock_irqrestore_wake include/linux/sched/wake_q.h:94 [inline]
rtlock_slowlock kernel/locking/rtmutex.c:1896 [inline]
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
rt_spin_lock+0x16d/0x3e0 kernel/locking/spinlock_rt.c:57
spin_lock include/linux/spinlock_rt.h:44 [inline]
f2fs_sync_inode_meta fs/f2fs/checkpoint.c:1142 [inline]
block_operations fs/f2fs/checkpoint.c:1265 [inline]
f2fs_write_checkpoint+0xa78/0x2450 fs/f2fs/checkpoint.c:1680
__write_checkpoint_sync fs/f2fs/checkpoint.c:1804 [inline]
__checkpoint_and_complete_reqs+0xdf/0x3d0 fs/f2fs/checkpoint.c:1823
issue_checkpoint_thread+0xd9/0x260 fs/f2fs/checkpoint.c:1855

kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>

F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006

Tested on:

commit: 3af870ae nfs/localio: fix regression due to out-of-ord..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=155c821a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=83a7cfc766b11a4f
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=176a3c1a580000

[syzbot]

fs/f2fs/checkpoint.c | 26 ++++++++++++++++++++++++--
1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index bbe07e3a6c75..05b1495b6fb6 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -1134,12 +1134,19 @@ static int f2fs_sync_inode_meta(struct f2fs_sb_info *sbi)
struct inode *inode;
struct f2fs_inode_info *fi;
s64 total = get_pages(sbi, F2FS_DIRTY_IMETA);
+ printk(KERN_ERR "f2fs_sync_inode_meta: total=%lld\n", total);

while (total--) {
+ printk(KERN_ERR "f2fs_sync_inode_meta: loop iteration, total=%lld\n", total);
+
if (unlikely(f2fs_cp_error(sbi)))
return -EIO;
-
+ printk(KERN_ERR "f2fs_sync_inode_meta: before spin_lock\n");
+
spin_lock(&sbi->inode_lock[DIRTY_META]);
+ printk(KERN_ERR "f2fs_sync_inode_meta: after spin_lock\n");
+ printk(KERN_ERR "f2fs_sync_inode_meta: after spin_lock, cp_error=%d\n", f2fs_cp_error(sbi));
+
if (list_empty(head)) {
spin_unlock(&sbi->inode_lock[DIRTY_META]);
return 0;
@@ -1152,9 +1159,13 @@ static int f2fs_sync_inode_meta(struct f2fs_sb_info *sbi)
sync_inode_metadata(inode, 0);

/* it's on eviction */
- if (is_inode_flag_set(inode, FI_DIRTY_INODE))
+ if (is_inode_flag_set(inode, FI_DIRTY_INODE)) {
+ printk(KERN_ERR "I AM DONE \n");
f2fs_update_inode_page(inode);
+ }

iput(inode);
+ if (unlikely(f2fs_cp_error(sbi)))
+ return -EIO;
}
}
return 0;

@@ -1275,14 +1286,25 @@ static int block_operations(struct f2fs_sb_info *sbi)
atomic_inc(&sbi->wb_sync_req[NODE]);
err = f2fs_sync_node_pages(sbi, &wbc, false, FS_CP_NODE_IO);
atomic_dec(&sbi->wb_sync_req[NODE]);
+ printk(KERN_ERR "block_operations: f2fs_sync_node_pages returned %d, cp_error=%d\n",
+ err, f2fs_cp_error(sbi));
if (err) {
f2fs_up_write(&sbi->node_change);
f2fs_unlock_all(sbi);
return err;
}
+ /* Check if I/O error set CP_ERROR_FLAG */
+ if (unlikely(f2fs_cp_error(sbi))) {
+ printk(KERN_ERR "NOT ALLOWED \n");
+ f2fs_up_write(&sbi->node_change);
+ f2fs_unlock_all(sbi);
+ return -EIO;
+ }
cond_resched();
goto retry_flush_nodes;
}
+ printk(KERN_ERR "block_operations: no more dirty nodes\n");
+

/*
* sbi->node_change is used only for AIO write_begin path which produces
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+4235e4...@syzkaller.appspotmail.com
Tested-by: syzbot+4235e4...@syzkaller.appspotmail.com

Tested on:

commit: f19b8418 Merge tag 'media/v6.19-2' of git://git.kernel..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11038992580000

kernel config: https://syzkaller.appspot.com/x/.config?x=83a7cfc766b11a4f
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=12f13c1a580000

Note: testing is done by a robot and is best-effort only.

[syzbot]

fs/f2fs/checkpoint.c | 6 ++++++
1 file changed, 6 insertions(+)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index bbe07e3a6c75..992637269a84 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -1140,6 +1140,10 @@ static int f2fs_sync_inode_meta(struct f2fs_sb_info *sbi)
return -EIO;

spin_lock(&sbi->inode_lock[DIRTY_META]);
+ if (unlikely(f2fs_cp_error(sbi))) {
+ spin_unlock(&sbi->inode_lock[DIRTY_META]);
+ return -EIO;

+ }
if (list_empty(head)) {
spin_unlock(&sbi->inode_lock[DIRTY_META]);
return 0;

@@ -1155,6 +1159,8 @@ static int f2fs_sync_inode_meta(struct f2fs_sb_info *sbi)
if (is_inode_flag_set(inode, FI_DIRTY_INODE))
f2fs_update_inode_page(inode);
iput(inode);
+ if (unlikely(f2fs_cp_error(sbi)))
+ return EIO;
}
}
return 0;
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in f2fs_release_file

INFO: task syz.0.17:6686 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:26840 pid:6686 tgid:6686 ppid:6590 task_flags:0x400040 flags:0x00080002

RIP: 0033:0x7febda5ff749
RSP: 002b:00007ffd51e7dc88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007febda857da0 RCX: 00007febda5ff749

RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003

RBP: 00007febda857da0 R08: 0000000000000000 R09: 0000000651e7df7f
R10: 00007febda857cb0 R11: 0000000000000246 R12: 0000000000028cbd
R13: 00007ffd51e7dd80 R14: ffffffffffffffff R15: 00007ffd51e7dda0
</TASK>
INFO: task syz.0.17:6687 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:24480 pid:6687 tgid:6686 ppid:6590 task_flags:0x400140 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7febda5ff749
RSP: 002b:00007febd9c66038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007febda855fa0 RCX: 00007febda5ff749

RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c

RBP: 00007febda683f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007febda856038 R14: 00007febda855fa0 R15: 00007ffd51e7db28

</TASK>

Showing all locks held in the system:

3 locks held by kworker/u8:0/12:
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90000117b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90000117b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888028f680d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:1/13:
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340

