INFO: task hung in nfsd_nl_cache_flush_doit

Status: upstream: reported on 2026/07/16 17:02
Subsystems: nfs
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+c7eae0eb80858a2dba0f@syzkaller.appspotmail.com
First crash: 128d, last: 5d20h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
90bebe34 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ INFO: task hung in nfsd_nl_cache_flush_doit 2026/06/30 00:01 2026/06/30 00:01 2026/06/30 00:55 fff8d0a0
▶ ▼ Discussions (14)
Title Replies (including bot) Last reply
[PATCH v5 10/15] NFSD: stop registering with rpcbind after a failure in listener_set 1 (1) 2026/09/01 13:39
[PATCH v5 04/15] SUNRPC: bound the local rpcbind client timeout to 1s 1 (1) 2026/09/01 13:39
[PATCH v5 02/15] NFSD: validate transport name in listener_set before serv creation 1 (1) 2026/09/01 13:39
[PATCH v4 10/14] NFSD: stop registering with rpcbind after a failure in listener_set 1 (1) 2026/08/31 16:14
[PATCH v4 04/14] SUNRPC: bound the local rpcbind client timeout to 1s 1 (1) 2026/08/31 16:14
[PATCH v4 02/14] NFSD: validate transport name in listener_set before serv creation 1 (1) 2026/08/31 16:14
[PATCH v3 10/14] NFSD: stop registering with rpcbind after a failure in listener_set 1 (1) 2026/08/28 16:37
[PATCH v3 04/14] SUNRPC: bound the local rpcbind client timeout to 1s 1 (1) 2026/08/28 16:37
[PATCH v3 02/14] NFSD: validate transport name in listener_set before serv creation 1 (1) 2026/08/28 16:37
[PATCH v2 5/8] SUNRPC: bound the local rpcbind client timeout to 1s 1 (1) 2026/08/11 12:03
[PATCH v2 1/8] NFSD: validate transport name in listener_set before serv creation 1 (1) 2026/08/11 12:03
[PATCH 4/7] SUNRPC: bound the local rpcbind client timeout to 1s 1 (1) 2026/08/10 17:38
[PATCH 1/7] NFSD: validate transport name in listener_set before serv creation 1 (1) 2026/08/10 17:38
[syzbot] [nfs?] INFO: task hung in nfsd_nl_cache_flush_doit 4 (5) 2026/07/21 23:51

Sample crash report:
INFO: task syz.9.12442:3123 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.12442     state:D stack:27168 pid:3123  tgid:3122  ppid:1316   task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x17dd/0x5820 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821
 nfsd_nl_cache_flush_doit+0xb5/0x1b0 fs/nfsd/nfsctl.c:2319
 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
 genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2576
 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x8ef/0xa80 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x7f0/0xb20 net/netlink/af_netlink.c:1920
 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0x54e/0x850 net/socket.c:2715
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769
 __sys_sendmsg net/socket.c:2801 [inline]
 __do_sys_sendmsg net/socket.c:2806 [inline]
 __se_sys_sendmsg net/socket.c:2804 [inline]
 __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa57199f559
RSP: 002b:00007fa5728d1028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fa571c25fa0 RCX: 00007fa57199f559
RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000003
RBP: 00007fa571a36b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa571c26038 R14: 00007fa571c25fa0 R15: 00007ffdae6027e8
 </TASK>

Showing all locks held in the system:
locks held by khungtaskd/33: 1, last CPU#1:
 #0: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871
locks held by udevd/4992: 2, last CPU#0:
 #0: ffff88807fca8e78 (&u->iolock){+.+.}-{4:4}, at: __unix_dgram_recvmsg+0x1f2/0xe60 net/unix/af_unix.c:2591
 #1: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 #1: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
locks held by getty/5380: 2, on CPU#1:
 #0: ffff88803790b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900032362e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
locks held by kworker/1:5/14828: 9, last CPU#1:
 #0: ffff888023e8a948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff888023e8a948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff888023e8a948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #0: ffff888023e8a948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #1: ffffc90006b07c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc90006b07c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc90006b07c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #1: ffffc90006b07c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #2: ffff8880270cc1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #2: ffff8880270cc1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5917
 #3: ffff8880247d11d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #3: ffff8880247d11d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073
 #4: ffff88802ac301a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #4: ffff88802ac301a0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073
 #5: ffffffff913e8420 (register_mutex#6){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #5: ffffffff913e8420 (register_mutex#6){+.+.}-{4:4}, at: usb_audio_probe+0x5e6/0x2240 sound/usb/card.c:962
 #6: ffffffff913c41e0 (sound_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #6: ffffffff913c41e0 (sound_mutex){+.+.}-{4:4}, at: snd_unregister_device+0x35/0x210 sound/core/sound.c:310
 #7: ffffffff90a25700 (dev_pm_qos_sysfs_mtx){+.+.}-{4:4}, at: dev_pm_qos_constraints_destroy+0x32/0x480 drivers/base/power/qos.c:254
 #8: ffff88801cebc980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_find_and_get_ns+0x34/0xe0 fs/kernfs/dir.c:981
locks held by kworker/u8:11/25763: 3, last CPU#0:
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #1: ffffc900051f7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc900051f7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc900051f7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #1: ffffc900051f7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #2: ffff8880527f5258 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834
locks held by udevd/28754: 4, on CPU#1:
 #0: ffff88808deb2bd8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183
 #1: ffff888052f0a880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165
