INFO: task syz.2.3:6004 blocked for more than 144 seconds.
      Tainted: G             L      syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.3         state:D stack:27424 pid:6004  tgid:5997  ppid:5850   task_flags:0x40054c flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5352 [inline]
 __schedule+0x1665/0x5590 kernel/sched/core.c:6964
 __schedule_loop kernel/sched/core.c:7047 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7062
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7119
 rwsem_down_read_slowpath+0x6d9/0x940 kernel/locking/rwsem.c:1114
 __down_read_common kernel/locking/rwsem.c:1291 [inline]
 __down_read kernel/locking/rwsem.c:1304 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1570
 mmap_read_lock include/linux/mmap_lock.h:592 [inline]
 exit_mm+0x73/0x250 kernel/exit.c:557
 do_exit+0x8b9/0x2490 kernel/exit.c:962
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1116
 get_signal+0x1284/0x1330 kernel/signal.c:3036
 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0eed79c799
RSP: 002b:00007f0eee65b0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f0eeda15fa8 RCX: 00007f0eed79c799
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0eeda15fa8
RBP: 00007f0eeda15fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0eeda16038 R14: 00007ffd0ad72ad0 R15: 00007ffd0ad72bb8
 </TASK>
INFO: task syz.2.3:6006 blocked for more than 145 seconds.
      Tainted: G             L      syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.3         state:D stack:26464 pid:6006  tgid:5997  ppid:5850   task_flags:0x40054c flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5352 [inline]
 __schedule+0x1665/0x5590 kernel/sched/core.c:6964
 __schedule_loop kernel/sched/core.c:7047 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7062
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7119
 rwsem_down_read_slowpath+0x6d9/0x940 kernel/locking/rwsem.c:1114
 __down_read_common kernel/locking/rwsem.c:1291 [inline]
 __down_read kernel/locking/rwsem.c:1304 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1570
 mmap_read_lock include/linux/mmap_lock.h:592 [inline]
 exit_mm+0x73/0x250 kernel/exit.c:557
 do_exit+0x8b9/0x2490 kernel/exit.c:962
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1116
 get_signal+0x1284/0x1330 kernel/signal.c:3036
 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:269 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0eed79c799
RSP: 002b:00007f0eee63a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: 0000000000003d40 RBX: 00007f0eeda16090 RCX: 00007f0eed79c799
RDX: 0000000000000002 RSI: 0000200000000840 RDI: 0000000000000006
RBP: 00007f0eed832c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0eeda16128 R14: 00007f0eeda16090 R15: 00007ffd0ad72bb8
 </TASK>
INFO: task syz.2.3:6014 blocked for more than 146 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.3         state:D stack:25960 pid:6014  tgid:5997  ppid:5850   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5352 [inline]
 __schedule+0x1665/0x5590 kernel/sched/core.c:6964
 __schedule_loop kernel/sched/core.c:7047 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7062
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7119
 rwsem_down_read_slowpath+0x6d9/0x940 kernel/locking/rwsem.c:1114
 __down_read_common kernel/locking/rwsem.c:1291 [inline]
 __down_read kernel/locking/rwsem.c:1304 [inline]
 down_read+0x99/0x2e0 kernel/locking/rwsem.c:1570
 mmap_read_lock include/linux/mmap_lock.h:592 [inline]
 madvise_collapse+0x227/0x820 mm/khugepaged.c:2846
 madvise_vma_behavior+0x1094/0x4460 mm/madvise.c:1362
 madvise_walk_vmas+0x573/0xae0 mm/madvise.c:1711
 madvise_do_behavior+0x386/0x540 mm/madvise.c:1927
 do_madvise+0x1fa/0x2e0 mm/madvise.c:2020
 __do_sys_madvise mm/madvise.c:2029 [inline]
 __se_sys_madvise mm/madvise.c:2027 [inline]
 __x64_sys_madvise+0xa6/0xc0 mm/madvise.c:2027
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0eed79c799
RSP: 002b:00007f0eee5f8028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007f0eeda16270 RCX: 00007f0eed79c799