#1: ffffc90000127b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90000127b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340

#2: ffff88803ac680d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563

1 lock held by khungtaskd/38:
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775

3 locks held by kworker/u8:5/85:
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340

#1: ffffc9000155fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000155fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340

#2: ffff88802a0e80d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:15/3524:
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000e7dfb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000e7dfb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888029cae0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:17/3751:
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140474138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000eddfb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000eddfb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888035a5a0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
2 locks held by getty/5557:
#0: ffff8880351a20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222
3 locks held by kworker/1:4/6677:
1 lock held by syz.0.17/6686:
#0: ffff888057251df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888057251df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.0.17/6687:
#0: ffff88803ac68480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888057251478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888057251478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888057251478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888057251478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888057251df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888057251df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:0/6709:
1 lock held by syz.1.18/6765:
#0: ffff8880573f1478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880573f1478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.1.18/6770:
#0: ffff88802a0e8480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880573f0af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880573f0af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff8880573f0af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff8880573f0af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880573f1478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880573f1478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
6 locks held by f2fs_ckpt-7:1/6771:
1 lock held by syz.2.19/6795:
#0: ffff8880573f3a78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880573f3a78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.2.19/6796:
#0: ffff888028f68480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880573f30f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880573f30f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff8880573f30f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff8880573f30f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880573f3a78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880573f3a78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:2/6800:
1 lock held by syz.3.20/6824:
#0: ffff8880573f43f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880573f43f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.3.20/6825:
#0: ffff888035a5a480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880572543f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880572543f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff8880572543f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff8880572543f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880573f43f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880573f43f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:3/6829:
1 lock held by syz.4.21/6865:
#0: ffff8880572569f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880572569f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.4.21/6867:
#0: ffff888029cae480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888057256078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888057256078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888057256078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888057256078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880572569f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880572569f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:4/6872:
1 lock held by syz.5.22/6903:
#0: ffff8880494a9478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880494a9478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.5.22/6904:
#0: ffff888058642480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880494a8af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880494a8af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff8880494a8af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff8880494a8af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880494a9478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880494a9478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:5/6908:
1 lock held by syz.6.23/6944:
#0: ffff8880494ab0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880494ab0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.6.23/6949:
#0: ffff888028fec480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880494aa778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880494aa778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff8880494aa778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff8880494aa778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880494ab0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880494ab0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:6/6950:
3 locks held by syz.7.24/6990:

=============================================

NMI backtrace for cpu 1

CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3c/0xf80 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>

Sending NMI from CPU 1 to CPUs 0:

NMI backtrace for cpu 0

CPU: 0 UID: 0 PID: 6771 Comm: f2fs_ckpt-7:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

RIP: 0010:raw_atomic_fetch_add_unless include/linux/atomic/atomic-arch-fallback.h:2429 [inline]
RIP: 0010:raw_atomic_add_unless include/linux/atomic/atomic-arch-fallback.h:2456 [inline]
RIP: 0010:atomic_add_unless include/linux/atomic/atomic-instrumented.h:1518 [inline]
RIP: 0010:page_ref_add_unless include/linux/page_ref.h:238 [inline]
RIP: 0010:folio_ref_add_unless include/linux/page_ref.h:248 [inline]
RIP: 0010:folio_try_get+0xf2/0x340 include/linux/page_ref.h:264
Code: c7 ff 49 83 c6 34 4c 89 f7 be 04 00 00 00 e8 d5 96 29 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 03 01 00 00 45 8b 3e <31> ff 44 89 fe e8 d4 39 c7 ff 45 85 ff 0f 84 e1 00 00 00 41 8d 4f
RSP: 0018:ffffc90004257450 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffffff81f8fc0c RCX: ffffffff81f8fccb
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffea0000c35774
RBP: 0000000000000001 R08: ffffea0000c35777 R09: 1ffffd4000186aee
R10: dffffc0000000000 R11: fffff94000186aef R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffea0000c35774 R15: 0000000000000002
FS: 0000000000000000(0000) GS:ffff888126d52000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f1e3d701000 CR3: 0000000024ada000 CR4: 00000000003526f0
Call Trace:
<TASK>
filemap_get_entry+0x1b8/0x2f0 mm/filemap.c:1905
__filemap_get_folio_mpol+0x3c/0xa50 mm/filemap.c:1941
__filemap_get_folio include/linux/pagemap.h:763 [inline]
f2fs_grab_cache_folio+0x2e/0x380 fs/f2fs/f2fs.h:2935
__get_node_folio+0x18e/0x14d0 fs/f2fs/node.c:1551
f2fs_update_inode_page+0x82/0x190 fs/f2fs/inode.c:766
f2fs_sync_inode_meta fs/f2fs/checkpoint.c:1160 [inline]
block_operations fs/f2fs/checkpoint.c:1269 [inline]
f2fs_write_checkpoint+0xc6f/0x2710 fs/f2fs/checkpoint.c:1684
__write_checkpoint_sync fs/f2fs/checkpoint.c:1808 [inline]
__checkpoint_and_complete_reqs+0xdf/0x3d0 fs/f2fs/checkpoint.c:1827
issue_checkpoint_thread+0xd9/0x260 fs/f2fs/checkpoint.c:1859

kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006


Tested on:

commit: 416f99c3 Merge tag 'driver-core-6.19-rc1' of git://git..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=12f53c1a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=8c04d4527fc98ffa

dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=15d802c2580000

[syzbot]

fs/f2fs/inode.c | 2 ++

1 file changed, 2 insertions(+)

diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index f1cda1900658..7cd0ac088f68 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -763,6 +763,8 @@ void f2fs_update_inode_page(struct inode *inode)
struct folio *node_folio;
int count = 0;
retry:
+ if (unlikely(f2fs_cp_error(sbi)))
+ return ;
node_folio = f2fs_get_inode_folio(sbi, inode->i_ino);
if (IS_ERR(node_folio)) {
int err = PTR_ERR(node_folio);
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in f2fs_release_file

INFO: task syz.0.17:6694 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:24920 pid:6694 tgid:6694 ppid:6608 task_flags:0x400040 flags:0x00080002

RIP: 0033:0x7f3dbfd0f749
RSP: 002b:00007ffc521fa8c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f3dbff67da0 RCX: 00007f3dbfd0f749

RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003

RBP: 00007f3dbff67da0 R08: 0000000000000000 R09: 00000006521fabbf
R10: 00007f3dbff67cb0 R11: 0000000000000246 R12: 0000000000028e21
R13: 00007ffc521fa9c0 R14: ffffffffffffffff R15: 00007ffc521fa9e0
</TASK>
INFO: task syz.0.17:6696 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:24488 pid:6696 tgid:6694 ppid:6608 task_flags:0x400140 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f3dbfd0f749
RSP: 002b:00007f3dbf37e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f3dbff65fa0 RCX: 00007f3dbfd0f749

RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c

RBP: 00007f3dbfd93f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f3dbff66038 R14: 00007f3dbff65fa0 R15: 00007ffc521fa768

</TASK>

Showing all locks held in the system:

1 lock held by khungtaskd/38:
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775

3 locks held by kworker/u8:3/48:
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90000ba7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90000ba7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88801fbe80d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
2 locks held by kworker/u8:5/71:
#0: ffff88813ff69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000156fb80 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000156fb80 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
3 locks held by kworker/u8:9/1125:
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90004bcfb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90004bcfb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88803d24a0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:11/1359:
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900053efb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900053efb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88802f6980d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:13/1430:
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000573fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000573fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88801ff960d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:15/1523:
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140475938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900059bfb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900059bfb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff8880388100d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
2 locks held by getty/5562:
#0: ffff8881443b30a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243

#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222

1 lock held by syz.0.17/6694:
#0: ffff888041589478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888041589478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.0.17/6696:
#0: ffff88801ff96480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888041588af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888041588af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888041588af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888041588af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888041589478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888041589478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
4 locks held by f2fs_ckpt-7:0/6715:
1 lock held by syz.1.18/6779:
#0: ffff88804158ba78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88804158ba78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.1.18/6780:
#0: ffff88803d24a480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88804158b0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88804158b0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88804158b0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88804158b0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88804158ba78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88804158ba78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:1/6785:
1 lock held by syz.2.19/6807:
#0: ffff88804158d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88804158d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.2.19/6808:
#0: ffff888038810480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88804158cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88804158cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88804158cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88804158cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88804158d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88804158d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:2/6812:
1 lock held by syz.3.20/6835:
#0: ffff88804158e9f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88804158e9f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.3.20/6836:
#0: ffff88802f698480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880479f1df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880479f1df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff8880479f1df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff8880479f1df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88804158e9f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88804158e9f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:3/6840:
1 lock held by syz.4.21/6875:
#0: ffff888047b20af8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888047b20af8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.4.21/6881:
#0: ffff88801fbe8480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888047b20178 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888047b20178 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888047b20178 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888047b20178 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888047b20af8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888047b20af8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:4/6882:
1 lock held by syz.5.22/6914:
#0: ffff8880479f4d78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880479f4d78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.5.22/6915:
#0: ffff888027e5c480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880479f43f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880479f43f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff8880479f43f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff8880479f43f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880479f4d78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880479f4d78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:5/6920:
1 lock held by syz.6.23/6957:
#0: ffff8880479f69f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880479f69f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.6.23/6964:
#0: ffff88802ef48480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff8880479f6078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff8880479f6078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff8880479f6078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff8880479f6078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880479f69f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880479f69f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:6/6965:
2 locks held by modprobe/7000:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3c/0xf80 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0

CPU: 0 UID: 0 PID: 7000 Comm: modprobe Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:151 [inline]
RIP: 0010:lock_release+0x287/0x3b0 kernel/locking/lockdep.c:5892
Code: 24 08 48 c7 c7 de 3a fd 8c e8 85 d8 29 09 b8 ff ff ff ff 65 0f c1 05 08 10 10 10 83 f8 01 75 4d 48 c7 44 24 20 00 00 00 00 9c <8f> 44 24 20 f7 44 24 20 00 02 00 00 75 52 f7 c3 00 02 00 00 74 01
RSP: 0018:ffffc900053fefa8 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000202 RCX: 8d34ce4fae259400
RDX: 0000000000000001 RSI: ffffffff8cfd3ade RDI: ffffffff8b3ede60
RBP: ffff88801db829f8 R08: ffffc900053ff8f0 R09: 0000000000000000
R10: ffffc900053ff138 R11: fffff52000a7fe29 R12: 0000000000000001
R13: 0000000000000001 R14: ffffffff8d5aecc0 R15: ffff88801db81e40

FS: 0000000000000000(0000) GS:ffff888126d52000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f4ef881da10 CR3: 0000000035d70000 CR4: 00000000003526f0
Call Trace:
<TASK>
rcu_lock_release include/linux/rcupdate.h:341 [inline]
rcu_read_unlock include/linux/rcupdate.h:897 [inline]
class_rcu_destructor include/linux/rcupdate.h:1195 [inline]
unwind_next_frame+0x19a9/0x2390 arch/x86/kernel/unwind_orc.c:680
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:397 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:414
kasan_kmalloc include/linux/kasan.h:262 [inline]
__do_kmalloc_node mm/slub.c:5652 [inline]
__kmalloc_noprof+0x23e/0x7e0 mm/slub.c:5664
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
tomoyo_encode+0x28b/0x550 security/tomoyo/realpath.c:80
tomoyo_realpath_from_path+0x58d/0x5d0 security/tomoyo/realpath.c:283
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x1c1/0x3b0 security/tomoyo/file.c:771
security_file_open+0xb1/0x270 security/security.c:2636
do_dentry_open+0x35c/0x1270 fs/open.c:939
vfs_open+0x3b/0x350 fs/open.c:1094
do_open fs/namei.c:4628 [inline]
path_openat+0x342a/0x3df0 fs/namei.c:4787
do_filp_open+0x1fa/0x410 fs/namei.c:4814
do_sys_openat2+0x121/0x200 fs/open.c:1430
do_sys_open fs/open.c:1436 [inline]
__do_sys_openat fs/open.c:1452 [inline]
__se_sys_openat fs/open.c:1447 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1447

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f4ef8b4a0ba
Code: 41 89 f2 48 89 54 24 e0 41 83 e2 40 75 2a 89 f0 f7 d0 a9 00 00 41 00 74 1f 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff ff 0f 05 <48> 3d 00 f0 ff ff 77 2e c3 0f 1f 44 00 00 48 8d 44 24 08 c7 44 24
RSP: 002b:00007fff84c12dc8 EFLAGS: 00000206 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fff84c12e40 RCX: 00007f4ef8b4a0ba
RDX: 0000000000080000 RSI: 00007fff84c12e40 RDI: 00000000ffffff9c
RBP: 00007fff84c12e30 R08: 00007fff84c13037 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000001b
R13: 00007f4ef8b1e050 R14: 00007fff84c13050 R15: 0000000000000000

