INFO: task syz.8.2995:18457 blocked for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.2995      state:D stack:28872 pid:18457 tgid:18455 ppid:11439  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x1709/0x5530 kernel/sched/core.c:7231
 __schedule_loop kernel/sched/core.c:7308 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7323
 cgroup_lock_and_drain_offline+0x51a/0x650 kernel/cgroup/cgroup.c:3275
 cgroup1_get_tree+0x9d/0x890 kernel/cgroup/cgroup-v1.c:1265
 vfs_get_tree+0x92/0x2a0 fs/super.c:1941
 fc_mount fs/namespace.c:1198 [inline]
 do_new_mount_fc fs/namespace.c:3777 [inline]
 do_new_mount+0x319/0xdc0 fs/namespace.c:3853
 do_mount fs/namespace.c:4186 [inline]
 __do_sys_mount fs/namespace.c:4402 [inline]
 __se_sys_mount+0x31d/0x420 fs/namespace.c:4379
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f91fe86de99
RSP: 002b:00007f91fcaa5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffff[ 1071.159061][   T39] RAX: ffffffffffffffda RBX: 00007f91feaf6090 RCX: 00007f91fe86de99
RDX: 0000200000000240 RSI: 00002000000004c0 RDI: 0000000000000000
RBP: 00007f91fe903eaf R08: 0000200000000500 R09: 0000000000000000
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f91feaf6128 R14: 00007f91feaf6090 R15: 00007ffc5d904208
 </TASK>

Showing all locks held in the system:
locks held by ktimers/0/16: 9, last CPU#0:
 #0: ffffffff8e259320 (local_bh){.+.+}-{1:3}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:667
 #1: ffff8880b8624548 (psi_seq){-...}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:933
 #2: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #2: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #2: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
 #2: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
 #3: ffff8880b86284b8 (_T->lock){....}-{2:2}, at: rt_mutex_slowunlock+0xbf/0xa20 kernel/locking/rtmutex.c:1430
 #4: ffff8880b8628458 (hrtimer_bases.lock){-...}-{2:2}, at: __run_hrtimer kernel/time/hrtimer.c:2069 [inline]
 #4: ffff8880b8628458 (hrtimer_bases.lock){-...}-{2:2}, at: __hrtimer_run_queues+0x495/0xaf0 kernel/time/hrtimer.c:2122
 #5: ffffffff99d06748 (&____s->seqcount#2){--..}-{0:0}, at: ktime_get+0x45/0x220 kernel/time/timekeeping.c:998
 #6: ffff8880b8624548 (psi_seq){-...}-{0:0}, at: psi_task_change+0xc9/0x320 kernel/sched/psi.c:919
 #7: ffff8880b86261d8 (&base->lock){-...}-{2:2}, at: lock_timer_base kernel/time/timer.c:1004 [inline]
 #7: ffff8880b86261d8 (&base->lock){-...}-{2:2}, at: __mod_timer+0x1a9/0xf10 kernel/time/timer.c:1085
 #8: ffffffff99f930c8 (&obj_hash[i].lock){-...}-{2:2}, at: debug_object_activate+0xa8/0x3b0 lib/debugobjects.c:873
locks held by khungtaskd/39: 1, last CPU#1:
 #0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6835
locks held by getty/5349: 2, on CPU#1:
 #0: ffff8880368560a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900044b62e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
locks held by kworker/0:3/5682: 7, last CPU#0:
 #0: ffff88802a7d9138 ((wq_completion)wg-crypt-wg2#15){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffff88802a7d9138 ((wq_completion)wg-crypt-wg2#15){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #0: ffff88802a7d9138 ((wq_completion)wg-crypt-wg2#15){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
 #1: ffffc900056ffc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #1: ffffc900056ffc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #1: ffffc900056ffc60 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
 #2: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
 #3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x261/0xc50 net/core/dev.c:6679
 #4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: ip6_input+0x23/0x270 net/ipv6/ip6_input.c:544
 #5: ffffffff8e259320 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
 #6: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #6: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:893 [inline]
 #6: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: wg_packet_consume_data drivers/net/wireguard/receive.c:515 [inline]
 #6: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: wg_packet_receive+0x106a/0x23c0 drivers/net/wireguard/receive.c:576
locks held by kworker/u8:37/8015: 1, last CPU#1:
 #0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
locks held by kworker/u8:6/14860: 10, last CPU#0:
