INFO: task syz-executor:11176 blocked for more than 143 seconds.
Tainted: G U L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:23800 pid:11176 tgid:11176 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x125c/0x6730 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7326
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0xccc/0x1bd0 kernel/locking/mutex.c:821
nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:576
nfsd_umount+0x3b/0x60 fs/nfsd/nfsctl.c:1365
deactivate_locked_super+0xc1/0x1b0 fs/super.c:477
deactivate_super fs/super.c:510 [inline]
deactivate_super+0xe7/0x110 fs/super.c:506
cleanup_mnt+0x21f/0x450 fs/namespace.c:1317
task_work_run+0x150/0x240 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
exit_to_user_mode_loop+0x1d8/0x6f0 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
do_syscall_64+0x652/0x840 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb89e79f097
RSP: 002b:00007ffef140f178 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007fb89e8332ca RCX: 00007fb89e79f097
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffef140f230
RBP: 00007ffef140f230 R08: 00007ffef1410230 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffef14102c0
R13: 00007fb89e8332ca R14: 000000000006ea7f R15: 00007ffef1410300
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8ebe5f00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8ebe5f00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8ebe5f00 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
2 locks held by getty/5384:
#0: ffff888037c860a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
1 lock held by syz-executor/5615:
#0: ffff8880b843b660 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:675 [inline]
#0: ffff8880b843b660 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 kernel/sched/core.c:659
2 locks held by udevd/5628:
2 locks held by syz-executor/5632:
#0: ffff88802ac680d8 (&type->s_umount_key#51){++++}-{4:4}, at: __super_lock fs/super.c:58 [inline]
#0: ffff88802ac680d8 (&type->s_umount_key#51){++++}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline]
#0: ffff88802ac680d8 (&type->s_umount_key#51){++++}-{4:4}, at: deactivate_super fs/super.c:509 [inline]
#0: ffff88802ac680d8 (&type->s_umount_key#51){++++}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:506
#1: ffffffff8f06f1e0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:576
4 locks held by kworker/1:4/5715:
#0: ffff88801bc72d40 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
#1: ffffc90004557d08 ((work_completion)(&(&ssp->srcu_sup->work)->work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
#2: ffffffff8ec75008 (&ssp->srcu_sup->srcu_gp_mutex){+.+.}-{4:4}, at: srcu_advance_state kernel/rcu/srcutree.c:1813 [inline]
#2: ffffffff8ec75008 (&ssp->srcu_sup->srcu_gp_mutex){+.+.}-{4:4}, at: process_srcu+0x77/0x20f0 kernel/rcu/srcutree.c:1973
#3: ffffffff8ebf19a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
2 locks held by syz-executor/8090:
#0: ffff88805d0e00d8 (&type->s_umount_key#51){++++}-{4:4}, at: __super_lock fs/super.c:58 [inline]
#0: ffff88805d0e00d8 (&type->s_umount_key#51){++++}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline]
#0: ffff88805d0e00d8 (&type->s_umount_key#51){++++}-{4:4}, at: deactivate_super fs/super.c:509 [inline]
#0: ffff88805d0e00d8 (&type->s_umount_key#51){++++}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:506
#1: ffffffff8f06f1e0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:576
2 locks held by kworker/u11:1/9312:
#0: ffff88801f7e3140 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
#1: ffffc90006e9fd08 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
2 locks held by syz.2.1017/10857:
#0: ffffffff90b4cf88 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217
#1: ffffffff8f06f1e0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x8c8/0x1100 fs/nfsd/nfsctl.c:1660
2 locks held by syz-executor/11176:
#0: ffff8880374d00d8 (&type->s_umount_key#51){++++}-{4:4}, at: __super_lock fs/super.c:58 [inline]
#0: ffff8880374d00d8 (&type->s_umount_key#51){++++}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline]
#0: ffff8880374d00d8 (&type->s_umount_key#51){++++}-{4:4}, at: deactivate_super fs/super.c:509 [inline]
#0: ffff8880374d00d8 (&type->s_umount_key#51){++++}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:506
#1: ffffffff8f06f1e0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:576
2 locks held by kworker/0:0/11292:
4 locks held by kworker/u11:10/11687:
#0: ffff88801caf6140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
#1: ffffc9000554fd08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
#2: ffffffff90a85768 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:673
#3: ffffffff90a9e380 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
#3: ffffffff90a9e380 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
2 locks held by syz.3.1571/13747:
#0: ffffffff90a85768 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:575
