INFO: task syz.8.1078:11107 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.1078 state:D stack:27760 pid:11107 ppid:10397 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
schedule+0xbd/0x170 kernel/sched/core.c:6773
io_schedule+0x80/0xd0 kernel/sched/core.c:9022
__lock_metapage fs/jfs/jfs_metapage.c:50 [inline]
lock_metapage+0x1ec/0x310 fs/jfs/jfs_metapage.c:64
__get_metapage+0x4ca/0xfa0 fs/jfs/jfs_metapage.c:639
ea_write+0x5e3/0xdd0 fs/jfs/xattr.c:256
ea_put fs/jfs/xattr.c:626 [inline]
__jfs_setxattr+0x931/0x1150 fs/jfs/xattr.c:792
__jfs_set_acl+0x121/0x1b0 fs/jfs/acl.c:87
jfs_set_acl+0x1d7/0x320 fs/jfs/acl.c:115
set_posix_acl fs/posix_acl.c:956 [inline]
vfs_set_acl+0x803/0xa60 fs/posix_acl.c:1135
do_set_acl+0xf5/0x180 fs/posix_acl.c:1280
do_setxattr fs/xattr.c:627 [inline]
__do_sys_fsetxattr fs/xattr.c:711 [inline]
__se_sys_fsetxattr+0x450/0x4b0 fs/xattr.c:687
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fabdb18f749
RSP: 002b:00007fabdc0a9038 EFLAGS: 00000246 ORIG_RAX: 00000000000000be
RAX: ffffffffffffffda RBX: 00007fabdb3e6090 RCX: 00007fabdb18f749
RDX: 00002000000001c0 RSI: 0000200000000280 RDI: 0000000000000004
RBP: 00007fabdb213f91 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000002c R11: 0000000000000246 R12: 0000000000000000
R13: 00007fabdb3e6128 R14: 00007fabdb3e6090 R15: 00007ffd727f01d8
Showing all locks held in the system:
1 lock held by khungtaskd/29:
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by kworker/1:2/787:
#0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc900039b7d00 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc900039b7d00 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
3 locks held by kworker/0:3/5153:
#0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90003047d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90003047d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffff8880600be240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x26c/0x3170 drivers/net/netdevsim/fib.c:1491
2 locks held by getty/5531:
#0: ffff88802d3070a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x425/0x1380 drivers/tty/n_tty.c:2217
4 locks held by kworker/u4:20/5876:
#0: ffff888141268538 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888141268538 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90004bafd00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90004bafd00 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffff88802fb800e0 (&type->s_umount_key#97){++++}-{3:3}, at: super_trylock_shared+0x20/0xf0 fs/super.c:607
#3: ffff88805caf5e48 (&jfs_ip->commit_mutex){+.+.}-{3:3}, at: jfs_commit_inode+0x1cb/0x520 fs/jfs/inode.c:108
4 locks held by syz.8.1078/11107:
#0: ffff88802fb80418 (sb_writers#41){.+.+}-{0:0}, at: mnt_want_write_file+0x63/0x200 fs/namespace.c:456
#1: ffff88805caf6210 (&type->i_mutex_dir_key#27){++++}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline]
#1: ffff88805caf6210 (&type->i_mutex_dir_key#27){++++}-{3:3}, at: vfs_set_acl+0x37a/0xa60 fs/posix_acl.c:1116
#2: ffff88805caf5e48 (&jfs_ip->commit_mutex){+.+.}-{3:3}, at: jfs_set_acl+0x10a/0x320 fs/jfs/acl.c:107
#3: ffff88805caf5ee0 (&jfs_ip->xattr_sem){++++}-{3:3}, at: __jfs_setxattr+0xe2/0x1150 fs/jfs/xattr.c:678
3 locks held by kworker/0:7/11160:
