INFO: task syz.8.958:10603 blocked for more than 145 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.8.958 state:D stack:27944 pid:10603 tgid:10571 ppid:6604 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x73e/0x1570 fs/open.c:962 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x21dc/0x3120 fs/namei.c:4796 do_filp_open+0x1f7/0x420 fs/namei.c:4823 do_sys_openat2+0x12e/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f552f79aeb9 RSP: 002b:00007f5530621028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f552fa16180 RCX: 00007f552f79aeb9 RDX: 0000000000125003 RSI: 00002000000002c0 RDI: ffffffffffffff9c RBP: 00007f552f808c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f552fa16218 R14: 00007f552fa16180 R15: 00007fff479847a8 Showing all locks held in the system: 1 lock held by kthreadd/2: 3 locks held by kworker/0:0/9: 2 locks held by kworker/0:1/10: 4 locks held by kworker/u8:0/12: 3 locks held by kworker/u8:1/13: 3 locks held by kworker/1:0/24: #0: ffff888058489948 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900001e7c98 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff888068d634c0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x30/0xe40 drivers/net/wireguard/noise.c:822 1 lock held by khungtaskd/31: #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 3 locks held by kworker/u8:2/36: 3 locks held by kworker/1:1/43: 3 locks held by kworker/u8:3/50: 4 locks held by kworker/u8:4/68: 1 lock held by kworker/1:2/794: 3 locks held by kworker/u8:5/1033: 1 lock held by aoe_tx0/1297: 3 locks held by kworker/u8:6/2910: 2 locks held by kworker/R-bat_e/3404: 4 locks held by kworker/u8:7/4329: 1 lock held by klogd/5168: 1 lock held by udevd/5179: 3 locks held by crond/5548: 2 locks held by getty/5574: #0: ffff8880323d50a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/5792: 6 locks held by kworker/1:3/5813: 4 locks held by kworker/0:3/5854: #0: ffff8880585f0948 ((wq_completion)wg-kex-wg1#6){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90002ef7c98 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88805e9ad308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff8880560b3ea8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 3 locks held by kworker/1:4/5869: 2 locks held by kworker/1:5/5891: 3 locks held by kworker/0:6/5910: 4 locks held by kworker/u8:8/5983: 3 locks held by kworker/u8:9/6225: 4 locks held by kworker/u8:10/6414: 3 locks held by kworker/u8:11/6528: 3 locks held by syz-executor/6561: 2 locks held by syz-executor/6618: 3 locks held by udevd/6622: 3 locks held by udevd/7581: 4 locks held by kworker/u8:12/8472: 4 locks held by kworker/u8:13/8473: 4 locks held by kworker/u8:14/8474: #0: ffff88805309e148 ((wq_completion)wg-kex-wg1){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000d22fc98 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88802a089308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff888068d634c0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 1 lock held by syz.8.958/10603: #0: ffffffff8f2d41a8 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8f2d41a8 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120 3 locks held by syz.5.965/10596: 3 locks held by dhcpcd-run-hook/10613: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 1297 Comm: aoe_tx0 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 RIP: 0010:ip6_pol_route+0x10e/0x1230 net/ipv6/route.c:2275 Code: e8 27 d8 e1 f7 48 8d bb 38 0d 00 00 83 e5 41 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 48 0f 00 00 <4c> 8b bb 38 0d 00 00 48 b8 00 00 00 00 00 fc ff df 49 8d 7f 0c 48 RSP: 0018:ffffc90000a07c78 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff88805f3e0000 RCX: ffffffff8a252728 RDX: 1ffff1100be7c1a7 RSI: ffffffff8a252339 RDI: ffff88805f3e0d38 RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffc90000a07f90 R13: 1ffff92000140f93 R14: 0000000000000080 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8881246db000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc5043bf40 CR3: 0000000066b08000 CR4: 00000000003526f0 Call Trace: pol_lookup_func include/net/ip6_fib.h:617 [inline] fib6_rule_lookup+0x52f/0x720 net/ipv6/fib6_rules.c:120 ip6_route_input_lookup net/ipv6/route.c:2349 [inline] ip6_route_input+0x662/0xc50 net/ipv6/route.c:2652 ip6_rcv_finish_core.isra.0+0x1a9/0x5a0 net/ipv6/ip6_input.c:66 ip6_rcv_finish+0x130/0x550 net/ipv6/ip6_input.c:77 ip_sabotage_in+0x21e/0x290 net/bridge/br_netfilter_hooks.c:990 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623 nf_hook.constprop.0+0x2a6/0x750 include/linux/netfilter.h:273 NF_HOOK include/linux/netfilter.h:316 [inline] ipv6_rcv+0xa4/0x610 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6152 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6265 netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x139/0x760 net/core/dev.c:6410 NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70 br_handle_frame_finish+0x84f/0x1f00 net/bridge/br_input.c:235 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167 br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184 br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0xa68/0x1510 net/bridge/br_input.c:442 __netif_receive_skb_core.constprop.0+0x6d7/0x3460 net/core/dev.c:6039 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6150 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6265 process_backlog+0x37a/0x1580 net/core/dev.c:6617 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0xa40/0xf20 net/core/dev.c:7896 handle_softirqs+0x1ea/0x910 kernel/softirq.c:622 do_softirq kernel/softirq.c:523 [inline] do_softirq+0xac/0xe0 kernel/softirq.c:510 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:936 [inline] __dev_queue_xmit+0x7f1/0x46f0 net/core/dev.c:4859 dev_queue_xmit include/linux/netdevice.h:3381 [inline] tx+0xc4/0x130 drivers/block/aoe/aoenet.c:62 kthread+0x1d8/0x3c0 drivers/block/aoe/aoecmd.c:1241 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246