INFO: task syz.8.12319:8975 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.12319 state:D stack:28808 pid:8975 tgid:8962 ppid:23477 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5535 [inline]
__schedule+0x1b47/0x5c60 kernel/sched/core.c:7305
__schedule_loop kernel/sched/core.c:7382 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7397
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7454
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821
fdget_pos+0x118/0x160 fs/file.c:1273
class_fd_pos_constructor include/linux/file.h:86 [inline]
ksys_lseek fs/read_write.c:398 [inline]
__do_sys_lseek fs/read_write.c:414 [inline]
__se_sys_lseek fs/read_write.c:412 [inline]
__x64_sys_lseek+0x7a/0x1e0 fs/read_write.c:412
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f58d5f9e159
RSP: 002b:00007f58d6db2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000008
RAX: ffffffffffffffda RBX: 00007f58d6226090 RCX: 00007f58d5f9e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007f58d603506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f58d6226128 R14: 00007f58d6226090 R15: 00007ffe08d32d68
INFO: task syz.8.12319:8978 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.12319 state:D stack:28808 pid:8978 tgid:8962 ppid:23477 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5535 [inline]
__schedule+0x1b47/0x5c60 kernel/sched/core.c:7305
__schedule_loop kernel/sched/core.c:7382 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7397
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7454
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821
fdget_pos+0x118/0x160 fs/file.c:1273
class_fd_pos_constructor include/linux/file.h:86 [inline]
ksys_read+0x79/0x270 fs/read_write.c:707
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f58d5f9e159
RSP: 002b:00007f58d6d91028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f58d6226180 RCX: 00007f58d5f9e159
RDX: 0000000000000064 RSI: 0000200000000300 RDI: 0000000000000003
RBP: 00007f58d603506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f58d6226218 R14: 00007f58d6226180 R15: 00007ffe08d32d68
Showing all locks held in the system:
locks held by khungtaskd/34: 1, last CPU#1:
#0: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871
locks held by udevd/4979: 1, last CPU#0:
#0: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
#0: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
locks held by getty/15099: 2, on CPU#0:
#0: ffff88803625e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900020ac2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
locks held by kworker/u8:11/23397: 4, last CPU#0:
#0: ffff888031673948 ((wq_completion)wg-kex-wg1#27){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff888031673948 ((wq_completion)wg-kex-wg1#27){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff888031673948 ((wq_completion)wg-kex-wg1#27){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
#0: ffff888031673948 ((wq_completion)wg-kex-wg1#27){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
#1: ffffc90004ff7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90004ff7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90004ff7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline]
#1: ffffc90004ff7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578
#2: ffff8880b8637870 (batched_entropy_u8.lock){..-.}-{3:3}, at: wg_noise_handshake_create_initiation+0x12e/0x810 drivers/net/wireguard/noise.c:529
#3: ffff88807b6ddc58 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 drivers/net/wireguard/noise.c:530
locks held by syz.8.12319/8966: 3, on CPU#1:
#0: ffff88803091c9b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 fs/file.c:1273
#1: ffff88807d554460 (sb_writers#20){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#1: ffff88807d554460 (sb_writers#20){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683
#2: ffffffff8f0a0c80 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xb5/0xd10 fs/nfsd/nfsctl.c:874
locks held by syz.8.12319/8975: 1, on CPU#0:
#0: ffff88803091c9b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 fs/file.c:1273
locks held by syz.8.12319/8978: 1, on CPU#0:
#0: ffff88803091c9b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x118/0x160 fs/file.c:1273
locks held by syz-executor/9469: 2, on CPU#0:
#0: ffff888076e5e0e8 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff888076e5e0e8 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff888076e5e0e8 (&type->s_umount_key#70){++++}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:613
#1: ffffffff8f217160 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xad/0x530 fs/jfs/jfs_logmgr.c:1441
locks held by syz-executor/11454: 4, last CPU#0:
#0: ffffffff8ee39210 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1541 [inline]
#0: ffffffff8ee39210 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10f/0x470 kernel/fork.c:1594
#1: ffff88807b17a9f8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:548 [inline]
#1: ffff88807b17a9f8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716
#2: ffff888025b0e9b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:538 [inline]
#2: ffff888025b0e9b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723
#3: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8ed5e2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302
locks held by syz-executor/11477: 2, on CPU#0:
#0: ffff8880298920e8 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff8880298920e8 (&type->s_umount_key#70){++++}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff8880298920e8 (&type->s_umount_key#70){++++}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:613
#1: ffffffff8f217160 (jfs_log_mutex){+.+.}-{4:4}, at: lmLogClose+0xad/0x530 fs/jfs/jfs_logmgr.c:1441
locks held by syz.4.12996/14959: 2, last CPU#1:
#0: ffff88807f0b26a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff88807f0b26a0 (sk_lock-AF_TIPC){+.+.}-{0:0}, at: __tipc_sendstream+0x633/0x12a0 net/tipc/socket.c:1587
#1: ffff88807f80e9b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:605 [inline]
#1: ffff88807f80e9b8 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/mmap_lock.c:474 [inline]
#1: ffff88807f80e9b8 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 mm/mmap_lock.c:534
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 34 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline]
watchdog+0x1058/0x10d0 kernel/hung_task.c:598
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 51 Comm: kworker/u8:3 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:107 [inline]
RIP: 0010:raw_atomic_try_cmpxchg_acquire include/linux/atomic/atomic-arch-fallback.h:2170 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:1302 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:112 [inline]
RIP: 0010:do_raw_spin_lock+0x138/0x2f0 kernel/locking/spinlock_debug.c:116
Code: df be 04 00 00 00 49 89 d6 e8 04 89 95 00 48 8d 7c 24 40 be 04 00 00 00 e8 f5 88 95 00 8b 44 24 40 b9 01 00 00 00 f0 0f b1 0b <0f> 85 20 01 00 00 43 c6 44 34 04 f8 65 8b 1d 5d 66 f2 11 43 0f b6
RSP: 0018:ffffc90000007b80 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff8880b863dbf8 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000007bc0
RBP: ffffc90000007c40 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000000f78 R12: 1ffff92000000f74
R13: ffff8880b863dc00 R14: dffffc0000000000 R15: 1ffff110170c7b80
FS: 0000000000000000(0000) GS:ffff888124caf000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000059a000 CR3: 000000007ed7a000 CR4: 00000000003526f0
Call Trace:
spin_lock_irq include/linux/spinlock.h:377 [inline]
backlog_lock_irq_disable net/core/dev.c:246 [inline]
process_backlog+0xf8a/0x18b0 net/core/dev.c:6739
__napi_poll+0xaa/0x330 net/core/dev.c:7787
napi_poll net/core/dev.c:7850 [inline]
net_rx_action+0x61d/0xf50 net/core/dev.c:8007
handle_softirqs+0x223/0x840 kernel/softirq.c:645
do_softirq+0x77/0xd0 kernel/softirq.c:546
__local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
__dev_queue_xmit+0x1edc/0x3820 net/core/dev.c:4961
dev_queue_xmit include/linux/netdevice.h:3459 [inline]
batadv_send_skb_packet+0x3ff/0x650 net/batman-adv/send.c:100
batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:466 [inline]
batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:491 [inline]
batadv_iv_send_outstanding_bat_ogm_packet+0x590/0x740 net/batman-adv/bat_iv_ogm.c:1912
process_one_work kernel/workqueue.c:3495 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245