INFO: task syz.5.1008:13022 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.1008 state:D stack:25248 pid:13022 tgid:13017 ppid:6324 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5258 [inline]
__schedule+0x150e/0x5070 kernel/sched/core.c:6866
__schedule_loop kernel/sched/core.c:6948 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6963
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7020
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776
nfsd_nl_rpc_status_get_dumpit+0xdf/0x1290 fs/nfsd/nfsctl.c:1477
genl_dumpit+0x10b/0x1b0 net/netlink/genetlink.c:1027
netlink_dump+0x6e4/0xe90 net/netlink/af_netlink.c:2325
__netlink_dump_start+0x5cb/0x7e0 net/netlink/af_netlink.c:2440
genl_family_rcv_msg_dumpit+0x1e7/0x2c0 net/netlink/genetlink.c:1076
genl_family_rcv_msg net/netlink/genetlink.c:1192 [inline]
genl_rcv_msg+0x5da/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec+0x18f/0x1d0 net/socket.c:737
__sock_sendmsg net/socket.c:752 [inline]
____sys_sendmsg+0x577/0x880 net/socket.c:2610
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2664
__sys_sendmsg net/socket.c:2696 [inline]
__do_sys_sendmsg net/socket.c:2701 [inline]
__se_sys_sendmsg net/socket.c:2699 [inline]
__x64_sys_sendmsg+0x19b/0x260 net/socket.c:2699
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f059578f749
RSP: 002b:00007f05965aa038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f05959e5fa0 RCX: 00007f059578f749
RDX: 0000000000000800 RSI: 0000200000000180 RDI: 0000000000000004
RBP: 00007f0595813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f05959e6038 R14: 00007f05959e5fa0 R15: 00007ffe3250e248
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e33f2e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e33f2e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e33f2e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5584:
#0: ffff88814e7870a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 drivers/tty/n_tty.c:2211
3 locks held by kworker/1:9/11289:
#0: ffff88813fe55948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
#1: ffffc9000462fb80 ((work_completion)(&helper->damage_work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
#2: ffff888143ec6280 (&helper->lock){+.+.}-{4:4}, at: drm_fb_helper_fb_dirty drivers/gpu/drm/drm_fb_helper.c:235 [inline]
#2: ffff888143ec6280 (&helper->lock){+.+.}-{4:4}, at: drm_fb_helper_damage_work+0xba/0x710 drivers/gpu/drm/drm_fb_helper.c:271
2 locks held by syz.0.952/12359:
#0: ffffffff8f794230 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
#1: ffffffff8e635308 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x137/0x1660 fs/nfsd/nfsctl.c:1880
3 locks held by syz.5.1008/13022:
#0: ffffffff8f794230 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
#1: ffff88807e0706f0 (nlk_cb_mutex-GENERIC){+.+.}-{4:4}, at: __netlink_dump_start+0xfe/0x7e0 net/netlink/af_netlink.c:2404
#2: ffffffff8e635308 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_rpc_status_get_dumpit+0xdf/0x1290 fs/nfsd/nfsctl.c:1477
2 locks held by syz.9.1805/22196:
10 locks held by syz.9.1805/22204:
#0: ffff8880335540a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffff888033554130 (&tty->atomic_write_lock){+.+.}-{4:4}, at: tty_write_lock drivers/tty/tty_io.c:939 [inline]
#1: ffff888033554130 (&tty->atomic_write_lock){+.+.}-{4:4}, at: iterate_tty_write drivers/tty/tty_io.c:958 [inline]
#1: ffff888033554130 (&tty->atomic_write_lock){+.+.}-{4:4}, at: file_tty_write+0x211/0xa20 drivers/tty/tty_io.c:1081
#2: ffff8880335542e8 (&tty->termios_rwsem){++++}-{4:4}, at: class_rwsem_read_constructor include/linux/rwsem.h:253 [inline]
#2: ffff8880335542e8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_write+0x1e0/0x12a0 drivers/tty/n_tty.c:2349
#3: ffffc90004313380 (&ldata->output_lock){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#3: ffffc90004313380 (&ldata->output_lock){+.+.}-{4:4}, at: process_output_block drivers/tty/n_tty.c:513 [inline]
#3: ffffc90004313380 (&ldata->output_lock){+.+.}-{4:4}, at: n_tty_write+0x6a2/0x12a0 drivers/tty/n_tty.c:2366
#4: ffffffff8e3331e0 (console_lock){+.+.}-{0:0}, at: class_console_lock_constructor include/linux/console.h:737 [inline]
#4: ffffffff8e3331e0 (console_lock){+.+.}-{0:0}, at: do_con_write+0x116/0x5210 drivers/tty/vt/vt.c:3194
#5: ffff888143ec6280 (&helper->lock){+.+.}-{4:4}, at: drm_fb_helper_pan_display+0xbe/0xbd0 drivers/gpu/drm/drm_fb_helper.c:1250
#6: ffff8881482fe130 (&dev->master_mutex){+.+.}-{4:4}, at: drm_master_internal_acquire+0x20/0x80 drivers/gpu/drm/drm_auth.c:435
#7: ffff888143ec6098 (&client->modeset_mutex){+.+.}-{4:4}, at: drm_client_modeset_commit_locked+0x4c/0x4d0 drivers/gpu/drm/drm_client_modeset.c:1204
#8: ffffc90005127190 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_client_modeset_commit_atomic+0xda/0x760 drivers/gpu/drm/drm_client_modeset.c:1042
