INFO: task syz.5.3310:18429 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.3310 state:D stack:25176 pid:18429 tgid:18428 ppid:12322 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5388 [inline]
__schedule+0x1295/0x67a0 kernel/sched/core.c:7189
__schedule_loop kernel/sched/core.c:7268 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7283
schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
__flush_work+0x7c7/0xcb0 kernel/workqueue.c:4366
p9_mux_poll_stop net/9p/trans_fd.c:140 [inline]
p9_conn_destroy net/9p/trans_fd.c:804 [inline]
p9_fd_close+0x299/0x5a0 net/9p/trans_fd.c:840
p9_client_create+0x678/0xd40 net/9p/client.c:937
v9fs_session_init+0x3c/0xd20 fs/9p/v9fs.c:446
v9fs_get_tree+0xb8/0xb50 fs/9p/vfs_super.c:97
vfs_get_tree+0x92/0x320 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount fs/namespace.c:3834 [inline]
path_mount+0x7d0/0x23d0 fs/namespace.c:4154
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount fs/namespace.c:4360 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:4360
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3714d9ce59
RSP: 002b:00007f3715bf4028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f3715015fa0 RCX: 00007f3714d9ce59
RDX: 0000200000000300 RSI: 0000200000000040 RDI: 0000000000000000
RBP: 00007f3714e32d6f R08: 00002000000004c0 R09: 0000000000000000
R10: 0000000000000084 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3715016038 R14: 00007f3715015fa0 R15: 00007ffcb44ac068
INFO: task syz.6.3359:18680 blocked for more than 144 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.3359 state:D stack:27896 pid:18680 tgid:18678 ppid:12315 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5388 [inline]
__schedule+0x1295/0x67a0 kernel/sched/core.c:7189
__schedule_loop kernel/sched/core.c:7268 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:7283
schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2e7/0x4c0 kernel/sched/completion.c:121
__flush_work+0x7c7/0xcb0 kernel/workqueue.c:4366
p9_mux_poll_stop net/9p/trans_fd.c:140 [inline]
p9_conn_destroy net/9p/trans_fd.c:804 [inline]
p9_fd_close+0x299/0x5a0 net/9p/trans_fd.c:840
p9_client_create+0x678/0xd40 net/9p/client.c:937
v9fs_session_init+0x3c/0xd20 fs/9p/v9fs.c:446
v9fs_get_tree+0xb8/0xb50 fs/9p/vfs_super.c:97
vfs_get_tree+0x92/0x320 fs/super.c:1754
fc_mount fs/namespace.c:1193 [inline]
do_new_mount_fc fs/namespace.c:3758 [inline]
do_new_mount fs/namespace.c:3834 [inline]
path_mount+0x7d0/0x23d0 fs/namespace.c:4154
do_mount fs/namespace.c:4167 [inline]
__do_sys_mount fs/namespace.c:4383 [inline]
__se_sys_mount fs/namespace.c:4360 [inline]
__x64_sys_mount+0x293/0x310 fs/namespace.c:4360
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f41ac99ce59
RSP: 002b:00007f41ad87b028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f41acc15fa0 RCX: 00007f41ac99ce59
RDX: 0000200000000040 RSI: 0000200000000000 RDI: 0000000000000000
RBP: 00007f41aca32d6f R08: 0000200000000280 R09: 0000000000000000
R10: 0000000000200000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f41acc16038 R14: 00007f41acc15fa0 R15: 00007fff8e4fa1c8
Showing all locks held in the system:
1 lock held by pool_workqueue_/3:
#0: ffffffff8e7f12e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
1 lock held by khungtaskd/30:
#0: ffffffff8e7e57a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e7e57a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8e7e57a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
2 locks held by kworker/1:1/42:
#0: ffff88813fe5b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3289
#1: ffffc90000b27d08 (p9_poll_work){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3290
2 locks held by getty/5365:
#0: ffff8880382900a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14f0 drivers/tty/n_tty.c:2211
2 locks held by kworker/u8:9/5833:
#0: ffff88801e74c940 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3289
#1: ffffc90004cafd08 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3290
4 locks held by udevd/6321:
#0: ffff88804dbfc2d8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183
#1: ffff88807e85c480 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172
#2: ffff88802c3b1a58 (kn->active#27){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88802c3b1a58 (kn->active#27){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173
#3: ffff8880513581d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1045 [inline]
#3: ffff8880513581d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
3 locks held by kworker/u8:10/8682:
#0: ffff8880b843b2a0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:660 [inline]
#0: ffff8880b843b2a0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 kernel/sched/core.c:644
#1: ffff8880b8524648 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:225 [inline]
#1: ffff8880b8524648 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2f15/0x67a0 kernel/sched/core.c:7183
#2: ffff8880b8526358 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x124/0x1d0 kernel/time/timer.c:1004
4 locks held by kworker/0:2/9980:
#0: ffff888022e8c140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12d6/0x1980 kernel/workqueue.c:3289
#1: ffffc9000340fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x973/0x1980 kernel/workqueue.c:3290
#2: ffff88802b6a91d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#2: ffff88802b6a91d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1bd/0x4af0 drivers/usb/core/hub.c:5899
#3: ffff8880513581d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#3: ffff8880513581d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4d0 drivers/base/dd.c:1076
3 locks held by syz.3.3372/18769:
#0: ffff88808a0d0ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:500
#1: ffff88808a0d00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 net/bluetooth/hci_sync.c:5356
#2: ffffffff90894320 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
#2: ffffffff90894320 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 net/bluetooth/hci_conn.c:2734
1 lock held by syz.4.3591/19837:
#0: ffffffff8e7f11b8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6d0 kernel/rcu/tree.c:3828
4 locks held by syz.9.3763/20474:
#0: ffff88807f12cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:500
#1: ffff88807f12c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 net/bluetooth/hci_sync.c:5356
#2: ffffffff90894320 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
#2: ffffffff90894320 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 net/bluetooth/hci_conn.c:2734
#3: ffff888077ca22f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x95/0x710 net/bluetooth/l2cap_core.c:1777
3 locks held by syz-executor/20495:
#0: ffffffff905f4948 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:575
#1: ffffffff9060d6a0 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
#1: ffffffff9060d6a0 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
#2: ffffffff8e7f12e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
1 lock held by syz.7.3770/20512:
#0: ffffffff9060d6a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline]
#0: ffffffff9060d6a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3438
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xcb1/0x1030 kernel/hung_task.c:561
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 1035 Comm: kworker/u8:6 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: krds_cp_wq#5/0 rds_connect_worker
RIP: 0010:__lock_acquire+0x139/0x2630 kernel/locking/lockdep.c:5170
Code: 00 44 39 e8 75 09 4d 85 e4 0f 85 99 05 00 00 48 8b 04 24 44 89 ea 66 81 e2 ff 1f 48 01 c3 0f b7 43 20 4c 89 53 10 4c 89 63 18 <66> 25 00 e0 09 d0 31 d2 66 89 43 20 48 8b 84 24 b0 00 00 00 48 89
RSP: 0018:ffffc9000517f6f8 EFLAGS: 00000082
RAX: 0000000000000007 RBX: ffff888028883158 RCX: 0000000000000005
RDX: 0000000000000007 RSI: ffff888028883130 RDI: ffffffff8e7e57a0
RBP: ffff888028882500 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff8e7e57a0 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000007 R14: 0000000000000002 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff88812436d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c4011ed CR3: 0000000022bf2000 CR4: 00000000003526f0
Call Trace:
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b1/0x370 kernel/locking/lockdep.c:5825
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
__ipv6_chk_addr_and_flags+0x9a/0x750 net/ipv6/addrconf.c:1987
ipv6_chk_addr_and_flags net/ipv6/addrconf.c:2022 [inline]
ipv6_chk_addr+0x3a/0x50 net/ipv6/addrconf.c:1963
__inet6_bind+0x1236/0x1b40 net/ipv6/af_inet6.c:367
inet6_bind_sk net/ipv6/af_inet6.c:449 [inline]
inet6_bind_sk net/ipv6/af_inet6.c:426 [inline]
inet6_bind+0xdb/0x120 net/ipv6/af_inet6.c:455
kernel_bind+0xff/0x160 net/socket.c:3660
rds_tcp_conn_path_connect+0x554/0xaa0 net/rds/tcp_connect.c:175
rds_connect_worker+0x1b4/0x2d0 net/rds/threads.c:176
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3314
process_scheduled_works kernel/workqueue.c:3397 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3478
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245