INFO: task syz.6.333:7228 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.333 state:D stack:26888 pid:7228 tgid:7227 ppid:7024 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x125c/0x6730 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7326
cgroup_lock_and_drain_offline+0x383/0x800 kernel/cgroup/cgroup.c:3275
cgroup_kn_lock_live+0x188/0x520 kernel/cgroup/cgroup.c:1715
cgroup_subtree_control_write+0x3dd/0xe90 kernel/cgroup/cgroup.c:3577
cgroup_file_write+0x1e6/0x8a0 kernel/cgroup/cgroup.c:4316
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6ac/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8aee79e019
RSP: 002b:00007f8aef61b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f8aeea25fa0 RCX: 00007f8aee79e019
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000008
RBP: 00007f8aee83500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8aeea26038 R14: 00007f8aeea25fa0 R15: 00007ffca20ab588
Showing all locks held in the system:
3 locks held by kworker/u8:1/13:
1 lock held by khungtaskd/30:
#0: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
3 locks held by udevd/4977:
2 locks held by getty/5365:
#0: ffff8880386570a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
3 locks held by kworker/1:6/5744:
#0: ffff88801f69ad40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
#1: ffffc9000466fd08 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
#2: ffff88802b8bf1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
#2: ffff88802b8bf1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4a60 drivers/usb/core/hub.c:5899
3 locks held by kworker/u8:14/6054:
#0: ffff8880b843b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:675 [inline]
#0: ffff8880b843b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x88/0x140 kernel/sched/core.c:659
#1: ffff8880b8424568 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:218 [inline]
#1: ffff8880b8424568 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2e8e/0x6730 kernel/sched/core.c:7228
#2: ffff8880899007a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6883 [inline]
#2: ffff8880899007a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:524
5 locks held by kworker/u8:27/6067:
#0: ffff88801ce90940 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
#1: ffffc90005d37d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
#2: ffffffff90a875e8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:673
#3: ffffffff90aa0200 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
#3: ffffffff90aa0200 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7ec/0xab0 net/core/net_namespace.c:248
#4: ffffffff8ebf3ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311
3 locks held by syz.6.333/7228:
#0: ffff88801fbaab70 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259
#1: ffff888023b6a450 (sb_writers#10){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
#2: ffff88807eef5480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
3 locks held by syz.0.586/8220:
#0: ffff88801cf529b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259
#1: ffff888023b6a450 (sb_writers#10){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
#2: ffff888057707080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
3 locks held by syz.7.595/8252:
#0: ffff8880355fe470 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259
#1: ffff888023b6a450 (sb_writers#10){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
#2: ffff88807bf82880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:336
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x21c/0x2a0 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xcb1/0x1030 kernel/hung_task.c:561
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6067 Comm: kworker/u8:27 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: netns cleanup_net
RIP: 0010:__bfs+0xde/0x2a0 kernel/locking/lockdep.c:1800
Code: 48 5c 74 3b 89 48 5c 49 8b 47 30 48 85 c0 74 1a 80 78 2b 00 41 0f b6 4f 2a 74 03 83 e1 fa 84 c9 74 1d 83 e1 0c 41 0f 94 47 2b <4d> 85 e4 74 61 4c 89 ee 4c 89 ff 2e e8 c9 83 1a 1e 84 c0 74 51 49
RSP: 0018:ffffc90005d370f8 EFLAGS: 00000002
RAX: ffffc90005d371c0 RBX: 0000000000000134 RCX: 0000000000000008
RDX: ffffffff96723a88 RSI: 0000000000000135 RDI: ffffffff98024108
RBP: 0000000000000030 R08: ffffffff96723ab8 R09: 0000000000000002
R10: ffffc90005d37290 R11: 0000000000000000 R12: ffffffff81e57da0
R13: ffffc90005d371a0 R14: ffffffff81e58bb0 R15: ffffffff98024bf8
FS: 0000000000000000(0000) GS:ffff888123dd8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe9d85ef2f8 CR3: 0000000032699000 CR4: 00000000003526f0
Call Trace:
__bfs_backwards kernel/locking/lockdep.c:1860 [inline]
check_irq_usage+0xe5/0x810 kernel/locking/lockdep.c:2796
check_prev_add+0xfe/0xe60 kernel/locking/lockdep.c:3169
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x136c/0x1a40 kernel/locking/lockdep.c:5237
lock_acquire kernel/locking/lockdep.c:5868 [inline]
lock_acquire+0x1b9/0x370 kernel/locking/lockdep.c:5825
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:166
lock_hrtimer_base kernel/time/hrtimer.c:191 [inline]
hrtimer_start_range_ns+0x8e/0x240 kernel/time/hrtimer.c:1501
hrtimer_start include/linux/hrtimer.h:223 [inline]
hrtick_cond_restart kernel/sched/core.c:939 [inline]
hrtick_schedule_exit kernel/sched/core.c:1001 [inline]
finish_lock_switch kernel/sched/core.c:5240 [inline]
finish_task_switch.isra.0+0xa71/0x10c0 kernel/sched/core.c:5359
context_switch kernel/sched/core.c:5513 [inline]
__schedule+0x1264/0x6730 kernel/sched/core.c:7234
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7556
irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x205/0xa00 kernel/entry/common.c:167
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872
Code: 05 3b 8d 7e 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 c6 93 3c 0f 0f 82 ac 02 00 00 8b 35 8e c7 3c 0f 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 dd 8c 7e 12 0f 85 ec 02 00 00 48 83 c4
RSP: 0018:ffffc90005d37768 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8e18229c RDI: ffffffff8c402680
RBP: ffff88803c882140 R08: 000000000025dd78 R09: ffffffff97469188
R10: 0000000000000200 R11: 000000000000758b R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
touch_wq_lockdep_map+0xad/0x1c0 kernel/workqueue.c:4037
__flush_workqueue+0x131/0x1200 kernel/workqueue.c:4079
drain_workqueue+0x175/0x3b0 kernel/workqueue.c:4243
destroy_workqueue+0xc3/0xa30 kernel/workqueue.c:6068
tipc_topsrv_work_stop net/tipc/topsrv.c:653 [inline]
tipc_topsrv_stop net/tipc/topsrv.c:719 [inline]
tipc_topsrv_exit_net+0x385/0x4b0 net/tipc/topsrv.c:732
ops_exit_list net/core/net_namespace.c:199 [inline]
ops_undo_list+0x2ee/0xab0 net/core/net_namespace.c:252
cleanup_net+0x499/0x920 net/core/net_namespace.c:702
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245