INFO: task kworker/u4:6:4333 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:6 state:D stack:23312 pid:4333 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __synchronize_srcu+0x2b9/0x350 kernel/rcu/srcutree.c:1243 fsnotify_mark_destroy_workfn+0x106/0x2f0 fs/notify/mark.c:924 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:15:4461 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:15 state:D stack:22928 pid:4461 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __synchronize_srcu+0x2b9/0x350 kernel/rcu/srcutree.c:1243 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:3:7383 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:3 state:D stack:23152 pid:7383 ppid:2 flags:0x00004000 Workqueue: events_unbound bpf_map_free_deferred Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 sock_hash_free+0x89/0x7d0 net/core/sock_map.c:1146 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz.4.1335:8864 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.1335 state:D stack:24528 pid:8864 ppid:4280 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 kthread_stop+0x197/0x650 kernel/kthread.c:711 kvm_destroy_vm virt/kvm/kvm_main.c:1310 [inline] kvm_put_kvm+0x325/0x1950 virt/kvm/kvm_main.c:1370 kvm_vm_release+0x42/0x50 virt/kvm/kvm_main.c:1393 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x982/0x2480 kernel/exit.c:881 do_group_exit+0x217/0x2d0 kernel/exit.c:1023 get_signal+0x1272/0x1350 kernel/signal.c:2871 arch_do_signal_or_restart+0xc4/0x1350 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f2a1299ce59 RSP: 002b:00007f2a10bf6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000009 RBX: 00007f2a12c16090 RCX: 00007f2a1299ce59 RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000008 RBP: 00007f2a12a32d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2a12c16128 R14: 00007f2a12c16090 R15: 00007ffce0384d58 INFO: task kvm-nx-lpage-re:8868 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kvm-nx-lpage-re state:D stack:28752 pid:8868 ppid:2 flags:0x00024000 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 synchronize_rcu_expedited+0x6e6/0x890 kernel/rcu/tree_exp.h:977 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 rcu_sync_enter+0x221/0x350 kernel/rcu/sync.c:149 percpu_down_write+0x69/0x2f0 kernel/locking/percpu-rwsem.c:231 cgroup_attach_task_all+0x2c/0xe0 kernel/cgroup/cgroup-v1.c:62 kvm_vm_worker_thread+0x38a/0x540 virt/kvm/kvm_main.c:6127 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz.1.1338:8871 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.1338 state:D stack:26224 pid:8871 ppid:4284 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 nft_rcv_nl_event+0x40f/0x5c0 net/netfilter/nf_tables_api.c:10853 notifier_call_chain kernel/notifier.c:87 [inline] blocking_notifier_call_chain+0x103/0x1b0 kernel/notifier.c:382 netlink_release+0x112a/0x19e0 net/netlink/af_netlink.c:766 __sock_release net/socket.c:654 [inline] sock_close+0xd5/0x240 net/socket.c:1399 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f353039ce59 RSP: 002b:00007ffe27ce8858 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f3530617da0 RCX: 00007f353039ce59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f3530617da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007f3530617cb0 R11: 0000000000000246 R12: 0000000000099d52 R13: 00007f3530615fac R14: 0000000000099ac4 R15: 00007ffe27ce8960 INFO: task syz.2.1341:8885 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.1341 state:D stack:25680 pid:8885 ppid:4282 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 __nf_tables_abort net/netfilter/nf_tables_api.c:10190 [inline] nf_tables_abort+0x54d4/0x6510 net/netfilter/nf_tables_api.c:10209 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:585 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:639 [inline] nfnetlink_rcv+0x1d15/0x2480 net/netfilter/nfnetlink.c:657 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ad/0xbd0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x5be/0x970 net/socket.c:2518 ___sys_sendmsg+0x2a2/0x360 net/socket.c:2572 __sys_sendmsg net/socket.c:2601 [inline] __do_sys_sendmsg net/socket.c:2610 [inline] __se_sys_sendmsg+0x1bb/0x2a0 net/socket.c:2608 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f1dd9b9ce59 RSP: 002b:00007f1ddaa0f028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f1dd9e15fa0 RCX: 00007f1dd9b9ce59 RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000008 RBP: 00007f1dd9c32d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1dd9e16038 R14: 00007f1dd9e15fa0 R15: 00007ffe4365a9a8 INFO: task syz.2.1341:8886 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.1341 state:D stack:26864 pid:8886 ppid:4282 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 nf_tables_valid_genid+0x37/0x100 net/netfilter/nf_tables_api.c:10232 nfnetlink_rcv_batch net/netfilter/nfnetlink.c:421 [inline] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:639 [inline] nfnetlink_rcv+0x8bf/0x2480 net/netfilter/nfnetlink.c:657 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ad/0xbd0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x5be/0x970 net/socket.c:2518 ___sys_sendmsg+0x2a2/0x360 net/socket.c:2572 __sys_sendmsg net/socket.c:2601 [inline] __do_sys_sendmsg