 #0: ffff88804e975938 ((wq_completion)wg-kex-wg1#16){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffff88804e975938 ((wq_completion)wg-kex-wg1#16){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #0: ffff88804e975938 ((wq_completion)wg-kex-wg1#16){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
 #1: ffffc90006ec7c60 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #1: ffffc90006ec7c60 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #1: ffffc90006ec7c60 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
 #2: ffffffff8e259320 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
 #3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
 #4: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #4: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:893 [inline]
 #4: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: mod_peer_timer drivers/net/wireguard/timers.c:34 [inline]
 #4: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: wg_timers_handshake_initiated+0x73/0x2c0 drivers/net/wireguard/timers.c:187
 #5: ffff8880b86261d8 (&base->lock){-...}-{2:2}, at: __mod_timer+0x922/0xf10 kernel/time/timer.c:1117
 #6: ffffffff99f23450 (&obj_hash[i].lock){-...}-{2:2}, at: debug_object_activate+0xa8/0x3b0 lib/debugobjects.c:873
 #7: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
 #7: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:893 [inline]
 #7: ffffffff8e3c38e0 (rcu_read_lock_bh){....}-{1:3}, at: send4+0x217/0xec0 drivers/net/wireguard/socket.c:38
 #8: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #8: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #8: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: ip_output+0x5a/0x450 net/ipv4/ip_output.c:432
 #9: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #9: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #9: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0x3de/0x1100 net/ipv4/ip_output.c:229

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 39 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xfd7/0x1030 kernel/hung_task.c:561
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 4948 Comm: klogd Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
RIP: 0010:in_lock_functions+0x0/0x30 kernel/locking/spinlock.c:412
Code: c7 38 99 c8 95 e8 50 6d 90 00 e9 61 ff ff ff cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 48 81 ff 00 b1 53 8b 0f 93 c0 48 81 ff 3a e4 53 8b 0f
RSP: 0018:ffffc900042cf520 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff99cc2501
RDX: 0000000000000000 RSI: ffffffff8bcbd060 RDI: 0000000000000000
RBP: ffffc900042cf658 R08: ffffffff8fd0c47f R09: 1ffffffff1fa188f
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: dffffc0000000000
R13: 1ffff92000859eb4 R14: ffff88801f6ab800 R15: dffffc0000000000
FS:  00007f9b79deac80(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3e9178b580 CR3: 00000000379dc000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 get_lock_parent_ip include/linux/ftrace.h:1180 [inline]
 preempt_latency_start kernel/sched/core.c:5960 [inline]
 preempt_count_add+0x9e/0x190 kernel/sched/core.c:5985
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:131 [inline]
 _raw_spin_lock_irqsave+0x24/0x60 kernel/locking/spinlock.c:166
 rt_mutex_slowunlock+0xbf/0xa20 kernel/locking/rtmutex.c:1430
 rt_spin_unlock+0x10d/0x200 kernel/locking/spinlock_rt.c:84
 spin_unlock_irqrestore include/linux/spinlock_rt.h:129 [inline]
 __slab_free+0x20a/0x2a0 mm/slub.c:-1
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4608 [inline]
 slab_alloc_node mm/slub.c:4921 [inline]
 kmem_cache_alloc_node_noprof+0x3f4/0x660 mm/slub.c:4993
 __alloc_skb+0x1d7/0x7a0 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_skb_with_frags+0xc6/0x760 net/core/skbuff.c:6769
 sock_alloc_send_pskb+0x884/0x9a0 net/core/sock.c:3013
 unix_dgram_sendmsg+0x4da/0x17b0 net/unix/af_unix.c:2131
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
 __sock_sendmsg net/socket.c:825 [inline]
 __sys_sendto+0x41e/0x5d0 net/socket.c:2292
 __do_sys_sendto net/socket.c:2299 [inline]
 __se_sys_sendto net/socket.c:2295 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2295
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9b79f3a407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffee7ebab20 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f9b79deac80 RCX: 00007f9b79f3a407
RDX: 0000000000000070 RSI: 00007ffee7ebac60 RDI: 0000000000000003
RBP: 00007ffee7ebb090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffee7ebb0a8
R13: 00007ffee7ebac60 R14: 0000000000000055 R15: 00007ffee7ebac60
 </TASK>