#0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90003ee7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90003ee7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffff888031af8240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x26c/0x3170 drivers/net/netdevsim/fib.c:1491
2 locks held by kworker/u4:1/11275:
#0: ffff8880b8f3c018 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:558
#1: ffff8880b8f289c0 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:189 [inline]
#1: ffff8880b8f289c0 (psi_seq){-.-.}-{0:0}, at: __schedule+0x20ee/0x44d0 kernel/sched/core.c:6694
1 lock held by syz-executor/12614:
#0: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#0: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x360/0x830 kernel/rcu/tree_exp.h:1004
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
nmi_cpu_backtrace+0x39b/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf41/0xf80 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5834 Comm: kworker/1:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: mld mld_dad_work
RIP: 0010:__in6_dev_get include/net/addrconf.h:323 [inline]
RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:414 [inline]
RIP: 0010:find_match+0xa8/0xc80 net/ipv6/route.c:782
Code: fc ff df 42 80 7c 25 00 00 74 08 48 89 df e8 ff cb b6 f8 48 89 d8 bb 48 03 00 00 48 03 18 48 89 d8 48 c1 e8 03 42 80 3c 20 00 <74> 08 48 89 df e8 de cb b6 f8 48 8b 1b e8 76 4a 41 01 41 89 c4 31
RSP: 0018:ffffc900001f0280 EFLAGS: 00000246
RAX: 1ffff11008c20069 RBX: ffff888046100348 RCX: 0000000000000100
RDX: ffff88807fa99e00 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 1ffff11005a40995 R08: ffffc900001f0580 R09: ffffc900001f0590
R10: ffffc900001f03e0 R11: fffff5200003e07e R12: dffffc0000000000
R13: 0000000000000003 R14: 1ffff11005a40997 R15: ffff88802d204cbf
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe9e75a0048 CR3: 000000000cb30000 CR4: 00000000003506e0
Call Trace:
__find_rr_leaf+0x23b/0x6c0 net/ipv6/route.c:870
find_rr_leaf net/ipv6/route.c:891 [inline]
rt6_select net/ipv6/route.c:935 [inline]
fib6_table_lookup+0x3a0/0xa70 net/ipv6/route.c:2221
ip6_pol_route+0x22d/0x1160 net/ipv6/route.c:2257
pol_lookup_func include/net/ip6_fib.h:578 [inline]
fib6_rule_lookup+0x1d7/0x510 net/ipv6/fib6_rules.c:116
ip6_route_input_lookup net/ipv6/route.c:2326 [inline]
ip6_route_input+0x6cf/0xa50 net/ipv6/route.c:2622
ip6_rcv_finish+0x143/0x230 net/ipv6/ip6_input.c:77
NF_HOOK+0x303/0x390 include/linux/netfilter.h:304
__netif_receive_skb_one_core net/core/dev.c:5608 [inline]
__netif_receive_skb+0xcc/0x290 net/core/dev.c:5722
process_backlog+0x380/0x6e0 net/core/dev.c:6050
__napi_poll+0xc0/0x460 net/core/dev.c:6612
napi_poll net/core/dev.c:6679 [inline]
net_rx_action+0x5ea/0xbf0 net/core/dev.c:6815
handle_softirqs+0x280/0x820 kernel/softirq.c:578
do_softirq+0xed/0x180 kernel/softirq.c:479
__local_bh_enable_ip+0x178/0x1c0 kernel/softirq.c:406
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:856 [inline]
__dev_queue_xmit+0x1449/0x35a0 net/core/dev.c:4452
dev_queue_xmit include/linux/netdevice.h:3113 [inline]
neigh_hh_output include/net/neighbour.h:527 [inline]
neigh_output include/net/neighbour.h:541 [inline]
ip6_finish_output2+0xdf5/0x1650 net/ipv6/ip6_output.c:141
dst_output include/net/dst.h:467 [inline]
NF_HOOK+0x163/0x470 include/linux/netfilter.h:304
mld_sendpack+0x7f9/0xd70 net/ipv6/mcast.c:1823
mld_dad_work+0x40/0x270 net/ipv6/mcast.c:2263
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293