INFO: task syz.1.1845:12122 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.1845 state:D stack:25072 pid:12122 ppid:5788 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
schedule+0xbd/0x170 kernel/sched/core.c:6773
perf_pending_task_sync kernel/events/core.c:5242 [inline]
_free_event+0x174/0xf30 kernel/events/core.c:5248
put_event kernel/events/core.c:5376 [inline]
perf_event_release_kernel+0x836/0x8c0 kernel/events/core.c:5501
perf_release+0x3b/0x40 kernel/events/core.c:5511
__fput+0x234/0x970 fs/file_table.c:384
task_work_run+0x1ce/0x250 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0x90b/0x23c0 kernel/exit.c:883
do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
get_signal+0x12fc/0x1400 kernel/signal.c:2902
arch_do_signal_or_restart+0x9c/0x7b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff2c078f6c9
RSP: 002b:00007ff2c15520e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007ff2c09e6098 RCX: 00007ff2c078f6c9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff2c09e6098
RBP: 00007ff2c09e6090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff2c09e6128 R14: 00007ffd9a96d8f0 R15: 00007ffd9a96d9d8
Showing all locks held in the system:
1 lock held by khungtaskd/28:
#0: ffffffff8cd2fee0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8cd2fee0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8cd2fee0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by getty/5555:
#0: ffff88814cc6e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x425/0x1380 drivers/tty/n_tty.c:2217
3 locks held by kworker/u4:24/6449:
4 locks held by syz.0.2643/14930:
2 locks held by syz.8.2654/14956:
#0: ffffffff8dfbbd08 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8dfbbd08 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511
#1: ffffffff8cd358b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline]
#1: ffffffff8cd358b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x448/0x830 kernel/rcu/tree_exp.h:1004
1 lock held by syz.0.2656/14964:
#0: ffffffff8dfbbd08 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8dfbbd08 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
nmi_cpu_backtrace+0x39b/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf41/0xf80 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 14930 Comm: syz.0.2643 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__preempt_count_add arch/x86/include/asm/preempt.h:80 [inline]
RIP: 0010:rcu_is_watching+0x8/0xb0 kernel/rcu/tree.c:699
Code: e8 7d 33 ff 08 48 c7 c7 40 67 d3 8c 4c 89 f6 e8 fe 46 e2 02 e9 53 ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 41 57 41 56 <53> 65 ff 05 68 1e 94 7e e8 5b 49 ff 08 89 c3 83 f8 08 73 60 49 bf
RSP: 0018:ffffc900032d6848 EFLAGS: 00000057
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff818bf1e8
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e4a8d68
RBP: ffffc900032d6940 R08: ffffffff8e4a8d6f R09: 1ffffffff1c951ad
R10: dffffc0000000000 R11: fffffbfff1c951ae R12: dffffc0000000000
R13: 0000000000000a02 R14: ffff88805a23ed98 R15: 1ffff9200065ad10
FS: 00007fd8994246c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2e9489 CR3: 0000000064978000 CR4: 00000000003506f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000200000000300
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
trace_irq_enable+0x37/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
seqcount_lockdep_reader_access+0x103/0x180 include/linux/seqlock.h:104
read_seqbegin include/linux/seqlock.h:893 [inline]
zone_span_seqbegin include/linux/memory_hotplug.h:134 [inline]
page_outside_zone_boundaries mm/page_alloc.c:448 [inline]
bad_range+0x5f/0x280 mm/page_alloc.c:467
rmqueue mm/page_alloc.c:2818 [inline]
get_page_from_freelist+0x193b/0x19f0 mm/page_alloc.c:3188
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
__folio_alloc+0x10/0x20 mm/page_alloc.c:4489
vma_alloc_folio+0x47a/0x8f0 mm/mempolicy.c:2242
shmem_alloc_folio+0x179/0x230 mm/shmem.c:1680
shmem_alloc_and_acct_folio+0x189/0x630 mm/shmem.c:1705
shmem_get_folio_gfp+0xcde/0x2ac0 mm/shmem.c:2042
shmem_get_folio mm/shmem.c:2165 [inline]
shmem_write_begin+0xf2/0x420 mm/shmem.c:2707
generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4016
shmem_file_write_iter+0xfb/0x120 mm/shmem.c:2884
__kernel_write_iter+0x274/0x670 fs/read_write.c:517
dump_emit_page fs/coredump.c:957 [inline]
dump_user_range+0x3f6/0x800 fs/coredump.c:984
elf_core_dump+0x3114/0x36e0 fs/binfmt_elf.c:2184
do_coredump+0x1755/0x2480 fs/coredump.c:833
get_signal+0x1133/0x1400 kernel/signal.c:2888
arch_do_signal_or_restart+0x9c/0x7b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0xe768964917
Code: Unable to access opcode bytes at 0xe7689648ed.
RSP: 002b:0000200000000358 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fd8987e6090 RCX: 00007fd89858f6c9
RDX: 0000200000000040 RSI: 0000200000000350 RDI: 0000000002040000
RBP: 00007fd898611f91 R08: 0000200000000380 R09: 0000200000000380
R10: 0000200000000200 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fd8987e6128 R14: 00007fd8987e6090 R15: 00007ffd1d785f48