net/socket.c:2610 [inline] __se_sys_sendmsg+0x1bb/0x2a0 net/socket.c:2608 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f1dd9b9ce59 RSP: 002b:00007f1dda9ee028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f1dd9e16090 RCX: 00007f1dd9b9ce59 RDX: 0000000000000040 RSI: 0000200000009b40 RDI: 0000000000000008 RBP: 00007f1dd9c32d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1dd9e16128 R14: 00007f1dd9e16090 R15: 00007ffe4365a9a8 INFO: task dhcpcd:8891 blocked for more than 147 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:24944 pid:8891 ppid:3932 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 __unregister_prot_hook+0x3f7/0x570 net/packet/af_packet.c:383 packet_do_bind+0x519/0xce0 net/packet/af_packet.c:3285 __sys_bind+0x2e9/0x3e0 net/socket.c:1810 __do_sys_bind net/socket.c:1821 [inline] __se_sys_bind net/socket.c:1819 [inline] __x64_sys_bind+0x76/0x80 net/socket.c:1819 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f0ac650e2d7 RSP: 002b:00007fffb01ebdb8 EFLAGS: 00000213 ORIG_RAX: 0000000000000031 RAX: ffffffffffffffda RBX: 000055bf0eb621f0 RCX: 00007f0ac650e2d7 RDX: 0000000000000014 RSI: 00007fffb01ebdd0 RDI: 0000000000000003 RBP: 000055bef8c3b4b0 R08: 00007f0ac65ddac0 R09: 0000000000000000 R10: 0000000000000002 R11: 0000000000000213 R12: 0000000000000000 R13: 000055bf0eb5a830 R14: 0000000000000000 R15: 000055bef8c50ac0 INFO: task syz.0.1343:8892 blocked for more than 147 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.1343 state:D stack:23952 pid:8892 ppid:4274 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __flush_workqueue+0x65e/0x13c0 kernel/workqueue.c:2864 rxrpc_release_sock net/rxrpc/af_rxrpc.c:882 [inline] rxrpc_release+0x284/0x440 net/rxrpc/af_rxrpc.c:912 __sock_release net/socket.c:654 [inline] sock_close+0xd5/0x240 net/socket.c:1399 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f41f979ce59 RSP: 002b:00007ffd78c31f18 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f41f9a17da0 RCX: 00007f41f979ce59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f41f9a17da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007f41f9a17cb0 R11: 0000000000000246 R12: 000000000009a1de R13: 00007f41f9a1627c R14: 0000000000099fa6 R15: 00007f41f9a16270 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8cb2e770 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8cb2ef90 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by khungtaskd/27: #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513 1 lock held by syslogd/3619: 2 locks held by getty/4027: #0: ffff88814d1e4098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x429/0x1390 drivers/tty/n_tty.c:2198 2 locks held by kworker/0:5/4319: 3 locks held by kworker/1:5/4324: #0: ffff88802f026d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004137d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4672 2 locks held by kworker/u4:6/4333: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc900044a7d00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 3 locks held by kworker/u4:13/4430: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc9000484fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263 2 locks held by kworker/u4:15/4461: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004a07d00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 3 locks held by kworker/u4:19/4787: 1 lock held by syz.0.346/5579: #0: ffffffff8d8337a8 (input_mutex){+.+.}-{3:3}, at: __input_unregister_device+0x2ee/0x5f0 drivers/input/input.c:2293 1 lock held by syz.1.371/5676: #0: ffffffff8d8337a8 (input_mutex){+.+.}-{3:3}, at: __input_unregister_device+0x2ee/0x5f0 drivers/input/input.c:2293 2 locks held by kworker/u4:3/7383: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc900036ffd00 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 4 locks held by kvm-nx-lpage-re/8868: #0: ffffffff8cb56868 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:442 [inline] #0: ffffffff8cb56868 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_attach_task_all+0x22/0xe0 kernel/cgroup/cgroup-v1.c:61 #1: ffffffff8c9ca6b0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_attach_lock+0xd/0x30 kernel/cgroup/cgroup.c:2476 #2: ffffffff8cb56a50 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_attach_task_all+0x2c/0xe0 kernel/cgroup/cgroup-v1.c:62 #3: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #3: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962 3 locks held by syz.1.1338/8871: #0: ffff88807432e210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88807432e210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff88807432e210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1399 #1: ffffffff8dda6eb0 ((netlink_chain).rwsem){++++}-{3:3}, at: blocking_notifier_call_chain+0x5e/0x1b0 kernel/notifier.c:381 #2: ffff88807da6a0b8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nft_rcv_nl_event+0x126/0x5c0 net/netfilter/nf_tables_api.c:10835 3 locks held by syz.2.1341/8884: #0: ffff888074276210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff888074276210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff888074276210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1399 #1: ffffffff8dda6eb0 ((netlink_chain).rwsem){++++}-{3:3}, at: blocking_notifier_call_chain+0x5e/0x1b0 kernel/notifier.c:381 #2: ffff88802f0642b8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nft_rcv_nl_event+0x126/0x5c0 net/netfilter/nf_tables_api.c:10835 2 locks held by syz.2.1341/8885: #0: ffff88802f0642b8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid+0x37/0x100 net/netfilter/nf_tables_api.c:10232 #1: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #1: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 2 locks held by syz.2.1341/8886: #0: ffffffff97024298 (nfnl_subsys_nftables){+.