 #2: ffff88802bd54d28 (kn->active#34){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
 #2: ffff88802bd54d28 (kn->active#34){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166
 #3: ffff8880247d11d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1109 [inline]
 #3: ffff8880247d11d8 (&dev->mutex){....}-{4:4}, at: serial_show+0x26/0xa0 drivers/usb/core/sysfs.c:143
locks held by syz.0.11650/990: 2, on CPU#1:
 #0: ffffffff914e95c8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217
 #1: ffffffff902a54a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x53d/0x1ab0 fs/nfsd/nfsctl.c:2057
locks held by kworker/u8:2/2432: 5, last CPU#0:
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #1: ffffc9000b56fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000b56fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000b56fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #1: ffffc9000b56fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #2: ffffffff8fde60d0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0x12/0x20 kernel/jump_label.c:222
 #3: ffffffff9003c6c0 (jump_label_mutex){+.+.}-{4:4}, at: jump_label_lock kernel/jump_label.c:27 [inline]
 #3: ffffffff9003c6c0 (jump_label_mutex){+.+.}-{4:4}, at: static_key_enable_cpuslocked+0xcb/0x240 kernel/jump_label.c:207
 #4: ffffffff8fdfd120 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145
locks held by kworker/u8:13/2434: 3, last CPU#0:
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #1: ffffc9000a907c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}
, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
, at: process_one_work kernel/workqueue.c:3460 [inline]
, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #2: ffff888033384258 (&devlink->lock_key#11){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834
locks held by kworker/u8:14/2435: 3, last CPU#0:
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #0: ffff88813fe04148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #1: ffffc9000a8f7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000a8f7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000a8f7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #1: ffffc9000a8f7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #2: ffff88802a801258 (&devlink->lock_key#10){+.+.}-{4:4}, at: __mod_timer+0x904/0xed0 kernel/time/timer.c:1117
locks held by kworker/u8:15/2436: 4, last CPU#0:
 #0: ffff88807bdd0148 ((wq_completion)wg-kex-wg0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffff88807bdd0148 ((wq_completion)wg-kex-wg0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffff88807bdd0148 ((wq_completion)wg-kex-wg0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #0: ffff88807bdd0148 ((wq_completion)wg-kex-wg0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #1: ffffc9000a8e7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffc9000a8e7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffc9000a8e7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
 #1: ffffc9000a8e7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
 #2: ffff88807e9d1480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 drivers/net/wireguard/noise.c:529
 #3: ffff88802d856640 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 drivers/net/wireguard/noise.c:530
locks held by syz.9.12442/3123: 2, on CPU#1:
 #0: ffffffff914e95c8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217
 #1: ffffffff902a54a0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_cache_flush_doit+0xb5/0x1b0 fs/nfsd/nfsctl.c:2319
locks held by syz-executor/3448: 8, last CPU#0:
 #0: ffffffff9003a150 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1540 [inline]
 #0: ffffffff9003a150 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x10a/0x470 kernel/fork.c:1593
 #1: ffff8880336e1bc0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:548 [inline]
 #1: ffff8880336e1bc0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716
 #2: ffff888032017180 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:538 [inline]
 #2: ffff888032017180 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723
 #3: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302
 #4: ffff88805482c618 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
 #4: ffff88805482c618 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:423
 #5: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #5: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #5: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302
 #6: ffff88802b5ae438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1317 [inline]
 #6: ffff88802b5ae438 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range+0x6fb/0x5c00 mm/memory.c:1453
 #7: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #7: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #7: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: page_table_check_set+0x1a4/0x590 mm/page_table_check.c:112
locks held by syz.4.13748/6364: 2, last CPU#1:
 #0: ffff88807f584cc0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:586 [inline]
 #0: ffff88807f584cc0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1299
 #1: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8ff5a360 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302
locks held by syz.5.13759/6381: 2, last CPU#1:
 #0: ffff88804e61d900 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:530 [inline]
 #0: ffff88804e61d900 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323
 #1: ffff8880746b68b0 (&anon_vma->rwsem){++++}-{4:4}, at: anon_vma_lock_write mm/internal.h:292 [inline]
 #1: ffff8880746b68b0 (&anon_vma->rwsem){++++}-{4:4}, at: unlink_anon_vmas+0x119/0x720 mm/rmap.c:495
locks held by syz-executor/6394: 4, last CPU#0:
 #0: ffff88807eec41c8 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:309
 #1: ffff8880b823c360 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:677
 #2: ffff8880b8224708 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:928
 #3: ffffffff9bcbc708 (&____s->seqcount#2){----}-{0:0}, at: ktime_get+0x45/0x220 kernel/time/timekeeping.c:1004

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xfd2/0x1030 kernel/hung_task.c:561
