INFO: task syz.2.579:9253 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.579 state:D stack:27912 pid:9253 ppid:7483 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843
nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
vfs_write+0x299/0x9a0 fs/read_write.c:582
ksys_write+0x151/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f705439e0d9
RSP: 002b:00007f70551df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f7054626090 RCX: 00007f705439e0d9
RDX: 0000000000000001 RSI: 0000200000000180 RDI: 0000000000000006
RBP: 00007f7054435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7054626128 R14: 00007f7054626090 R15: 00007fff00433818
</TASK>
INFO: task syz.6.621:9490 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.621 state:D stack:27624 pid:9490 ppid:6507 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
nfsd_shutdown_threads+0x53/0x1a0 fs/nfsd/nfssvc.c:638
nfsd_umount+0x42/0xc0 fs/nfsd/nfsctl.c:1464
deactivate_locked_super+0x97/0x100 fs/super.c:481
cleanup_mnt+0x3d7/0x460 fs/namespace.c:1259
task_work_run+0x1d4/0x260 kernel/task_work.c:245
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa8d739e0d9
RSP: 002b:00007fa8d818d028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: fffffffffffffffe RBX: 00007fa8d7625fa0 RCX: 00007fa8d739e0d9
RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000000000000000
RBP: 00007fa8d7435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa8d7626038 R14: 00007fa8d7625fa0 R15: 00007ffe2436a378
</TASK>
Showing all locks held in the system:
2 locks held by kworker/1:0/23:
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900001d7d00 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900001d7d00 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
1 lock held by khungtaskd/29:
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
3 locks held by kworker/u4:4/59:
#0: ffff88802c373d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88802c373d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900015a7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900015a7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d6ac8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xce/0x1550 net/ipv6/addrconf.c:4188
5 locks held by kworker/u4:5/1077:
#0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000449fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000449fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3c9ad0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 net/core/net_namespace.c:606
#3: ffffffff8e3d6ac8 (rtnl_mutex){+.+.}-{3:3}, at: ip6_tnl_exit_batch_net+0xcc/0x630 net/ipv6/ip6_tunnel.c:2300
#4: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#4: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
3 locks held by kworker/u4:11/4810:
#0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000f4c7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000f4c7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d6ac8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
1 lock held by dhcpcd/5438:
#0: ffffffff8e3d6ac8 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2fc/0x1d70 net/ipv4/devinet.c:1101
1 lock held by getty/5533:
2 locks held by kworker/1:4/5814:
#0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900047dfd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900047dfd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
3 locks held by syz.2.579/9251:
#0: ffff888077da8fc8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040
#1: ffff88802c1b8418 (sb_writers#23){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
#2: ffffffff8d3e1748 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843
3 locks held by syz.2.579/9253:
#0: ffff88803041d248 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040
#1: ffff88802c1b8418 (sb_writers#23){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
#2: ffffffff8d3e1748 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843
2 locks held by syz.6.621/9490:
#0: ffff8880662b80e0 (&type->s_umount_key#74){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff8880662b80e0 (&type->s_umount_key#74){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff8880662b80e0 (&type->s_umount_key#74){+.+.}-{3:3}, at: deactivate_super+0xa4/0xe0 fs/super.c:513
#1: ffffffff8d3e1748 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_shutdown_threads+0x53/0x1a0 fs/nfsd/nfssvc.c:638
