INFO: task kworker/0:3:981 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:24512 pid:981 tgid:981 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_long flush_mdb Call Trace: context_switch kernel/sched/core.c:5258 [inline] __schedule+0x150e/0x5070 kernel/sched/core.c:6866 __schedule_loop kernel/sched/core.c:6948 [inline] schedule+0x165/0x360 kernel/sched/core.c:6963 io_schedule+0x80/0xd0 kernel/sched/core.c:7792 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:250 __wait_on_bit_lock+0xec/0x4f0 kernel/sched/wait_bit.c:93 out_of_line_wait_on_bit_lock+0x123/0x170 kernel/sched/wait_bit.c:120 lock_buffer include/linux/buffer_head.h:432 [inline] hfs_mdb_commit+0x115/0x12e0 fs/hfs/mdb.c:271 process_one_work+0x93a/0x15a0 kernel/workqueue.c:3279 process_scheduled_works kernel/workqueue.c:3362 [inline] worker_thread+0x9b0/0xee0 kernel/workqueue.c:3443 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 INFO: task syz-executor:5988 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:19496 pid:5988 tgid:5988 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5258 [inline] __schedule+0x150e/0x5070 kernel/sched/core.c:6866 __schedule_loop kernel/sched/core.c:6948 [inline] schedule+0x165/0x360 kernel/sched/core.c:6963 io_schedule+0x80/0xd0 kernel/sched/core.c:7792 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:250 __wait_on_bit_lock+0xec/0x4f0 kernel/sched/wait_bit.c:93 out_of_line_wait_on_bit_lock+0x123/0x170 kernel/sched/wait_bit.c:120 lock_buffer include/linux/buffer_head.h:432 [inline] hfs_mdb_commit+0xe4e/0x12e0 fs/hfs/mdb.c:331 hfs_sync_fs+0x15/0x20 fs/hfs/super.c:37 sync_filesystem+0xee/0x230 fs/sync.c:56 generic_shutdown_super+0x6f/0x2c0 fs/super.c:622 kill_block_super+0x44/0x90 fs/super.c:1722 deactivate_locked_super+0xbc/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1318 task_work_run+0x1d4/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x2d0/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe4dfd90a77 RSP: 002b:00007ffdb2c3a038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fe4dfe13d7d RCX: 00007fe4dfd90a77 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdb2c3a0f0 RBP: 00007ffdb2c3a0f0 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffdb2c3b180 R13: 00007fe4dfe13d7d R14: 0000000000016343 R15: 00007ffdb2c3b1c0 Showing all locks held in the system: 2 locks held by kworker/0:0/9: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc900000e7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 2 locks held by kworker/0:1/10: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc900000f7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 1 lock held by khungtaskd/31: #0: ffffffff8e13f2e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e13f2e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e13f2e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 2 locks held by kworker/1:1/37: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc90000ad7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 2 locks held by kworker/0:3/981: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc90003cb7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 2 locks held by getty/5587: #0: ffff8880356b90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 drivers/tty/n_tty.c:2211 3 locks held by kworker/1:4/5856: #0: ffff88813fe15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc9000406fb80 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 #2: ffff88806dd95240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1f7/0x3b0 drivers/net/netdevsim/fib.c:1490 1 lock held by syz-executor/5988: #0: ffff88803120a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88803120a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88803120a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 2 locks held by kworker/0:5/6132: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc90002fa7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 1 lock held by syz-executor/6137: #0: ffff888021b420e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff888021b420e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff888021b420e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 2 locks held by kworker/0:6/6166: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc90002fe7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 1 lock held by syz-executor/6168: #0: ffff88802fe8c0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88802fe8c0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88802fe8c0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 2 locks held by kworker/0:7/6188: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc900035c7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 1 lock held by syz-executor/6190: #0: ffff88807e7c40e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88807e7c40e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88807e7c40e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 2 locks held by kworker/0:8/6209: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc900036a7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 1 lock held by syz-executor/6212: #0: ffff88805fb0a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88805fb0a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88805fb0a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 1 lock held by syz-executor/6240: #0: ffff88805c8c00e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88805c8c00e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88805c8c00e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 2 locks held by kworker/0:10/6256: #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc90003dbfb80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 1 lock held by syz-executor/6274: #0: ffff888065cc60e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff888065cc60e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff888065cc60e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 1 lock held by syz-executor/6303: #0: ffff88805d9600e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88805d9600e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88805d9600e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 1 lock held by syz-executor/6332: #0: ffff88805d5780e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88805d5780e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88805d5780e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 3 locks held by kworker/u8:18/6361: #0: ffff88802ff8c948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254 #1: ffffc90004427b80 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255 #2: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0 net/ipv6/addrconf.c:4194 3 locks held by syz-executor/6367: #0: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8ec/0x1c90 net/core/rtnetlink.c:4071 #1: ffff88802fc95528 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x227/0x420 drivers/net/wireguard/device.c:50 #2: ffffffff8e144e38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #2: ffffffff8e144e38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 kernel/rcu/tree_exp.h:956 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:363 [inline] watchdog+0xe40/0xe90 kernel/hung_task.c:557 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:12 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:put_dec+0x0/0xe0 lib/vsprintf.c:312 Code: 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 19 1b 04 00 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 57 41 56 41 54 53 48 89 f3 49 89 fe e8 6e 22 68 f6 bf ff e0 f5 RSP: 0018:ffffc9000c24edb8 EFLAGS: 00000293 RAX: ffffffff8b59b745 RBX: ffffc9000c24ee40 RCX: ffff888031261e80 RDX: 0000000000000000 RSI: 00000000000000f2 RDI: ffffc9000c24ee40 RBP: ffffc9000c24eee0 R08: ffffc9000c24ee57 R09: 0000000000000000 R10: ffffc9000c24ee40 R11: fffff52001849dcb R12: 00000000000000f2 R13: 00000000000000f2 R14: ffffc9000c24f1c1 R15: 0000000005ffff0a FS: 0000000000000000(0000) GS:ffff888125c25000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f146b35ea8 CR3: 0000000077a86000 CR4: 00000000003526f0 Call Trace: number+0x2f8/0xf60 lib/vsprintf.c:520 vsnprintf+0x8e5/0xee0 lib/vsprintf.c:2912 sprintf+0xd9/0x120 lib/vsprintf.c:3111 print_time kernel/printk/printk.c:1357 [inline] info_print_prefix+0x155/0x310 kernel/printk/printk.c:1383 record_print_text+0x154/0x420 kernel/printk/printk.c:1432 printk_get_next_message+0x26d/0x7b0 kernel/printk/printk.c:3018 console_emit_next_record kernel/printk/printk.c:3083 [inline] console_flush_one_record kernel/printk/printk.c:3215 [inline] console_flush_all+0x514/0xb60 kernel/printk/printk.c:3289 __console_flush_and_unlock kernel/printk/printk.c:3319 [inline] console_unlock+0xbb/0x190 kernel/printk/printk.c:3359 vprintk_emit+0x4f8/0x5f0 kernel/printk/printk.c:2426 _printk+0xcf/0x120 kernel/printk/printk.c:2451 ieee80211_sta_find_ibss net/mac80211/ibss.c:1443 [inline] ieee80211_ibss_work+0xdae/0x1060 net/mac80211/ibss.c:1666 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438 process_one_work+0x93a/0x15a0 kernel/workqueue.c:3279 process_scheduled_works kernel/workqueue.c:3362 [inline] worker_thread+0x9b0/0xee0 kernel/workqueue.c:3443 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246