</TASK>
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006

Tested on:

commit: 416f99c3 Merge tag 'driver-core-6.19-rc1' of git://git..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=13e33c1a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=8c04d4527fc98ffa
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=17fb8992580000

[syzbot]

fs/f2fs/inode.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
index f1cda1900658..8deeb865dbb1 100644
--- a/fs/f2fs/inode.c
+++ b/fs/f2fs/inode.c
@@ -763,6 +763,10 @@ void f2fs_update_inode_page(struct inode *inode)

struct folio *node_folio;
int count = 0;
retry:
+ if (unlikely(f2fs_cp_error(sbi))) {

+ printk("f2fs: f2fs_update_inode_page bailing out due to cp_error\n");
+ goto stop_checkpoint;
+ }

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

INFO: task hung in f2fs_issue_checkpoint

INFO: task syz.0.17:6514 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:24488 pid:6514 tgid:6513 ppid:6400 task_flags:0x400140 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7fdf27e3f749
RSP: 002b:00007fdf274ae038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007fdf28095fa0 RCX: 00007fdf27e3f749

RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c

RBP: 00007fdf27ec3f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fdf28096038 R14: 00007fdf28095fa0 R15: 00007fffa8021c98

</TASK>

Showing all locks held in the system:

3 locks held by kworker/u8:0/12:
#0: ffff8881404f3938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff8881404f3938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90000117b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90000117b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff8880356da0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563

1 lock held by khungtaskd/38:
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775

3 locks held by kworker/u8:6/1041:
#0: ffff8881404f3938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff8881404f3938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900044ffb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900044ffb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88802956a0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:13/1909:
#0: ffff8881404f3938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff8881404f3938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900055b7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900055b7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88801e7b40d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:15/3454:
#0: ffff8881404f3938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff8881404f3938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000c9b7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000c9b7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888030e200d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
2 locks held by getty/5557:
#0: ffff8880346c50a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243

#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222

1 lock held by syz.0.17/6513:
#0: ffff88805b1e1478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805b1e1478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.0.17/6514:
#0: ffff88802956a480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805b1e0af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805b1e0af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805b1e0af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805b1e0af8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805b1e1478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805b1e1478 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
5 locks held by f2fs_ckpt-7:0/6518:
1 lock held by syz.1.18/6544:
#0: ffff88805b1e30f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805b1e30f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.1.18/6545:
#0: ffff888030e20480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805b1e2778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805b1e2778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805b1e2778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805b1e2778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805b1e30f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805b1e30f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:1/6551:
1 lock held by syz.2.19/6575:
#0: ffff888042f330f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888042f330f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.2.19/6576:
#0: ffff88801e7b4480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888042f32778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888042f32778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888042f32778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888042f32778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888042f330f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888042f330f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:2/6580:
1 lock held by syz.3.20/6603:
#0: ffff88805b1e4d78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805b1e4d78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.3.20/6608:
#0: ffff8880356da480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805b1e43f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805b1e43f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805b1e43f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805b1e43f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805b1e4d78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805b1e4d78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:3/6609:
1 lock held by syz.4.21/6647:
#0: ffff88805b1e69f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805b1e69f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.4.21/6648:
#0: ffff88803238e480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805b1e6078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805b1e6078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805b1e6078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805b1e6078 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805b1e69f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805b1e69f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
6 locks held by f2fs_ckpt-7:4/6652:
1 lock held by syz.5.22/6683:
#0: ffff88805bd78178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805bd78178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.5.22/6688:
#0: ffff88805ca4c480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888042f356f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888042f356f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888042f356f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888042f356f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805bd78178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805bd78178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:5/6689:
1 lock held by syz.6.23/6722:
#0: ffff88805bd78af8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805bd78af8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.6.23/6723:
#0: ffff8880333b6480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888042f37378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888042f37378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888042f37378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888042f37378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805bd78af8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805bd78af8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:6/6729:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3c/0xf80 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0

CPU: 0 UID: 0 PID: 6689 Comm: f2fs_ckpt-7:5 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

RIP: 0010:check_preemption_disabled+0x0/0x120 lib/smp_processor_id.c:13
Code: c7 80 de 3e 8b 48 c7 c6 c0 de 3e 8b eb 1c 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <55> 41 57 41 56 53 48 83 ec 10 65 48 8b 05 1e f2 e5 06 48 89 44 24
RSP: 0018:ffffc90005277640 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 00000000ffffffff RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffffffff8ce10d12 RDI: ffffffff8b3edee0
RBP: 00000000ffffffff R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000a4eec0 R12: 0000000000000046
R13: ffff888026d3bc80 R14: ffff888042270470 R15: ffff888026d3bc80

FS: 0000000000000000(0000) GS:ffff888126d52000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 000055c7cfa2b920 CR3: 000000003ae6e000 CR4: 00000000003526f0
Call Trace:
<TASK>
lockdep_recursion_inc kernel/locking/lockdep.c:465 [inline]
lock_is_held_type+0x79/0x190 kernel/locking/lockdep.c:5939
lock_is_held include/linux/lockdep.h:249 [inline]
try_to_take_rt_mutex+0x4f/0xac0 kernel/locking/rtmutex.c:1090
__rt_mutex_slowtrylock kernel/locking/rtmutex.c:1360 [inline]
rt_mutex_slowtrylock kernel/locking/rtmutex.c:1393 [inline]
rt_mutex_try_acquire kernel/locking/rtmutex.c:320 [inline]
__rt_mutex_lock kernel/locking/rtmutex.c:1812 [inline]
rwbase_write_lock+0xce/0x750 kernel/locking/rwbase_rt.c:244
f2fs_down_write fs/f2fs/f2fs.h:2294 [inline]
block_operations fs/f2fs/checkpoint.c:1258 [inline]
f2fs_write_checkpoint+0x96f/0x2440 fs/f2fs/checkpoint.c:1678
__write_checkpoint_sync fs/f2fs/checkpoint.c:1802 [inline]
__checkpoint_and_complete_reqs+0xdf/0x3d0 fs/f2fs/checkpoint.c:1821
issue_checkpoint_thread+0xd9/0x260 fs/f2fs/checkpoint.c:1853

kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>

Tested on:

commit: 416f99c3 Merge tag 'driver-core-6.19-rc1' of git://git..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=1317f6b4580000

kernel config: https://syzkaller.appspot.com/x/.config?x=8c04d4527fc98ffa
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=120202c2580000