#9: ffffc900051271b8 (crtc_ww_class_mutex){+.+.}-{4:4}, at: drm_client_modeset_commit_atomic+0xda/0x760 drivers/gpu/drm/drm_client_modeset.c:1042
4 locks held by syz.7.1807/22220:
#0: ffff88804a41ef48 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline]
#0: ffff88804a41ef48 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x89/0x250 net/socket.c:665
#1: ffffffff8f792670 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 kernel/notifier.c:379
#2: ffff88805b3facd8 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nft_rcv_nl_event+0x116/0x640 net/netfilter/nf_tables_api.c:12135
#3: ffffffff8e344e38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
#3: ffffffff8e344e38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 kernel/rcu/tree_exp.h:956
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:363 [inline]
watchdog+0xe40/0xe90 kernel/hung_task.c:557
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 22196 Comm: syz.9.1805 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__bfs kernel/locking/lockdep.c:1815 [inline]
RIP: 0010:__bfs_backwards kernel/locking/lockdep.c:1860 [inline]
RIP: 0010:check_irq_usage kernel/locking/lockdep.c:2796 [inline]
RIP: 0010:check_prev_add kernel/locking/lockdep.c:3169 [inline]
RIP: 0010:check_prevs_add kernel/locking/lockdep.c:3284 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3908 [inline]
RIP: 0010:__lock_acquire+0x197c/0x2cf0 kernel/locking/lockdep.c:5237
Code: 14 25 ff 0f 00 00 39 05 9e 3d 2d 12 73 06 89 05 96 3d 2d 12 48 8b 02 48 89 df 4c 39 e8 0f 84 2c fe ff ff 4c 89 60 30 48 8b 00 <4c> 39 e8 75 f4 48 89 df e9 18 fe ff ff 48 89 fb 48 c7 c7 b0 f3 20
RSP: 0018:ffffc9000c93ea20 EFLAGS: 00000002
RAX: ffffffff96506198 RBX: 0000000000000111 RCX: 0000000000000002
RDX: ffffffff964fe8d8 RSI: ffff8880356dc8d0 RDI: 0000000000000111
RBP: fda85f93e90f0448 R08: ffffc9000c93e9e8 R09: 0000000000000020
R10: dffffc0000000000 R11: ffffffff819f1f10 R12: ffffc9000c93eab0
R13: ffffffff936d92d8 R14: ffff8880356dbd00 R15: 0000000000000001
FS: 00007f77665546c0(0000) GS:ffff8881259dc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c304328 CR3: 000000002fe60000 CR4: 00000000003526f0
Call Trace:
lock_acquire+0x117/0x340 kernel/locking/lockdep.c:5868
_raw_spin_lock_nested+0x32/0x50 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:639
raw_spin_rq_lock kernel/sched/sched.h:1556 [inline]
rq_lock kernel/sched/sched.h:1883 [inline]
ttwu_queue kernel/sched/core.c:3894 [inline]
try_to_wake_up+0x635/0x12b0 kernel/sched/core.c:4220
swake_up_locked kernel/sched/swait.c:30 [inline]
swake_up_one+0x70/0x140 kernel/sched/swait.c:53
rcu_report_exp_rnp kernel/rcu/tree_exp.h:232 [inline]
rcu_preempt_deferred_qs_irqrestore+0x8bd/0xce0 kernel/rcu/tree_plugin.h:581
rcu_read_unlock_special+0x3d8/0x520 kernel/rcu/tree_plugin.h:769
__rcu_read_unlock+0x84/0xe0 kernel/rcu/tree_plugin.h:438
rcu_read_unlock include/linux/rcupdate.h:899 [inline]
class_rcu_destructor include/linux/rcupdate.h:1195 [inline]
unwind_next_frame+0x1ab6/0x23d0 arch/x86/kernel/unwind_orc.c:695
arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5661 [inline]
__kmalloc_noprof+0x41d/0x800 mm/slub.c:5673
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
new_dir fs/proc/proc_sysctl.c:966 [inline]
get_subdir fs/proc/proc_sysctl.c:1010 [inline]
sysctl_mkdir_p fs/proc/proc_sysctl.c:1320 [inline]
__register_sysctl_table+0xba1/0x1340 fs/proc/proc_sysctl.c:1395
__devinet_sysctl_register+0x37f/0x470 net/ipv4/devinet.c:2677
devinet_sysctl_register+0x187/0x200 net/ipv4/devinet.c:2717
inetdev_init+0x2b1/0x4f0 net/ipv4/devinet.c:291
inetdev_event+0x2f1/0x15b0 net/ipv4/devinet.c:1590
notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2269 [inline]
call_netdevice_notifiers net/core/dev.c:2283 [inline]
register_netdevice+0x15bd/0x1a70 net/core/dev.c:11430
__ip_tunnel_create+0x3d7/0x550 net/ipv4/ip_tunnel.c:268
ip_tunnel_init_net+0x2ba/0x800 net/ipv4/ip_tunnel.c:1147
ops_init+0x35c/0x5c0 net/core/net_namespace.c:137
setup_net+0x110/0x330 net/core/net_namespace.c:446
copy_net_ns+0x3e3/0x570 net/core/net_namespace.c:581
create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:130
unshare_nsproxy_namespaces+0x11c/0x170 kernel/nsproxy.c:226
ksys_unshare+0x4c8/0x8c0 kernel/fork.c:3175
__do_sys_unshare kernel/fork.c:3246 [inline]
__se_sys_unshare kernel/fork.c:3244 [inline]
__x64_sys_unshare+0x38/0x50 kernel/fork.c:3244
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f776578f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7766554038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f77659e5fa0 RCX: 00007f776578f749
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000006a040000
RBP: 00007f7765813f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f77659e6038 R14: 00007f77659e5fa0 R15: 00007fffa44d2f88