RDX: 0000000000000019 RSI: 0000000000600000 RDI: 0000200000000000
RBP: 00007f0eed832c99 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0eeda16308 R14: 00007f0eeda16270 R15: 00007ffd0ad72bb8
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/u8:0/12:
 #0: ffff888031e7e140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x894/0x1780 kernel/workqueue.c:3260
 #1: ffffc90000117c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1780 kernel/workqueue.c:3261
 #2: ffffffff8fbd4c00 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8fbd4c00 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11e/0x14c0 net/ipv6/addrconf.c:4198
1 lock held by khungtaskd/31:
 #0: ffffffff8e75d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8e75d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8e75d6a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5597:
 #0: ffff888036f9a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
1 lock held by syz.2.3/6004:
 #0: ffff88801b0941b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline]
 #0: ffff88801b0941b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x73/0x250 kernel/exit.c:557
1 lock held by syz.2.3/6006:
 #0: ffff88801b0941b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline]
 #0: ffff88801b0941b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x73/0x250 kernel/exit.c:557
1 lock held by syz.2.3/6014:
 #0: ffff88801b0941b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline]
 #0: ffff88801b0941b8 (&mm->mmap_lock){++++}-{4:4}, at: madvise_collapse+0x227/0x820 mm/khugepaged.c:2846
6 locks held by syz-executor/6269:
 #0: ffff8880b863ae60 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb6/0x150 kernel/sched/core.c:655
 #1: ffff8880b8624588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933
 #2: ffff88807f9e5b98 (&sb->s_type->i_lock_key#10){+.+.}-{3:3}, at: spin_trylock include/linux/spinlock.h:354 [inline]
 #2: ffff88807f9e5b98 (&sb->s_type->i_lock_key#10){+.+.}-{3:3}, at: lock_for_kill+0x84/0x210 fs/dcache.c:715
 #3: ffffffff8e75d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #3: ffffffff8e75d6a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #3: ffffffff8e75d6a0 (rcu_read_lock){....}-{1:3}, at: percpu_ref_tryget_many include/linux/percpu-refcount.h:241 [inline]
 #3: ffffffff8e75d6a0 (rcu_read_lock){....}-{1:3}, at: percpu_ref_tryget+0x15/0x180 include/linux/percpu-refcount.h:266
 #4: ffffffff9a504ea0 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x83/0x580 lib/debugobjects.c:846
 #5: ffff88801bb0c228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: spin_trylock include/linux/spinlock.h:354 [inline]
 #5: ffff88801bb0c228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: qdisc_run_begin include/net/sch_generic.h:205 [inline]
 #5: ffff88801bb0c228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_xmit_skb net/core/dev.c:4175 [inline]
 #5: ffff88801bb0c228 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock#3){+...}-{3:3}, at: __dev_queue_xmit+0x114b/0x3870 net/core/dev.c:4805
1 lock held by syz.1.148/6777:
 #0: ffff88807b2c3538 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline]
 #0: ffff88807b2c3538 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm+0x73/0x250 kernel/exit.c:557
3 locks held by syz-executor/6891:
 #0: ffffffff8fbd4c00 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8fbd4c00 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8fbd4c00 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071
 #1: ffff88807a015550 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x227/0x420 drivers/net/wireguard/device.c:50
 #2: ffffffff8e7638e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
 #2: ffffffff8e7638e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0x1002/0x1060 kernel/hung_task.c:561
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6891 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:__bfs kernel/locking/lockdep.c:-1 [inline]
RIP: 0010:__bfs_backwards kernel/locking/lockdep.c:1860 [inline]
RIP: 0010:check_irq_usage kernel/locking/lockdep.c:2796 [inline]