[syzbot]

fs/f2fs/checkpoint.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index bbe07e3a6c75..b0b5b792e092 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -1659,9 +1659,10 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
return 0;
f2fs_warn(sbi, "Start checkpoint disabled!");
}
+ printk("f2fs_cp: 1 before cp_global_sem\n");
if (cpc->reason != CP_RESIZE)
f2fs_down_write(&sbi->cp_global_sem);
-
+ printk("f2fs_cp: 2 after cp_global_sem\n");
stat_cp_time(cpc, CP_TIME_LOCK);

if (!is_sbi_flag_set(sbi, SBI_IS_DIRTY) &&
@@ -1669,16 +1670,18 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)
((cpc->reason & CP_DISCARD) && !sbi->discard_blks)))
goto out;
if (unlikely(f2fs_cp_error(sbi))) {
+ printk("f2fs_cp: 3 cp_error detected early\n");
err = -EIO;
goto out;
}

trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, "start block_ops");
-
+ printk("f2fs_cp: 4 before block_operations\n");
err = block_operations(sbi);
+ printk("f2fs_cp: 5 after block_operations err=%d cp_error=%d\n", err, f2fs_cp_error(sbi));
if (err)
goto out;
-
+ //printk("f2fs_cp: 6 before do_checkpoint\n");
stat_cp_time(cpc, CP_TIME_OP_LOCK);

trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, "finish block_ops");
@@ -1724,8 +1727,10 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)

/* save inmem log status */
f2fs_save_inmem_curseg(sbi);
+ printk("f2fs_cp: 4 before block_operations\n");

err = do_checkpoint(sbi, cpc);
+ printk("f2fs_cp: 7 after do_checkpoint err=%d\n", err);
if (err) {
f2fs_err(sbi, "do_checkpoint failed err:%d, stop checkpoint", err);
f2fs_bug_on(sbi, !f2fs_cp_error(sbi));
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:

INFO: task hung in f2fs_release_file

INFO: task syz.0.17:6598 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:26840 pid:6598 tgid:6598 ppid:6488 task_flags:0x400040 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]

rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7241
rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
__rt_mutex_slowlock_locked+0x1dfe/0x25e0 kernel/locking/rtmutex.c:1760
rt_mutex_slowlock+0xb5/0x160 kernel/locking/rtmutex.c:1800
__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244
inode_lock include/linux/fs.h:1027 [inline]
f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
__fput+0x45b/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x2e3/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f1dccfff749
RSP: 002b:00007fff9df4ebb8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f1dcd257da0 RCX: 00007f1dccfff749

RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003

RBP: 00007f1dcd257da0 R08: 0000000000000000 R09: 000000069df4eeaf
R10: 00007f1dcd257cb0 R11: 0000000000000246 R12: 0000000000027b0d
R13: 00007fff9df4ecb0 R14: ffffffffffffffff R15: 00007fff9df4ecd0
</TASK>
INFO: task syz.0.17:6599 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:24488 pid:6599 tgid:6598 ppid:6488 task_flags:0x400140 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f1dccfff749
RSP: 002b:00007f1dcc666038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f1dcd255fa0 RCX: 00007f1dccfff749

RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c

RBP: 00007f1dcd083f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f1dcd256038 R14: 00007f1dcd255fa0 R15: 00007fff9df4ea58
</TASK>
INFO: task syz.1.18:6626 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.1.18 state:D stack:26840 pid:6626 tgid:6626 ppid:6605 task_flags:0x400040 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]

rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7241
rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
__rt_mutex_slowlock_locked+0x1dfe/0x25e0 kernel/locking/rtmutex.c:1760
rt_mutex_slowlock+0xb5/0x160 kernel/locking/rtmutex.c:1800
__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
rwbase_write_lock+0x14f/0x750 kernel/locking/rwbase_rt.c:244
inode_lock include/linux/fs.h:1027 [inline]
f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
__fput+0x45b/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x2e3/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7fdf96d9f749
RSP: 002b:00007fff745008d8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fdf96ff7da0 RCX: 00007fdf96d9f749

RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003

RBP: 00007fdf96ff7da0 R08: 0000000000000000 R09: 0000000674500bcf
R10: 00007fdf96ff7cb0 R11: 0000000000000246 R12: 000000000002c3b7
R13: 00007fff745009d0 R14: ffffffffffffffff R15: 00007fff745009f0
</TASK>
INFO: task syz.1.18:6627 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.1.18 state:D stack:24488 pid:6627 tgid:6626 ppid:6605 task_flags:0x400140 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7fdf96d9f749
RSP: 002b:00007fdf96406038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007fdf96ff5fa0 RCX: 00007fdf96d9f749

RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c

RBP: 00007fdf96e23f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fdf96ff6038 R14: 00007fdf96ff5fa0 R15: 00007fff74500778

</TASK>

Showing all locks held in the system:
3 locks held by kworker/u8:0/12:

#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340

#1: ffffc90000117b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90000117b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340

#2: ffff8880306fc0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563

1 lock held by khungtaskd/38:
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775

3 locks held by kworker/u8:5/81:
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000159fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000159fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88801ead60d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:6/808:
3 locks held by kworker/u8:10/1551:
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000520fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000520fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88803bbc20d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:14/3678:
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000d187b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000d187b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff8880276640d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
2 locks held by getty/5560:
#0: ffff8880268520a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243

#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222

1 lock held by syz.0.17/6598:
#0: ffff888051658178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888051658178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.0.17/6599:
#0: ffff88803bbc2480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888051681478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888051681478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888051681478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888051681478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888051658178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888051658178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
4 locks held by f2fs_ckpt-7:0/6603:
1 lock held by syz.1.18/6626:
#0: ffff888051659df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888051659df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.1.18/6627:
#0: ffff888027664480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888051659478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888051659478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888051659478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888051659478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888051659df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888051659df8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
4 locks held by f2fs_ckpt-7:1/6631:
1 lock held by syz.2.19/6659:
#0: ffff8880516843f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880516843f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.2.19/6660:
#0: ffff8880306fc480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888051683a78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888051683a78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888051683a78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888051683a78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880516843f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880516843f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:2/6664:
1 lock held by syz.3.20/6689:
#0: ffff8880516856f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880516856f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.3.20/6690:
#0: ffff88801ef30480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805165b0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805165b0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805165b0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805165b0f8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880516856f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880516856f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
5 locks held by f2fs_ckpt-7:3/6694:
1 lock held by syz.4.21/6724:
#0: ffff88805165ba78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805165ba78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.4.21/6725:
#0: ffff88801ead6480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888051687378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888051687378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888051687378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888051687378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805165ba78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805165ba78 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:4/6732:
1 lock held by syz.5.22/6770:
#0: ffff88805165d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805165d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.5.22/6771:
#0: ffff888028b5c480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805165cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805165cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805165cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805165cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805165d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805165d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
4 locks held by f2fs_ckpt-7:5/6775:
3 locks held by kworker/u8:20/6778:
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140464138 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90004eafb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90004eafb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88801ef300d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
1 lock held by syz.6.23/6814:
#0: ffff888058210178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888058210178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.6.23/6815:
#0: ffff8880397e0480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805165f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805165f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805165f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805165f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888058210178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888058210178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
4 locks held by f2fs_ckpt-7:6/6820:
6 locks held by syz-executor/6829:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3c/0xf80 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0

