INFO: task syz.4.978:10794 blocked for more than 143 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.978 state:D stack:25736 pid:10794 tgid:10793 ppid:7214 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 nfsd_umount+0x3b/0x60 fs/nfsd/nfsctl.c:1353 deactivate_locked_super+0xc1/0x1b0 fs/super.c:474 deactivate_super fs/super.c:507 [inline] deactivate_super+0xe7/0x110 fs/super.c:503 cleanup_mnt+0x21f/0x450 fs/namespace.c:1318 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x100/0x4b0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ea/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8a0059aeb9 RSP: 002b:00007f8a0144f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: fffffffffffffffe RBX: 00007f8a00815fa0 RCX: 00007f8a0059aeb9 RDX: 0000200000000140 RSI: 00002000000000c0 RDI: 0000000000000000 RBP: 00007f8a00608c1f R08: 0000000000000000 R09: 0000000000000000 R10: 000000000000000f R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8a00816038 R14: 00007f8a00815fa0 R15: 00007fff6945eb28 INFO: task syz.2.985:10817 blocked for more than 143 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.985 state:D stack:26440 pid:10817 tgid:10816 ppid:5822 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 nfsd_umount+0x3b/0x60 fs/nfsd/nfsctl.c:1353 deactivate_locked_super+0xc1/0x1b0 fs/super.c:474 deactivate_super fs/super.c:507 [inline] deactivate_super+0xe7/0x110 fs/super.c:503 cleanup_mnt+0x21f/0x450 fs/namespace.c:1318 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0x100/0x4b0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x4ea/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fec68b9aeb9 RSP: 002b:00007fec69aca028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: fffffffffffffffe RBX: 00007fec68e15fa0 RCX: 00007fec68b9aeb9 RDX: 0000200000000080 RSI: 0000200000000040 RDI: 0000000000000000 RBP: 00007fec68c08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000007 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fec68e16038 R14: 00007fec68e15fa0 R15: 00007fff9c31cfb8 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 2 locks held by syz-executor/5823: #0: ffff88807f84c0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88807f84c0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88807f84c0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff88807f84c0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz.1.949/10651: #0: ffffffff904a2690 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x687/0xbc0 fs/nfsd/nfsctl.c:1596 2 locks held by syz.4.978/10794: #0: ffff88807b5760e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88807b5760e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88807b5760e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff88807b5760e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz.2.985/10817: #0: ffff888033d6a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff888033d6a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff888033d6a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff888033d6a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/10894: #0: ffff8880592f60e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff8880592f60e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff8880592f60e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff8880592f60e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/10984: #0: ffff8880298360e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff8880298360e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff8880298360e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff8880298360e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/10994: #0: ffff8880679600e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff8880679600e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff8880679600e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff8880679600e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/11289: #0: ffff88805c9ce0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88805c9ce0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88805c9ce0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff88805c9ce0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/11335: #0: ffff8880410320e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff8880410320e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff8880410320e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff8880410320e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz.0.1105/11578: #0: ffffffff904a2690 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x687/0xbc0 fs/nfsd/nfsctl.c:1596 2 locks held by syz-executor/11811: #0: ffff8880623920e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff8880623920e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff8880623920e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff8880623920e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/11844: #0: ffff88804d0740e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88804d0740e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88804d0740e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff88804d0740e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/12100: #0: ffff88804341a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88804341a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88804341a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff88804341a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/12148: #0: ffff88802b44a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88802b44a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88802b44a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff88802b44a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz-executor/12286: #0: ffff88807be8a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88807be8a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88807be8a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super fs/super.c:506 [inline] #0: ffff88807be8a0e0 (&type->s_umount_key#52){+.+.}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575 2 locks held by syz.7.1260/12499: #0: ffffffff904a2690 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8ea472a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x687/0xbc0 fs/nfsd/nfsctl.c:1596 2 locks held by syz-executor/12721: #0: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3436 #1: ffffffff8e5ef8f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 8893 Comm: kworker/u10:16 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1091 [inline] RIP: 0010:debug_check_no_obj_freed+0x222/0x630 lib/debugobjects.c:1129 Code: 03 89 f3 42 80 3c 22 00 0f 85 dd 00 00 00 48 8d 78 18 83 c3 01 4c 8b 30 48 89 fa 48 c1 ea 03 42 80 3c 22 00 0f 85 27 03 00 00 <48> 8b 50 18 4c 39 ea 0f 82 cb 00 00 00 4c 39 fa 0f 83 c2 00 00 00 RSP: 0018:ffffc90011c6ef30 EFLAGS: 00000046 RAX: ffff8880800f8428 RBX: 000000000000000b RCX: ffffffff81e2d6c8 RDX: 1ffff1101001f088 RSI: 0000000000000000 RDI: ffff8880800f8440 RBP: ffffc90011c6f060 R08: 0000000000000001 R09: fffff5200238ddd4 R10: 0000000000000003 R11: 0000000000000000 R12: dffffc0000000000 R13: ffff8880988dc800 R14: ffff8880800f8c78 R15: ffff8880988dcc00 FS: 0000000000000000(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555ab749a000 CR3: 000000000e392000 CR4: 00000000003526f0 Call Trace: slab_free_hook mm/slub.c:2471 [inline] slab_free mm/slub.c:6674 [inline] kfree+0x34c/0x690 mm/slub.c:6882 ieee80211_inform_bss+0x8d5/0x1150 net/mac80211/scan.c:164 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline] cfg80211_inform_single_bss_data+0x898/0x1d40 net/wireless/scan.c:2373 cfg80211_inform_bss_data+0x230/0x39f0 net/wireless/scan.c:3228 cfg80211_inform_bss_frame_data+0x247/0x730 net/wireless/scan.c:3319 ieee80211_bss_info_update+0x310/0xab0 net/mac80211/scan.c:230 ieee80211_rx_bss_info net/mac80211/ibss.c:1094 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1575 [inline] ieee80211_ibss_rx_queued_mgmt+0x1919/0x2f30 net/mac80211/ibss.c:1602 ieee80211_iface_process_skb net/mac80211/iface.c:1740 [inline] ieee80211_iface_work+0xbf1/0x1350 net/mac80211/iface.c:1794 cfg80211_wiphy_work+0x3f7/0x560 net/wireless/core.c:438 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246