RIP: 0010:check_prev_add kernel/locking/lockdep.c:3169 [inline]
RIP: 0010:check_prevs_add kernel/locking/lockdep.c:3284 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3908 [inline]
RIP: 0010:__lock_acquire+0x1968/0x2cf0 kernel/locking/lockdep.c:5237
Code: 89 c1 81 e1 ff 0f 00 00 89 0d 08 b9 84 14 2b 05 fe b8 84 14 25 ff 0f 00 00 39 05 bf b8 83 12 73 06 89 05 b7 b8 83 12 48 8b 02 <48> 89 df 4c 39 e8 0f 84 2c fe ff ff 4c 89 60 30 48 8b 00 4c 39 e8
RSP: 0018:ffffc9000628e118 EFLAGS: 00000002
RAX: ffffffff93c921d8 RBX: 00000000000003dd RCX: 00000000000001de
RDX: ffffffff96ac2658 RSI: ffff8880313d8bf0 RDI: 00000000000003dd
RBP: e6caed1ae739159e R08: ffffc9000628e0e0 R09: 0000000000000020
R10: dffffc0000000000 R11: ffffffff81a31030 R12: ffffffff96c12c78
R13: ffffffff93c921d8 R14: ffff8880313d8000 R15: 00000000000001dd
FS:  0000555594c0f500(0000) GS:ffff888125436000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa5085e92f8 CR3: 0000000077d72000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868
 seqcount_lockdep_reader_access+0x55/0x100 include/linux/seqlock.h:73
 ktime_get+0x45/0x220 kernel/time/timekeeping.c:965
 hrtick_schedule_exit kernel/sched/core.c:980 [inline]
 finish_lock_switch kernel/sched/core.c:5088 [inline]
 finish_task_switch+0x312/0xbe0 kernel/sched/core.c:5207
 context_switch kernel/sched/core.c:5355 [inline]
 __schedule+0x166d/0x5590 kernel/sched/core.c:6964
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7292
 irqentry_exit+0x5e4/0x700 kernel/entry/common.c:240
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:arch_try_cmpxchg128 arch/x86/include/asm/cmpxchg_64.h:83 [inline]
RIP: 0010:__update_freelist_fast mm/slub.c:641 [inline]
RIP: 0010:slab_update_freelist mm/slub.c:707 [inline]
RIP: 0010:__slab_free+0xb3/0x2c0 mm/slub.c:5556
Code: 09 c1 89 4c 24 38 4d 85 ed 89 44 24 04 74 45 85 c0 74 41 45 31 e4 41 f6 46 0a 20 74 66 48 89 de 48 8b 5c 24 30 48 8b 4c 24 38 <48> 8b 44 24 40 48 8b 54 24 48 f0 48 0f c7 4e 20 48 89 f3 0f 84 e8
RSP: 0018:ffffc9000628e6e0 EFLAGS: 00000202
RAX: 0000000000000002 RBX: ffff888035708000 RCX: 0000000800040002
RDX: ffff888035708000 RSI: ffffea0000d5c200 RDI: ffff88801b042140
RBP: ffffc9000628e770 R08: 0000000000000000 R09: ffffffff82303fde
R10: dffffc0000000000 R11: fffffbfff20245ff R12: 0000000000000000
R13: ffff88803570e000 R14: ffff88801b042140 R15: 0000000000000000
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4569 [inline]
 slab_alloc_node mm/slub.c:4898 [inline]
 kmem_cache_alloc_lru_noprof+0x2b8/0x640 mm/slub.c:4917
 sock_alloc_inode+0x2c/0x190 net/socket.c:327
 alloc_inode+0x6a/0x1b0 fs/inode.c:347
 new_inode_pseudo include/linux/fs.h:3001 [inline]
 sock_alloc net/socket.c:696 [inline]
 __sock_create+0x11e/0x960 net/socket.c:1642
 udp_sock_create4+0xca/0x480 net/ipv4/udp_tunnel_core.c:19
 udp_sock_create include/net/udp_tunnel.h:64 [inline]
 wg_socket_init+0x67c/0xef0 drivers/net/wireguard/socket.c:387
 wg_open+0x24f/0x420 drivers/net/wireguard/device.c:51
 __dev_open+0x44d/0x830 net/core/dev.c:1702
 __dev_change_flags+0x1f7/0x690 net/core/dev.c:9783
 netif_change_flags+0x88/0x1a0 net/core/dev.c:9846
 do_setlink+0xf82/0x4590 net/core/rtnetlink.c:3158
 rtnl_changelink net/core/rtnetlink.c:3776 [inline]
 __rtnl_newlink net/core/rtnetlink.c:3935 [inline]
 rtnl_newlink+0x15a9/0x1be0 net/core/rtnetlink.c:4072
 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec+0x112/0x150 net/socket.c:796
 __sock_sendmsg net/socket.c:811 [inline]
 __sys_sendto+0x3ff/0x590 net/socket.c:2279
 __do_sys_sendto net/socket.c:2286 [inline]
 __se_sys_sendto net/socket.c:2282 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2282
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe18f75cfce
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffc5d371608 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555594c0f500 RCX: 00007fe18f75cfce
RDX: 0000000000000020 RSI: 00007fe190544670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffc5d371684 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fe190544670 R15: 0000000000000000
 </TASK>