INFO: task syz.3.6810:2145 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.6810 state:D stack:27232 pid:2145 tgid:2142 ppid:30751 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 nfsd_nl_cache_flush_doit+0xb5/0x1b0 fs/nfsd/nfsctl.c:2319 genl_fam genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800 __sock_sendmsg net/socket.c:818 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2715 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769 __sys_sendmsg net/socket.c:2801 [inline] __do_sys_sendmsg net/socket.c:2806 [inline] __se_sys_sendmsg net/socket.c:2804 [inline] __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5879f9e199 RSP: 002b:00007f587ae13028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f587a226090 RCX: 00007f5879f9e199 RDX: 0000000004000080 RSI: 0000200000000000 RDI: 0000000000000005 RBP: 00007f587a0358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f587a226128 R14: 00007f587a226090 R15: 00007ffcddcd54c8 Showing all locks held in the system: locks held by khungtaskd/32: 1, last CPU#0: #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by getty/5371: 2, on CPU#0: #0: ffff88803604c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by kworker/u8:14/8824: 3, on CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000be47c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000be47c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000be47c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000be47c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by kworker/u8:28/19217: 6, last CPU#1: #0: ffff8880260cc140 ((wq_completion)wg-kex-wg2#15){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880260cc140 ((wq_completion)wg-kex-wg2#15){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880260cc140 ((wq_completion)wg-kex-wg2#15){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880260cc140 ((wq_completion)wg-kex-wg2#15){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900051bfc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900051bfc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900051bfc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900051bfc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888078b7daa0 (&peer->endpoint_lock){++-.}-{3:3}, at: wg_socket_send_skb_to_peer+0x54/0x1d0 drivers/net/wireguard/socket.c:172 #3: ffffffff8ed5c900 (rcu_read_lock_bh){....}-{1:3}, at: local_bh_disable include/linux/bottom_half.h:20 [inline] #3: ffffffff8ed5c900 (rcu_read_lock_bh){....}-{1:3}, at: rcu_read_lock_bh include/linux/rcupdate.h:902 [inline] #3: ffffffff8ed5c900 (rcu_read_lock_bh){....}-{1:3}, at: send6+0x255/0x920 drivers/net/wireguard/socket.c:118 #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: l3mdev_l3_out include/net/l3mdev.h:212 [inline] #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: l3mdev_ip6_out include/net/l3mdev.h:236 [inline] #4: ffffffff8ed5c8a0 (rcu_read_lock){....}-{1:3}, at: __ip6_local_out+0x15c/0x940 net/ipv6/output_core.c:110 #5: ffff8880b8728298 (hrtimer_bases.lock){-.-.}-{2:2}, at: class_raw_spinlock_constructor include/linux/spinlock.h:559 [inline] #5: ffff8880b8728298 (hrtimer_bases.lock){-.-.}-{2:2}, at: __hrtimer_rearm_deferred+0x99/0x4b0 kernel/time/hrtimer.c:2188 locks held by syz.0.6766/1982: 2, on CPU#0: #0: ffffffff902b8ee8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217 #1: ffffffff8f09f7c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x53d/0x1ab0 fs/nfsd/nfsctl.c:2057 locks held by syz.3.6810/2145: 2, on CPU#0: #0: ffffffff902b8ee8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217 #1: ffffffff8f09f7c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_cache_flush_doit+0xb5/0x1b0 fs/nfsd/nfsctl.c:2319 locks held by syz.5.7638/6153: 2, on CPU#0: #0: ffffffff902b8ee8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217 #1: ffffffff8f09f7c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x53d/0x1ab0 fs/nfsd/nfsctl.c:2057 locks held by syz.4.8019/7793: 2, on CPU#0: #0: ffffffff902b8ee8 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217 #1: ffffffff8f09f7c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_version_set_doit+0xcd/0x7a0 fs/nfsd/nfsctl.c:1844 locks held by syz.2.8083/8022: 2, on CPU#0: #0: ffff8880557ffb00 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline] #0: ffff8880557ffb00 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 net/socket.c:734 #1: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: raw_release+0x1bb/0x9f0 net/can/raw.c:430 locks held by syz.7.8084/8025: 1, last CPU#1: #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:650 [inline] #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3587 locks held by syz.1.8085/8032: 1, on CPU#1: #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3da/0x1e70 drivers/net/tun.c:3229 locks held by syz.1.8085/8038: 1, on CPU#1: #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3da/0x1e70 drivers/net/tun.c:3229 locks held by syz.1.8085/8040: 1, on CPU#1: #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x2fb/0x1c50 net/ipv4/devinet.c:1122 locks held by syz.6.8086/8037: 2, on CPU#1: #0: ffffffff907b1fe8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff907b1fe8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff907b1fe8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:595 #1: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #1: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 net/core/rtnetlink.c:4241 locks held by syz.6.8086/8039: 1, on CPU#1: #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3da/0x1e70 drivers/net/tun.c:3229 locks held by syz.6.8086/8042: 1, on CPU#1: #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff90254aa0 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x2fb/0x1c50 net/ipv4/devinet.c:1122 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 19217 Comm: kworker/u8:28 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Workqueue: events_unbound macvlan_process_broadcast RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline] RIP: 0010:rcu_is_watching+0x11/0xb0 kernel/rcu/tree.c:753 Code: 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 53 65 48 ff 05 ef e4 e7 11 ba 87 39 0a 89 c3 83 f8 08 73 66 49 bf 00 00 00 00 00 fc ff df RSP: 0018:ffffc900051bf7f8 EFLAGS: 00000083 RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff81d03dbc RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff9079a078 RBP: 0000000000000000 R08: ffffffff9079a07f R09: 1ffffffff20f340f R10: dffffc0000000000 R11: fffffbfff20f3410 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124dda000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000560891d2ea38 CR3: 00000000658fc000 CR4: 00000000003526f0 Call Trace: trace_irq_disable+0x3b/0x140 include/trace/events/preemptirq.h:36 irqentry_enter_from_kernel_mode include/linux/irq-entry-common.h:439 [inline] irqentry_enter+0xac/0x130 kernel/entry/common.c:120 sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:macvlan_broadcast+0x593/0x630 drivers/net/macvlan.c:-1 Code: c1 0f 8c e7 fd ff ff 4c 89 ff e8 18 4d 8a fb e9 da fd ff ff e8 5e 4a 1a fb e9 17 ff ff ff e8 54 4a 1a fb eb 05 e8 4d 4a 1a fb <4c> 8b 7c 24 38 49 ff c7 49 81 ff 00 01 00 00 74 0a e8 37 4a 1a fb RSP: 0018:ffffc900051bf910 EFLAGS: 00000293 RAX: ffffffff86ada3bc RBX: 1ffff11004366750 RCX: ffff8880203a3e80 RDX: 0000000000000000 RSI: 000000000000000f RDI: 0000000000000004 RBP: 000000000000000f R08: ffffffff86adb5a7 R09: 0000000000000000 R10: ffff888084f91b40 R11: ffffed10109f236a R12: 0000000000000000 R13: 1ffff110109f237f R14: dffffc0000000000 R15: ffff88807db145b0 macvlan_multicast_rx drivers/net/macvlan.c:-1 [inline] macvlan_process_broadcast+0x437/0x660 drivers/net/macvlan.c:344 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245