INFO: task syz-executor:6411 blocked for more than 143 seconds. Tainted: G L syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21968 pid:6411 tgid:6411 ppid:1 task_flags:0x40054c flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5298 [inline] __schedule+0x1553/0x5240 kernel/sched/core.c:6911 __schedule_loop kernel/sched/core.c:6993 [inline] rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7289 rt_mutex_slowlock_block+0x508/0x680 kernel/locking/rtmutex.c:1647 __rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline] __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline] rt_mutex_slowlock+0x2dc/0x7b0 kernel/locking/rtmutex.c:1800 __rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline] __mutex_lock_common kernel/locking/rtmutex_api.c:534 [inline] mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:552 rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 netdev_run_todo+0x2e0/0xde0 net/core/dev.c:11695 tun_detach drivers/net/tun.c:640 [inline] tun_chr_close+0x13f/0x1c0 drivers/net/tun.c:3436 __fput+0x461/0xa90 fs/file_table.c:469 task_work_run+0x1d9/0x270 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x70f/0x23c0 kernel/exit.c:976 do_group_exit+0x21b/0x2d0 kernel/exit.c:1118 get_signal+0x125c/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efddeb9cfce RSP: 002b:00007ffc89f31298 EFLAGS: 00000246 ORIG_RAX: 000000000000003d RAX: fffffffffffffe00 RBX: 0000555562fae500 RCX: 00007efddeb9cfce RDX: 0000000040000000 RSI: 00007ffc89f3133c RDI: ffffffffffffffff RBP: 00007ffc89f3133c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000004e R13: 0000555562fc19f0 R14: 0000000000053606 R15: 00007ffc89f31390 INFO: task syz-executor:6417 blocked for more than 143 seconds. Tainted: G L syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21704 pid:6417 tgid:6417 ppid:1 task_flags:0x40054c flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5298 [inline] __schedule+0x1553/0x5240 kernel/sched/core.c:6911 __schedule_loop kernel/sched/core.c:6993 [inline] rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7289 rt_mutex_slowlock_block+0x508/0x680 kernel/locking/rtmutex.c:1647 __rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline] __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline] rt_mutex_slowlock+0x2dc/0x7b0 kernel/locking/rtmutex.c:1800 __rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline] __mutex_lock_common kernel/locking/rtmutex_api.c:534 [inline] mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:552 rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 netdev_run_todo+0x2e0/0xde0 net/core/dev.c:11695 tun_detach drivers/net/tun.c:640 [inline] tun_chr_close+0x13f/0x1c0 drivers/net/tun.c:3436 __fput+0x461/0xa90 fs/file_table.c:469 task_work_run+0x1d9/0x270 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x70f/0x23c0 kernel/exit.c:976 do_group_exit+0x21b/0x2d0 kernel/exit.c:1118 get_signal+0x125c/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f31525fcfce RSP: 002b:00007fff97d2a5c8 EFLAGS: 00000246 ORIG_RAX: 000000000000003d RAX: fffffffffffffe00 RBX: 000055557a894500 RCX: 00007f31525fcfce RDX: 0000000040000000 RSI: 00007fff97d2a66c RDI: ffffffffffffffff RBP: 00007fff97d2a66c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000045 R13: 000055557a8a79f0 R14: 0000000000054cca R15: 00007fff97d2a6c0 INFO: task syz.3.633:8321 blocked for more than 143 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.633 state:D stack:23104 pid:8321 tgid:8319 ppid:5799 task_flags:0x400140 flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5298 [inline] __schedule+0x1553/0x5240 kernel/sched/core.c:6911 __schedule_loop kernel/sched/core.c:6993 [inline] rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7289 rt_mutex_slowlock_block+0x508/0x680 kernel/locking/rtmutex.c:1647 __rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline] __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline] rt_mutex_slowlock+0x2dc/0x7b0 kernel/locking/rtmutex.c:1800 __rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline] __mutex_lock_common kernel/locking/rtmutex_api.c:534 [inline] mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:552 rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 kvm_mmu_uninit_vm+0x53/0x90 arch/x86/kvm/mmu/mmu.c:6880 kvm_arch_destroy_vm+0x26e/0x2d0 arch/x86/kvm/x86.c:13409 kvm_destroy_vm virt/kvm/kvm_main.c:1301 [inline] kvm_put_kvm+0x6ca/0xa80 virt/kvm/kvm_main.c:1338 kvm_vcpu_release+0x57/0x70 virt/kvm/kvm_main.c:4101 __fput+0x461/0xa90 fs/file_table.c:469 task_work_run+0x1d9/0x270 kernel/task_work.c:233 get_signal+0x11c3/0x1310 kernel/signal.c:2807 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc3a09cc799 RSP: 002b:00007fc39ec26028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffffffffc RBX: 00007fc3a0c45fa0 RCX: 00007fc3a09cc799 RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 000000000000000c RBP: 00007fc3a0a62c99 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc3a0c46038 R14: 00007fc3a0c45fa0 R15: 00007fff839bd268 Showing all locks held in the system: 9 locks held by kworker/u8:1/13: 3 locks held by rcuc/0/20: 1 lock held by khungtaskd/39: #0: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #0: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #0: ffffffff8ddcb980 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 10 locks held by kworker/u8:12/1282: 2 locks held by getty/5556: #0: ffff88803702d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90003e832e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13c0 drivers/tty/n_tty.c:2211 3 locks held by kworker/1:5/5885: 3 locks held by kworker/1:6/5886: #0: ffff888019c03938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline] #0: ffff888019c03938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359 #1: ffffc90004d6fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline] #1: ffffc90004d6fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359 #2: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz-executor/6411: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz-executor/6417: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz.0.563/8053: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz-executor/8190: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz.1.624/8287: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz.6.625/8302: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz.3.633/8321: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz-executor/8331: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz-executor/8332: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz-executor/8338: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz-executor/8357: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz-executor/8370: #0: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 2 locks held by syz-executor/8399: #0: ffffffff8f14c400 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577 #1: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 2 locks held by syz-executor/8402: #0: ffffffff8f14c400 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577 #1: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 2 locks held by syz-executor/8403: #0: ffffffff8f14c400 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577 #1: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 2 locks held by syz-executor/8414: #0: ffffffff8f14c400 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577 #1: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 2 locks held by syz-executor/8419: #0: ffffffff8f14c400 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577 #1: ffffffff8ddd1bf0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 2 locks held by syz-executor/8431: 2 locks held by syz-executor/8436: #0: ffffffff8f14c400 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577 #1: ffffffff8f15abb8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock_killable include/linux/rtnetlink.h:145 [inline] #1: ffffffff8f15abb8 (rtnl_mutex){+.+.}-{4:4}, at: register_netdev+0x18/0x60 net/core/dev.c:11537 2 locks held by syz-executor/8438: 2 locks held by syz-executor/8441: #0: ffffffff8f14c400 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577 #1: ffffffff8f15abb8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock_killable include/linux/rtnetlink.h:145 [inline] #1: ffffffff8f15abb8 (rtnl_mutex){+.+.}-{4:4}, at: register_netdev+0x18/0x60 net/core/dev.c:11537 1 lock held by syz-executor/8447: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xfd9/0x1030 kernel/hung_task.c:515 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 13 Comm: kworker/u8:1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: events_unbound nsim_dev_trap_report_work RIP: 0010:check_wait_context kernel/locking/lockdep.c:4882 [inline] RIP: 0010:__lock_acquire+0x56f/0x2cf0 kernel/locking/lockdep.c:5187 Code: 85 c0 74 1c 83 3d 54 12 ca 0d 00 75 13 48 8d 3d 07 23 cd 0d 48 c7 c6 34 4c 67 8d 67 48 0f b9 3a 90 31 c9 0f b6 81 c4 00 00 00 <84> c0 0f 84 77 ff ff ff 41 0f b6 f4 0f b6 d0 40 38 c6 0f 42 d6 80 RSP: 0018:ffffc90000126558 EFLAGS: 00000002 RAX: 0000000000000003 RBX: ffff88801ca9e870 RCX: ffffffff92f70c88 RDX: 0000000000000003 RSI: 0000000000000003 RDI: 0000000000000000 RBP: ffff88801ca9e878 R08: ffffffff81767e65 R09: ffffffff8ddcb980 R10: ffffc90000126848 R11: fffff52000024d15 R12: 0000000000000003 R13: ffff88801ca9e878 R14: ffff88801ca9db80 R15: 0000000000000007 FS: 0000000000000000(0000) GS:ffff88812643c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd245ea499d CR3: 000000003b84e000 CR4: 00000000003526f0 Call Trace: lock_acquire+0xf0/0x2e0 kernel/locking/lockdep.c:5868 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495 __unwind_start+0x5b8/0x760 arch/x86/kernel/unwind_orc.c:773 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xe3/0x150 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4538 [inline] slab_alloc_node mm/slub.c:4866 [inline] kmem_cache_alloc_node_noprof+0x22a/0x6e0 mm/slub.c:4918 kmalloc_reserve net/core/skbuff.c:613 [inline] __alloc_skb+0x27d/0x7d0 net/core/skbuff.c:713 alloc_skb include/linux/skbuff.h:1383 [inline] synproxy_send_client_synack+0x172/0xe30 net/netfilter/nf_synproxy_core.c:461 nft_synproxy_eval_v4+0x34a/0x4e0 net/netfilter/nft_synproxy.c:60 nft_synproxy_do_eval+0x305/0x580 net/netfilter/nft_synproxy.c:142 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x45e/0x1990 net/netfilter/nf_tables_core.c:285 nft_do_chain_inet+0x29d/0x380 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6164 [inline] __netif_receive_skb net/core/dev.c:6277 [inline] process_backlog+0x569/0xc60 net/core/dev.c:6628 __napi_poll+0xaf/0x580 net/core/dev.c:7692 napi_poll net/core/dev.c:7755 [inline] net_rx_action+0x696/0xe00 net/core/dev.c:7912 handle_softirqs+0x1de/0x6f0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] __local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302 local_bh_enable include/linux/bottom_half.h:33 [inline] __alloc_skb+0x1aa/0x7d0 net/core/skbuff.c:697 alloc_skb include/linux/skbuff.h:1383 [inline] nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:819 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:876 [inline] nsim_dev_trap_report_work+0x29f/0xbc0 drivers/net/netdevsim/dev.c:922 process_one_work kernel/workqueue.c:3276 [inline] process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245