CPU: 0 UID: 0 PID: 808 Comm: kworker/u8:6 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:__bfs kernel/locking/lockdep.c:1815 [inline]
RIP: 0010:__bfs_backwards kernel/locking/lockdep.c:1860 [inline]
RIP: 0010:check_irq_usage kernel/locking/lockdep.c:2796 [inline]
RIP: 0010:check_prev_add kernel/locking/lockdep.c:3169 [inline]
RIP: 0010:check_prevs_add kernel/locking/lockdep.c:3284 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3908 [inline]
RIP: 0010:__lock_acquire+0x197c/0x2cf0 kernel/locking/lockdep.c:5237
Code: 13 25 ff 0f 00 00 39 05 9e 87 17 11 73 06 89 05 96 87 17 11 48 8b 02 48 89 df 4c 39 e8 0f 84 2c fe ff ff 4c 89 60 30 48 8b 00 <4c> 39 e8 75 f4 48 89 df e9 18 fe ff ff 48 89 fb 48 c7 c7 10 e4 47
RSP: 0018:ffffc900042370b8 EFLAGS: 00000002
RAX: ffffffff95556ad8 RBX: 00000000000003cc RCX: 00000000000000a9
RDX: ffffffff953bcee8 RSI: ffff8880240d0ca8 RDI: 00000000000003cc
RBP: 233744c3de05d782 R08: ffffc90004237080 R09: 0000000000000020
R10: dffffc0000000000 R11: ffffffff819d54f0 R12: ffffffff9540f898
R13: ffffffff9257f330 R14: ffff8880240d0000 R15: 00000000000000a8

FS: 0000000000000000(0000) GS:ffff888126d52000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f1748c6f000 CR3: 0000000036390000 CR4: 00000000003526f0
Call Trace:
<TASK>
lock_acquire+0x117/0x340 kernel/locking/lockdep.c:5868
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]

rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]

rt_spin_lock+0x14a/0x3e0 kernel/locking/spinlock_rt.c:57
spin_lock include/linux/spinlock_rt.h:44 [inline]
__folio_end_writeback+0x157/0x760 mm/page-writeback.c:2990
folio_end_writeback_no_dropbehind+0x151/0x290 mm/filemap.c:1661
folio_end_writeback+0xea/0x220 mm/filemap.c:1687
f2fs_write_end_io+0x7ba/0xb60 fs/f2fs/data.c:362
blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1168
blk_complete_reqs block/blk-mq.c:1243 [inline]
blk_done_softirq+0x10a/0x160 block/blk-mq.c:1248
handle_softirqs+0x226/0x6d0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
__local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
__alloc_skb+0x224/0x430 net/core/skbuff.c:674
alloc_skb include/linux/skbuff.h:1383 [inline]
nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:818 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:875 [inline]
nsim_dev_trap_report_work+0x29f/0xbc0 drivers/net/netdevsim/dev.c:921

process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421

kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>

F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006
F2FS-fs (loop7): inject read IO error in f2fs_read_end_io of blk_update_request+0x57e/0xe60 block/blk-mq.c:1006

Tested on:

commit: 416f99c3 Merge tag 'driver-core-6.19-rc1' of git://git..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=119b821a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=8c04d4527fc98ffa
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=17000eb4580000

[syzbot]

fs/f2fs/checkpoint.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index bbe07e3a6c75..efe72e517955 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -1216,8 +1216,9 @@ static int block_operations(struct f2fs_sb_info *sbi)
* Let's flush inline_data in dirty node pages.
*/
f2fs_flush_inline_data(sbi);
-
+ printk("f2fs: block_ops enter\n");
retry_flush_quotas:
+ printk("f2fs: block_ops retry_flush_quotas cnt=%d\n", cnt);
f2fs_lock_all(sbi);
if (__need_flush_quota(sbi)) {
bool need_lock = sbi->umount_lock_holder != current;
@@ -1242,6 +1243,8 @@ static int block_operations(struct f2fs_sb_info *sbi)

retry_flush_dents:
/* write all the dirty dentry pages */
+ printk("f2fs: block_ops retry_flush_dents dirty_dents=%lld\n",
+ get_pages(sbi, F2FS_DIRTY_DENTS));
if (get_pages(sbi, F2FS_DIRTY_DENTS)) {
f2fs_unlock_all(sbi);
err = f2fs_sync_dirty_inodes(sbi, DIR_INODE, true);
@@ -1256,7 +1259,8 @@ static int block_operations(struct f2fs_sb_info *sbi)
* until finishing nat/sit flush. inode->i_blocks can be updated.
*/
f2fs_down_write(&sbi->node_change);
-
+ printk("f2fs: block_ops check DIRTY_IMETA=%lld\n",
+ get_pages(sbi, F2FS_DIRTY_IMETA));
if (get_pages(sbi, F2FS_DIRTY_IMETA)) {
f2fs_up_write(&sbi->node_change);
f2fs_unlock_all(sbi);
@@ -1268,6 +1272,8 @@ static int block_operations(struct f2fs_sb_info *sbi)
}

retry_flush_nodes:
+ printk("f2fs: block_ops retry_flush_nodes dirty_nodes=%lld\n",
+ get_pages(sbi, F2FS_DIRTY_NODES));
f2fs_down_write(&sbi->node_write);

if (get_pages(sbi, F2FS_DIRTY_NODES)) {
@@ -1290,6 +1296,7 @@ static int block_operations(struct f2fs_sb_info *sbi)
*/
__prepare_cp_block(sbi);
f2fs_up_write(&sbi->node_change);
+ printk("f2fs: block_ops done\n");
return err;
}

@@ -1659,9 +1666,10 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)

return 0;
f2fs_warn(sbi, "Start checkpoint disabled!");
}
+ printk("f2fs_cp: 1 before cp_global_sem\n");
if (cpc->reason != CP_RESIZE)
f2fs_down_write(&sbi->cp_global_sem);
-
+ printk("f2fs_cp: 2 after cp_global_sem\n");
stat_cp_time(cpc, CP_TIME_LOCK);

if (!is_sbi_flag_set(sbi, SBI_IS_DIRTY) &&

@@ -1669,16 +1677,18 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)

