INFO: task syz.8.280:8458 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.8.280 state:D stack:26760 pid:8458 tgid:8458 ppid:7440 task_flags:0x440040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x16f3/0x4c20 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7307 rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline] __rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline] __rt_mutex_slowlock_locked+0x1e04/0x25e0 kernel/locking/rtmutex.c:1760 __rwbase_read_lock+0xbc/0x180 kernel/locking/rwbase_rt.c:114 rwbase_read_lock kernel/locking/rwbase_rt.c:147 [inline] __down_read kernel/locking/rwsem.c:1466 [inline] down_read+0x127/0x1f0 kernel/locking/rwsem.c:1539 filemap_invalidate_lock_shared include/linux/fs.h:1045 [inline] page_cache_ra_unbounded+0x1a3/0x8e0 mm/readahead.c:233 do_sync_mmap_readahead+0x554/0x670 mm/filemap.c:3340 filemap_fault+0x6c2/0x12c0 mm/filemap.c:3489 __do_fault+0x138/0x390 mm/memory.c:5281 do_shared_fault mm/memory.c:5780 [inline] do_fault mm/memory.c:5854 [inline] do_pte_missing mm/memory.c:4362 [inline] handle_pte_fault mm/memory.c:6195 [inline] __handle_mm_fault mm/memory.c:6336 [inline] handle_mm_fault+0x117f/0x3400 mm/memory.c:6505 do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x82/0x100 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618 RIP: 0033:0x7f1fac457398 RSP: 002b:00007fff9789bdb8 EFLAGS: 00010246 RAX: 00002000000000c0 RBX: 0000000000000004 RCX: 00303636396f7369 RDX: 0000000000000008 RSI: 00303636396f7369 RDI: 00002000000000c0 RBP: 00007f1fac6e7da0 R08: 0000001b2cf20000 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000009 R12: 00007f1fac6e5fac R13: 00007f1fac6e5fa0 R14: fffffffffffffffe R15: 00007fff9789bed0 Showing all locks held in the system: 2 locks held by kworker/u8:1/13: #0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346 #1: ffffc90000127ba0 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc90000127ba0 ((reaper_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346 1 lock held by khungtaskd/38: #0: ffffffff8d5aa880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8d5aa880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8d5aa880 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 4 locks held by kworker/u8:2/43: 3 locks held by kworker/u8:3/58: #0: ffff8880302c2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff8880302c2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346 #1: ffffc9000124fba0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc9000124fba0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346 #2: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x119/0x15a0 net/ipv6/addrconf.c:4194 3 locks held by kworker/u8:4/68: #0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346 #1: ffffc9000153fba0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc9000153fba0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346 #2: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303 2 locks held by kworker/u8:8/1435: #0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346 #1: ffffc90005447ba0 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc90005447ba0 (connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346 2 locks held by dhcpcd/5461: #0: ffffffff8e8ca520 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: nl80211_pre_doit+0x5f/0x930 net/wireless/nl80211.c:17926 2 locks held by getty/5555: #0: ffff88823bf488a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90003e862e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222 2 locks held by kworker/1:3/5809: #0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346 #1: ffffc90004be7ba0 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc90004be7ba0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346 3 locks held by kworker/0:4/5876: #0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346 #1: ffffc900050a7ba0 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc900050a7ba0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346 #2: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104 5 locks held by udevd/7709: 4 locks held by syz-executor/8147: #0: ffff888023cf8e88 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:499 [inline] #0: ffff888023cf8e88 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510 net/bluetooth/hci_core.c:2715 #1: ffff888023cf80a8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330 net/bluetooth/hci_sync.c:5296 #2: ffffffff8e9cc2f8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2126 [inline] #2: ffffffff8e9cc2f8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230 net/bluetooth/hci_conn.c:2614 #3: ffff888055230b58 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680 net/bluetooth/l2cap_core.c:1763 2 locks held by syz.6.241/8202: 1 lock held by syz.8.280/8458: #0: ffff888148efbd78 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1045 [inline] #0: ffff888148efbd78 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_unbounded+0x1a3/0x8e0 mm/readahead.c:233 1 lock held by syz.3.292/8534: #0: ffff888148efbd78 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1045 [inline] #0: ffff888148efbd78 (mapping.invalidate_lock){++++}-{4:4}, at: page_cache_ra_unbounded+0x1a3/0x8e0 mm/readahead.c:233 2 locks held by kworker/u8:17/9038: 1 lock held by syz-executor/9612: #0: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x5b7/0xd20 net/ipv6/addrconf.c:5027 2 locks held by syz-executor/10068: #0: ffffffff8dfed860 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8dfed860 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8dfed860 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8e9/0x1c80 net/core/rtnetlink.c:4064 1 lock held by syz-executor/10237: #0: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8e863d78 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz.1.484/10240: 3 locks held by syz.0.486/10242: ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline] watchdog+0xf60/0xfa0 kernel/hung_task.c:495 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 9038 Comm: kworker/u8:17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: loop1 loop_rootcg_workfn RIP: 0010:__kasan_check_write+0xa/0x20 mm/kasan/shadow.c:37 Code: ff 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 89 f6 48 8b 0c 24 01 00 00 00 e9 bc e4 ff ff 66 66 66 2e 0f 1f 84 00 00 00 00 00 RSP: 0018:ffffc9000f627338 EFLAGS: 00000056 RAX: 00000000ffffff01 RBX: ffff88801df3e480 RCX: ffffffff819c9951 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc9000f627380 RBP: ffffc9000f6273f0 R08: ffff88801df3e483 R09: 1ffff11003be7c90 R10: dffffc0000000000 R11: ffffed1003be7c91 R12: ffff88801df3e490 R13: ffff88801df3e488 R14: 1ffff11003be7c92 R15: 1ffff11003be7c91 FS: 0000000000000000(0000) GS:ffff888126df4000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f24d81e6000 CR3: 000000003839e000 CR4: 00000000003526f0 Call Trace: instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1301 [inline] queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] do_raw_spin_lock+0x121/0x290 kernel/locking/spinlock_debug.c:116 task_blocks_on_rt_mutex kernel/locking/rtmutex.c:1232 [inline] rtlock_slowlock_locked+0x38d/0x4010 kernel/locking/rtmutex.c:1851 rtlock_slowlock kernel/locking/rtmutex.c:1895 [inline] rtlock_lock kernel/locking/spinlock_rt.c:43 [inline] __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline] rt_spin_lock+0x158/0x3e0 kernel/locking/spinlock_rt.c:57 spin_lock_irq include/linux/spinlock_rt.h:93 [inline] loop_process_work+0xf8/0x1060 drivers/block/loop.c:1951 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245