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 32 Comm: pr/ttyS0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:delay_tsc+0x4/0xd0 arch/x86/lib/delay.c:62
Code: 84 00 00 00 00 00 48 ff c8 75 fb 48 ff c8 e9 ee 50 14 f5 cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <55> 41 57 41 56 53 48 89 fb bf 01 00 00 00 e8 79 c7 99 f5 e8 c4 83
RSP: 0018:ffffc90000a878d8 EFLAGS: 00000813
RAX: 00000000044388d0 RBX: ffffffff9bfd0c68 RCX: 00000000074d333c
RDX: 0000000000000992 RSI: 00000000000007b2 RDI: 0000000000000993
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: ffffffff8bfbf030 R12: 1ffffffff37fa18d
R13: 00000000ffffffff R14: ffffffff9bfd0980 R15: 00000000000007b1
FS:  0000000000000000(0000) GS:ffff88812373c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f796a3aeff8 CR3: 000000007d44b000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 udelay include/asm-generic/delay.h:62 [inline]
 wait_for_lsr+0x147/0x2f0 drivers/tty/serial/8250/8250_port.c:2042
 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3294 [inline]
 __serial8250_console_fifo_write+0x346/0x3e0 drivers/tty/serial/8250/8250_port.c:3396
 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3402 [inline]
 __serial8250_console_write drivers/tty/serial/8250/8250_port.c:3456 [inline]
 serial8250_console_write+0xa7e/0x1200 drivers/tty/serial/8250/8250_port.c:3520
 nbcon_emit_next_record+0xef5/0x1a90 kernel/printk/nbcon.c:-1
 nbcon_emit_one kernel/printk/nbcon.c:1157 [inline]
 nbcon_kthread_func+0x6d9/0x8d0 kernel/printk/nbcon.c:1271
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Crashes (470):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/25 13:58 upstream 21a7f44fd076 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/22 01:43 upstream 9ba46df34488 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/18 21:36 upstream a0ff06b3a7bd 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/18 16:31 upstream 32c52ec87d62 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/09/21 07:00 upstream 93f51579e7df 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/07/12 12:21 upstream 44696aa3a489 d78ea535 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/07/09 17:33 upstream 0e35b9b6ec0f b9f1ceaa .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/06/28 07:46 upstream 780d569e6c4b fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/20 08:13 net 78731b46967e 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/20 02:20 net 78731b46967e 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/19 14:47 net 07bd391eb957 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/19 12:57 net 07bd391eb957 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/19 11:13 net 07bd391eb957 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/19 01:23 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/18 22:59 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/18 18:25 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/18 08:37 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/18 07:16 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/18 04:56 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/18 01:04 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/17 23:55 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/17 19:51 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/17 18:32 net 7ec48f396a1d 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/17 08:20 net 00accbd9d502 432c0077 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/16 18:35 net 191aa41548b2 b1757810 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/16 16:06 net 191aa41548b2 b1757810 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/16 12:20 net 191aa41548b2 b1757810 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/16 08:06 net 191aa41548b2 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/16 00:35 net f88bb3606e4b 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/15 21:45 net f88bb3606e4b 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/15 05:52 net 513444cc62e2 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/14 21:30 net 513444cc62e2 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/14 18:32 net 513444cc62e2 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/14 14:40 net 513444cc62e2 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/14 02:07 net 8e2fbe0e75d3 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/13 23:37 net 8e2fbe0e75d3 7321cd29 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/29 09:34 net-next 734bef548a96 b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/29 03:45 net-next 734bef548a96 b1d00f76 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/26 12:38 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/26 09:04 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/26 07:11 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/26 05:25 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/26 05:00 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/26 03:56 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/25 23:34 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/25 19:08 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/25 17:57 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/25 08:04 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/25 06:00 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/25 04:26 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/25 02:29 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/24 19:09 net-next 734bef548a96 1d9ca40b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/20 09:49 net-next 6ac0d7ba21d5 72cdc28d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/10/15 17:17 net-next 73022f605c44 3f2522c6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
2026/09/25 11:36 linux-next 4c253ac4b29b f281d9d2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: task hung in nfsd_nl_cache_flush_doit
2026/08/07 23:39 linux-next cc2b5f627e8c e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce INFO: task hung in nfsd_nl_cache_flush_doit
* Struck through repros no longer work on HEAD.