((cpc->reason & CP_DISCARD) && !sbi->discard_blks)))
goto out;
if (unlikely(f2fs_cp_error(sbi))) {
+ printk("f2fs_cp: 3 cp_error detected early\n");
err = -EIO;
goto out;
}

trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, "start block_ops");
-
+ printk("f2fs_cp: 4 before block_operations\n");
err = block_operations(sbi);
+ printk("f2fs_cp: 5 after block_operations err=%d cp_error=%d\n", err, f2fs_cp_error(sbi));
if (err)
goto out;
-
+ //printk("f2fs_cp: 6 before do_checkpoint\n");
stat_cp_time(cpc, CP_TIME_OP_LOCK);

trace_f2fs_write_checkpoint(sbi->sb, cpc->reason, "finish block_ops");

@@ -1724,8 +1734,10 @@ int f2fs_write_checkpoint(struct f2fs_sb_info *sbi, struct cp_control *cpc)

[syzbot]

Hello,

syzbot has tested the proposed patch and the reproducer did not trigger any issue:

Reported-by: syzbot+4235e4...@syzkaller.appspotmail.com
Tested-by: syzbot+4235e4...@syzkaller.appspotmail.com

Tested on:

commit: 416f99c3 Merge tag 'driver-core-6.19-rc1' of git://git..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=119c4992580000

kernel config: https://syzkaller.appspot.com/x/.config?x=8c04d4527fc98ffa
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=121546c2580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] f2fs: fix infinite loop in block_operations() on CP error

Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When IO errors occur and CP_ERROR_FLAG is set, the retry loops in
block_operations() can spin forever. The sync functions (f2fs_sync_dirty_inodes,
f2fs_sync_inode_meta, f2fs_sync_node_pages) may return success even though
dirty pages remain due to IO errors, causing infinite retry loops.

The hung task traces show:
f2fs: block_ops check DIRTY_IMETA=1
f2fs: block_ops retry_flush_quotas cnt=0
f2fs: block_ops retry_flush_dents dirty_dents=0
f2fs: block_ops check DIRTY_IMETA=1
... (repeats forever)

Add f2fs_cp_error() checks after each sync operation in block_operations()
to break out of retry loops when the filesystem is in error state.

Reported-by: syzbot+4235e4...@syzkaller.appspotmail.com

Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---

fs/f2fs/checkpoint.c | 11 +++++++++++
1 file changed, 11 insertions(+)

diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
index bbe07e3a6c75..a6f831ed3d9b 100644
--- a/fs/f2fs/checkpoint.c
+++ b/fs/f2fs/checkpoint.c
@@ -1236,6 +1236,8 @@ static int block_operations(struct f2fs_sb_info *sbi)
f2fs_do_quota_sync(sbi->sb, -1);
up_read(&sbi->sb->s_umount);
}
+ if (unlikely(f2fs_cp_error(sbi)))
+ return -EIO;
cond_resched();
goto retry_flush_quotas;
}
@@ -1247,6 +1249,8 @@ static int block_operations(struct f2fs_sb_info *sbi)

err = f2fs_sync_dirty_inodes(sbi, DIR_INODE, true);

if (err)
return err;
+ if (unlikely(f2fs_cp_error(sbi)))
+ return -EIO;
cond_resched();
goto retry_flush_quotas;
}
@@ -1263,6 +1267,8 @@ static int block_operations(struct f2fs_sb_info *sbi)
err = f2fs_sync_inode_meta(sbi);
if (err)
return err;
+ if (unlikely(f2fs_cp_error(sbi)))
+ return -EIO;
cond_resched();
goto retry_flush_quotas;
}
@@ -1280,6 +1286,11 @@ static int block_operations(struct f2fs_sb_info *sbi)
f2fs_unlock_all(sbi);
return err;
}
+ if (unlikely(f2fs_cp_error(sbi))) {

+ f2fs_up_write(&sbi->node_change);
+ f2fs_unlock_all(sbi);
+ return -EIO;
+ }
cond_resched();
goto retry_flush_nodes;
}

--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: task hung in f2fs_release_file

INFO: task syz.0.17:6630 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:26840 pid:6630 tgid:6630 ppid:6466 task_flags:0x400040 flags:0x00080002

RIP: 0033:0x7f255a87f749
RSP: 002b:00007ffd480f4778 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f255aad7da0 RCX: 00007f255a87f749

RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003

RBP: 00007f255aad7da0 R08: 0000000000000000 R09: 00000006480f4a6f
R10: 00007f255aad7cb0 R11: 0000000000000246 R12: 0000000000027f51
R13: 00007ffd480f4870 R14: ffffffffffffffff R15: 00007ffd480f4890
</TASK>
INFO: task syz.0.17:6631 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:23840 pid:6631 tgid:6630 ppid:6466 task_flags:0x400140 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f255a87f749
RSP: 002b:00007f2559ee6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f255aad5fa0 RCX: 00007f255a87f749

RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c

RBP: 00007f255a903f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f255aad6038 R14: 00007f255aad5fa0 R15: 00007ffd480f4618
</TASK>
INFO: task syz.1.18:6657 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.1.18 state:D stack:26840 pid:6657 tgid:6657 ppid:6637 task_flags:0x400040 flags:0x00080002

RIP: 0033:0x7f0733fcf749
RSP: 002b:00007ffd49167788 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f0734227da0 RCX: 00007f0733fcf749

RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003

RBP: 00007f0734227da0 R08: 0000000000000000 R09: 0000000649167a7f
R10: 00007f0734227cb0 R11: 0000000000000246 R12: 000000000002c7c8
R13: 00007ffd49167880 R14: ffffffffffffffff R15: 00007ffd491678a0
</TASK>
INFO: task syz.1.18:6658 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.1.18 state:D stack:24488 pid:6658 tgid:6657 ppid:6637 task_flags:0x400140 flags:0x00080002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1480/0x50a0 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
f2fs_issue_checkpoint+0x382/0x610 fs/f2fs/checkpoint.c:-1
f2fs_unlink+0x5cb/0xa80 fs/f2fs/namei.c:603
vfs_unlink+0x386/0x650 fs/namei.c:5369
do_unlinkat+0x2cf/0x570 fs/namei.c:5439
__do_sys_unlinkat fs/namei.c:5469 [inline]
__se_sys_unlinkat fs/namei.c:5462 [inline]
__x64_sys_unlinkat+0xd3/0xf0 fs/namei.c:5462
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f0733fcf749
RSP: 002b:00007f0733636038 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007f0734225fa0 RCX: 00007f0733fcf749