+.}-{3:3}, at: nfnl_lock net/netfilter/nfnetlink.c:98 [inline] #0: ffffffff97024298 (nfnl_subsys_nftables){+.+.}-{3:3}, at: nfnetlink_rcv_batch net/netfilter/nfnetlink.c:392 [inline] #0: ffffffff97024298 (nfnl_subsys_nftables){+.+.}-{3:3}, at: nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:639 [inline] #0: ffffffff97024298 (nfnl_subsys_nftables){+.+.}-{3:3}, at: nfnetlink_rcv+0x648/0x2480 net/netfilter/nfnetlink.c:657 #1: ffff88802f0642b8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid+0x37/0x100 net/netfilter/nf_tables_api.c:10232 1 lock held by dhcpcd/8891: #0: ffff888029352130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888029352130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by syz.0.1343/8892: #0: ffff88807176f410 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88807176f410 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff88807176f410 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1399 1 lock held by syz.0.1343/8895: #0: ffff88804b690070 (&dev->mutex#5){+.+.}-{3:3}, at: vhost_net_set_owner drivers/vhost/net.c:1681 [inline] #0: ffff88804b690070 (&dev->mutex#5){+.+.}-{3:3}, at: vhost_net_ioctl+0x18b/0x12a0 drivers/vhost/net.c:1739 1 lock held by syz.0.1343/8897: #0: ffff88804b690070 (&dev->mutex#5){+.+.}-{3:3}, at: vhost_net_ioctl+0x22f/0x12a0 drivers/vhost/net.c:1741 1 lock held by dhcpcd/8894: #0: ffff888143f4e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888143f4e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by vhost-8895/8896: #0: ffffffff8cb56868 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:442 [inline] #0: ffffffff8cb56868 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_attach_task_all+0x22/0xe0 kernel/cgroup/cgroup-v1.c:61 1 lock held by dhcpcd/8899: #0: ffff88807d050130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88807d050130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/8900: #0: ffff888074e00130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888074e00130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by syz.3.1346/8908: #0: ffff8880256a8210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff8880256a8210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff8880256a8210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1399 1 lock held by syz-executor/8913: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8925: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8929: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8931: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8934: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8937: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8943: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8946: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8949: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8952: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8955: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8959: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8963: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8966: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/8969: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xeee/0xf30 kernel/hung_task.c:377 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4319 Comm: kworker/0:5 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: events p9_poll_workfn RIP: 0010:task_irq_context kernel/locking/lockdep.c:4558 [inline] RIP: 0010:__lock_acquire+0x483/0x7d10 kernel/locking/lockdep.c:4987 Code: 8b 84 24 88 00 00 00 4c 8d b0 c4 0a 00 00 4c 89 f0 48 c1 e8 03 48 89 84 24 d0 00 00 00 42 0f b6 04 00 84 c0 0f 85 11 63 00 00 <31> c0 4c 89 b4 24 b8 00 00 00 41 83 3e 00 0f 95 c0 09 c3 c1 e3 0d RSP: 0018:ffffc900040e7760 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff11005820c97 RDX: 0000000000000e20 RSI: 0000000000000000 RDI: ffff88802c1064a8 RBP: ffffc900040e79b0 R08: dffffc0000000000 R09: 0000000000000001 R10: dffffc0000000000 R11: fffffbfff1c3ff7e R12: ffff88802c106498 R13: 0000000000000000 R14: ffff88802c106404 R15: 0000000000000e20 FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005602c621a000 CR3: 000000007e79f000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5662 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline] _raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170 spin_lock_irq include/linux/spinlock.h:376 [inline] dma_buf_poll+0x384/0x680 drivers/dma-buf/dma-buf.c:284 vfs_poll include/linux/poll.h:92 [inline] p9_fd_poll net/9p/trans_fd.c:238 [inline] p9_poll_mux net/9p/trans_fd.c:630 [inline] p9_poll_workfn+0x35b/0x5a0 net/9p/trans_fd.c:1174 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295