2 locks held by syz-executor/11037:
#0: ffff8880253480e0 (&type->s_umount_key#74){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline]
#0: ffff8880253480e0 (&type->s_umount_key#74){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
#0: ffff8880253480e0 (&type->s_umount_key#74){+.+.}-{3:3}, at: deactivate_super+0xa4/0xe0 fs/super.c:513
#1: ffffffff8d3e1748 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_shutdown_threads+0x53/0x1a0 fs/nfsd/nfssvc.c:638
1 lock held by syz-executor/12491:
#0: ffffffff8e3d6ac8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d6ac8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
4 locks held by syz.8.1205/12503:
#0: ffff88806a1f4e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:521 [inline]
#0: ffff88806a1f4e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 net/bluetooth/hci_core.c:2709
#1: ffff88806a1f40b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 net/bluetooth/hci_sync.c:5326
#2: ffffffff8e5439c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2016 [inline]
#2: ffffffff8e5439c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 net/bluetooth/hci_conn.c:2571
#3: ffff88805e2c2338 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_conn_del+0x7b/0x630 net/bluetooth/l2cap_core.c:1793
3 locks held by syz.1.1207/12513:
#0: ffff888030de4e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:521 [inline]
#0: ffff888030de4e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 net/bluetooth/hci_core.c:2709
#1: ffff888030de40b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 net/bluetooth/hci_sync.c:5326
#2: ffffffff8e5439c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2016 [inline]
#2: ffffffff8e5439c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 net/bluetooth/hci_conn.c:2571
1 lock held by syz-executor/12525:
#0: ffffffff8e3d6ac8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d6ac8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf59/0xfa0 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 3429 Comm: kworker/u4:7 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:131 [inline]
RIP: 0010:lock_is_held_type+0x11f/0x190 kernel/locking/lockdep.c:5827
Code: 00 00 00 48 c7 c7 60 dd ca 8a e8 9c 12 00 00 b8 ff ff ff ff 65 0f c1 05 27 7c 73 75 83 f8 01 75 40 48 c7 04 24 00 00 00 00 9c <8f> 04 24 f7 04 24 00 02 00 00 75 46 41 f7 c5 00 02 00 00 74 01 fb
RSP: 0018:ffffc900001f0220 EFLAGS: 00000046
RAX: 0000000000000001 RBX: ffff88802d7c5a00 RCX: 035cb51d1cb0ee00
RDX: 0000000000000100 RSI: ffffffff8acadd60 RDI: ffffffff8b1d32e0
RBP: 0000000000000000 R08: ffffc900001f0580 R09: ffffc900001f0590
R10: ffffc900001f03e0 R11: fffff5200003e07e R12: 0000000000000006
R13: 0000000000000246 R14: ffffffff8e3d6ac8 R15: ffff88802d7c65d8
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fd02bfdf000 CR3: 000000000cf32000 CR4: 00000000003506e0
Call Trace:
<IRQ>
lock_is_held include/linux/lockdep.h:288 [inline]
lockdep_rtnl_is_held+0x1b/0x30 net/core/rtnetlink.c:176
__in6_dev_get include/net/addrconf.h:323 [inline]
ip6_ignore_linkdown include/net/addrconf.h:422 [inline]
find_match+0xd0/0xc50 net/ipv6/route.c:785
__find_rr_leaf+0x244/0x760 net/ipv6/route.c:873
find_rr_leaf net/ipv6/route.c:894 [inline]
rt6_select net/ipv6/route.c:938 [inline]
fib6_table_lookup+0x3c7/0xae0 net/ipv6/route.c:2235
ip6_pol_route+0x239/0x1230 net/ipv6/route.c:2271
pol_lookup_func include/net/ip6_fib.h:641 [inline]
fib6_rule_lookup+0x226/0x580 net/ipv6/fib6_rules.c:116
ip6_route_input_lookup net/ipv6/route.c:2340 [inline]
ip6_route_input+0x78a/0xab0 net/ipv6/route.c:2636
ip6_rcv_finish+0x143/0x230 net/ipv6/ip6_input.c:77
NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:304
__netif_receive_skb_one_core net/core/dev.c:5646 [inline]
__netif_receive_skb+0xcc/0x290 net/core/dev.c:5760
process_backlog+0x380/0x710 net/core/dev.c:6088
__napi_poll+0xbb/0x460 net/core/dev.c:6650
napi_poll net/core/dev.c:6717 [inline]
net_rx_action+0x65f/0xcc0 net/core/dev.c:6853
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
do_softirq+0xfa/0x1a0 kernel/softirq.c:479
</IRQ>
<TASK>
__local_bh_enable_ip+0x184/0x1c0 kernel/softirq.c:406
spin_unlock_bh include/linux/spinlock.h:396 [inline]
nsim_dev_trap_report drivers/net/netdevsim/dev.c:820 [inline]
nsim_dev_trap_report_work+0x71b/0xa90 drivers/net/netdevsim/dev.c:851
process_one_work kernel/workqueue.c:2657 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>