RDX: 0000000000000000 RSI: 0000200000000040 RDI: ffffffffffffff9c

RBP: 00007f0734053f91 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f0734226038 R14: 00007f0734225fa0 R15: 00007ffd49167628

</TASK>

Showing all locks held in the system:

1 lock held by khungtaskd/38:
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aecc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775

3 locks held by kworker/u8:3/50:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90000bc7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90000bc7b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff8880339a40d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:5/153:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90003a97b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90003a97b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888057e3a0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:8/1098:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90004c7fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90004c7fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88802ac120d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
3 locks held by kworker/u8:16/3502:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000d517b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000d517b80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88805f73a0d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
2 locks held by getty/5564:
#0: ffff88814ded00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243

#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222

1 lock held by syz.0.17/6630:
#0: ffff888058488178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff888058488178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.0.17/6631:
#0: ffff888057e3a480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058571478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888058571478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888058571478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888058571478 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff888058488178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff888058488178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:0/6635:
1 lock held by syz.1.18/6657:
#0: ffff8880585730f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880585730f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.1.18/6658:
#0: ffff88805f73a480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058572778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888058572778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888058572778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888058572778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880585730f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880585730f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:1/6665:
1 lock held by syz.2.19/6689:
#0: ffff88805848b0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805848b0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.2.19/6690:
#0: ffff88802ac12480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805848a778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805848a778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805848a778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805848a778 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805848b0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805848b0f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:2/6694:
1 lock held by syz.3.20/6718:
#0: ffff88805848d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805848d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.3.20/6719:
#0: ffff888037b64480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805848cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805848cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805848cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805848cd78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805848d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805848d6f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:3/6723:
1 lock held by syz.4.21/6753:
#0: ffff8880585756f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff8880585756f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.4.21/6754:
#0: ffff8880339a4480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058574d78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888058574d78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888058574d78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888058574d78 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff8880585756f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff8880585756f8 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
5 locks held by f2fs_ckpt-7:4/6764:
3 locks held by kworker/u8:18/6790:
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888140462938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90004e2fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90004e2fb80 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888037b640d0 (&type->s_umount_key#55){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:563
1 lock held by syz.5.22/6795:
#0: ffff88805d948178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805d948178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.5.22/6796:
#0: ffff8880346ea480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff888058577378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff888058577378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff888058577378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff888058577378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805d948178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805d948178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:5/6800:
1 lock held by syz.6.23/6836:
#0: ffff88805da38178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805da38178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.6.23/6837:
#0: ffff888035b9c480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805848f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805848f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805848f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805848f378 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805da38178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805da38178 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
3 locks held by f2fs_ckpt-7:6/6841:
1 lock held by syz.7.24/6882:
#0: ffff88805da3a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#0: ffff88805da3a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: f2fs_release_file+0xe3/0x150 fs/f2fs/file.c:2063
3 locks held by syz.7.24/6883:
#0: ffff88805baf2480 (sb_writers#12){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499
#1: ffff88805da39df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1072 [inline]
#1: ffff88805da39df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2864 [inline]
#1: ffff88805da39df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2875 [inline]
#1: ffff88805da39df8 (&type->i_mutex_dir_key#8/1){+.+.}-{4:4}, at: do_unlinkat+0x1b2/0x570 fs/namei.c:5420
#2: ffff88805da3a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline]
#2: ffff88805da3a778 (&sb->s_type->i_mutex_key#23){+.+.}-{4:4}, at: vfs_unlink+0xef/0x650 fs/namei.c:5355
2 locks held by f2fs_ckpt-7:7/6889:

=============================================

NMI backtrace for cpu 0

CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3c/0xf80 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>

Sending NMI from CPU 0 to CPUs 1:

NMI backtrace for cpu 1

CPU: 1 UID: 0 PID: 6889 Comm: f2fs_ckpt-7:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

RIP: 0010:check_preemption_disabled+0x12/0x120 lib/smp_processor_id.c:13

Code: 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 57 41 56 53 48 83 ec 10 65 48 8b 05 1e f2 e5 06 <48> 89 44 24 08 65 8b 05 26 f2 e5 06 65 8b 0d 1b f2 e5 06 f7 c1 ff
RSP: 0018:ffffc900052df610 EFLAGS: 00000082
RAX: 6dac46a9b706f000 RBX: 00000000ffffffff RCX: dffffc0000000000
RDX: dffffc0000000000 RSI: ffffffff8ce10cff RDI: ffffffff8b3ede60

RBP: 00000000ffffffff R08: 0000000000000003 R09: 0000000000000004

R10: dffffc0000000000 R11: fffff52000a5bec0 R12: 0000000000000046
R13: ffff888024e55ac0 R14: ffff8880348bc360 R15: ffff888024e55ac0
FS: 0000000000000000(0000) GS:ffff888126e52000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f0178684f98 CR3: 000000000d3a8000 CR4: 00000000003526f0
Call Trace:
<TASK>

lockdep_recursion_inc kernel/locking/lockdep.c:465 [inline]
lock_is_held_type+0x79/0x190 kernel/locking/lockdep.c:5939
lock_is_held include/linux/lockdep.h:249 [inline]
try_to_take_rt_mutex+0x4f/0xac0 kernel/locking/rtmutex.c:1090
__rt_mutex_slowtrylock kernel/locking/rtmutex.c:1360 [inline]
rt_mutex_slowtrylock kernel/locking/rtmutex.c:1393 [inline]
rt_mutex_try_acquire kernel/locking/rtmutex.c:320 [inline]
__rt_mutex_lock kernel/locking/rtmutex.c:1812 [inline]
rwbase_write_lock+0xce/0x750 kernel/locking/rwbase_rt.c:244
f2fs_down_write fs/f2fs/f2fs.h:2294 [inline]

f2fs_lock_all fs/f2fs/f2fs.h:2374 [inline]
block_operations fs/f2fs/checkpoint.c:1221 [inline]
f2fs_write_checkpoint+0x566/0x26a0 fs/f2fs/checkpoint.c:1689
__write_checkpoint_sync fs/f2fs/checkpoint.c:1813 [inline]
__checkpoint_and_complete_reqs+0xdf/0x3d0 fs/f2fs/checkpoint.c:1832
issue_checkpoint_thread+0xd9/0x260 fs/f2fs/checkpoint.c:1864

kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>

Tested on:

commit: 416f99c3 Merge tag 'driver-core-6.19-rc1' of git://git..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=105746c2580000

kernel config: https://syzkaller.appspot.com/x/.config?x=8c04d4527fc98ffa
dashboard link: https://syzkaller.appspot.com/bug?extid=4235e4d7b6fd75704528
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=150cbc1a580000