#1: ffffffff90a9e380 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
#1: ffffffff90a9e380 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
3 locks held by syz.6.1575/13760:
#0: ffff888028e72de8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_debugfs_lock_nomemsave block/blk.h:787 [inline]
#0: ffff888028e72de8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_debugfs_lock block/blk.h:801 [inline]
#0: ffff888028e72de8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0x1f2/0x440 kernel/trace/blktrace.c:788
#1: ffffffff8ec8a600 (blk_probe_mutex){+.+.}-{4:4}, at: get_probe_ref kernel/trace/blktrace.c:490 [inline]
#1: ffffffff8ec8a600 (blk_probe_mutex){+.+.}-{4:4}, at: blk_trace_setup_finalize+0x2db/0x3a0 kernel/trace/blktrace.c:759
#2: ffffffff8ec74ce0 (tracepoints_mutex){+.+.}-{4:4}, at: tracepoint_probe_register_prio kernel/tracepoint.c:471 [inline]
#2: ffffffff8ec74ce0 (tracepoints_mutex){+.+.}-{4:4}, at: tracepoint_probe_register+0x9d/0x110 kernel/tracepoint.c:495
1 lock held by syz.6.1575/13761:
#0: ffff888028e72de8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_debugfs_lock_nomemsave block/blk.h:787 [inline]
#0: ffff888028e72de8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:561 [inline]
#0: ffff888028e72de8 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x263/0x320 kernel/trace/blktrace.c:952
3 locks held by syz.6.1575/13762:
#0: ffff88801c3ac450 (sb_writers#14){.+.+}-{0:0}, at: do_open fs/namei.c:4693 [inline]
#0: ffff88801c3ac450 (sb_writers#14){.+.+}-{0:0}, at: path_openat+0x2929/0x4280 fs/namei.c:4863
#1: ffffffff8ec8d6c0 (event_mutex){+.+.}-{4:4}, at: ftrace_clear_events kernel/trace/trace_events.c:1028 [inline]
#1: ffffffff8ec8d6c0 (event_mutex){+.+.}-{4:4}, at: ftrace_event_set_open+0x1ec/0x380 kernel/trace/trace_events.c:2801
#2: ffffffff8ec74ce0 (tracepoints_mutex){+.+.}-{4:4}, at: tracepoint_probe_unregister+0x31/0xd10 kernel/tracepoint.c:512
2 locks held by syz.6.1575/13763:
#0: ffffffff90a85768 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:575
#1: ffffffff8ebf19a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
1 lock held by syz.6.1575/13765:
#0: ffffffff90a85768 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:575
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G U L syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x21c/0x2a0 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xcb1/0x1030 kernel/hung_task.c:561
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 11687 Comm: kworker/u11:10 Tainted: G U L syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: netns cleanup_net
RIP: 0010:schedule_debug kernel/sched/core.c:6073 [inline]
RIP: 0010:__schedule+0x187/0x6730 kernel/sched/core.c:7083
Code: b3 58 00 00 48 8b 85 70 ff ff ff 4c 8b 60 20 48 b8 00 00 00 00 00 fc ff df 4c 89 e2 48 c1 ea 03 80 3c 02 00 0f 85 80 58 00 00 <49> 81 3c 24 9d 6e ac 57 0f 85 7f 65 00 00 48 8b 85 70 ff ff ff 48
RSP: 0018:ffffc9000554f460 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff8bb7566f
RDX: 1ffff92000aa9000 RSI: ffffffff8c400300 RDI: ffff8880227cbe20
RBP: ffffc9000554f5b8 R08: 0000000000000000 R09: fffffbfff2244b92
R10: ffffffff91225c97 R11: 0000000000000000 R12: ffffc90005548000
R13: 0000000000000001 R14: 0000000000000000 R15: ffff8880b843b600
FS: 0000000000000000(0000) GS:ffff888123df2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555efff4e8 CR3: 000000007a690000 CR4: 00000000003526f0
Call Trace:
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7556
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x205/0xa00 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:kernfs_root+0x6b/0x2a0 fs/kernfs/kernfs-internal.h:77
Code: dc 4c ff 58 85 db 0f 85 b7 00 00 00 e8 5e e2 4c ff 48 8d 7d 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 24 02 00 00 48 8b 5d 30 e8 06 38 fa 08 31 ff 41 89 c4 89 c6
RSP: 0018:ffffc9000554f6d8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff82bc4ac9
RDX: 1ffff1100ef17406 RSI: ffffffff82bc4a02 RDI: ffff8880778ba030
RBP: ffff8880778ba000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff8880778ba000
R13: 0000000000000001 R14: dffffc0000000000 R15: ffff8880778ba000
kernfs_root_is_locked fs/kernfs/kernfs-internal.h:110 [inline]
kernfs_parent fs/kernfs/kernfs-internal.h:134 [inline]
__kernfs_remove+0x648/0xb80 fs/kernfs/dir.c:1580
kernfs_remove fs/kernfs/dir.c:1624 [inline]
kernfs_remove+0x4b/0x70 fs/kernfs/dir.c:1613
sysfs_remove_group+0xb9/0x1b0 fs/sysfs/group.c:330
sysfs_remove_groups fs/sysfs/group.c:352 [inline]
sysfs_remove_groups+0x60/0xb0 fs/sysfs/group.c:344
device_remove_groups drivers/base/core.c:2914 [inline]
device_remove_attrs+0x192/0x290 drivers/base/core.c:3044
device_del+0x36e/0x9b0 drivers/base/core.c:3960
unregister_netdevice_many_notify+0x14fb/0x2140 net/core/dev.c:12473
ops_exit_rtnl_list net/core/net_namespace.c:187 [inline]
ops_undo_list+0x8ff/0xab0 net/core/net_namespace.c:248
cleanup_net+0x499/0x920 net/core/net_namespace.c:702
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245