INFO: task syz.8.3812:19757 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.3812 state:D stack:24584 pid:19757 tgid:19756 ppid:15335 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7323
cgroup_lock_and_drain_offline+0x51a/0x650 kernel/cgroup/cgroup.c:3275
cgroup_kn_lock_live+0x120/0x230 kernel/cgroup/cgroup.c:1715
cgroup_subtree_control_write+0x4b5/0x1080 kernel/cgroup/cgroup.c:3577
cgroup_file_write+0x331/0x8f0 kernel/cgroup/cgroup.c:4316
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb10673de99
RSP: 002b:00007fb104996028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fb1069c5fa0 RCX: 00007fb10673de99
RDX: 0000000000000005 RSI: 0000200000000300 RDI: 0000000000000008
RBP: 00007fb1067d3eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb1069c6038 R14: 00007fb1069c5fa0 R15: 00007ffdcd627cf8
Showing all locks held in the system:
locks held by khungtaskd/38: 1, last CPU#1:
#0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6835
locks held by kworker/u8:4/67: 5, last CPU#0:
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000152fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000152fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000152fc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffff88802b676310 (&devlink->lock_key#14){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 drivers/net/netdevsim/dev.c:909
#3: ffff88803a152120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88803a152120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff88803a152120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
locks held by getty/5348: 2, on CPU#0:
#0: ffff88803334a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900044ce2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
locks held by kworker/1:6/5780: 3, on CPU#1:
#0: ffff88801af91938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88801af91938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88801af91938 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000604fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000604fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000604fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffff88802a332210 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff88802a332210 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4cf0 drivers/usb/core/hub.c:5899
locks held by kworker/0:7/5785: 3, last CPU#0:
#0: ffff88813fe62538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88813fe62538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88813fe62538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc9000607fc60 ((work_completion)(&(&cache_cleaner)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc9000607fc60 ((work_completion)(&(&cache_cleaner)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc9000607fc60 ((work_completion)(&(&cache_cleaner)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffffffff8f99d7d8 (cache_list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffffffff8f99d7d8 (cache_list_lock){+.+.}-{3:3}, at: cache_clean+0x95/0xa10 net/sunrpc/cache.c:450
locks held by kworker/u8:30/8874: 6, last CPU#0:
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc900046a7c60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc900046a7c60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc900046a7c60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffff88802530a310 (&devlink->lock_key#11){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 drivers/net/netdevsim/dev.c:909
#3: ffff888070c6d520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff888070c6d520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff888070c6d520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffff88801e2df858 (&n->list_lock){+.+.}-{3:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffff88801e2df858 (&n->list_lock){+.+.}-{3:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#5: ffff88801e2df858 (&n->list_lock){+.+.}-{3:3}, at: __rt_spin_trylock kernel/locking/spinlock_rt.c:127 [inline]
#5: ffff88801e2df858 (&n->list_lock){+.+.}-{3:3}, at: rt_spin_trylock+0x10c/0x2b0 kernel/locking/spinlock_rt.c:135
locks held by kworker/u8:46/9020: 4, last CPU#0:
#0: ffff88801bee0938 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88801bee0938 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88801bee0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc90003937c60 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc90003937c60 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc90003937c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#2: ffffffff8f7b5760 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677
#3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
locks held by kworker/u8:61/11065: 2, last CPU#0:
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffff88801aea4138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
#1: ffffc90008cafc60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffc90008cafc60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffc90008cafc60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x7fd/0x1480 kernel/workqueue.c:3344
locks held by syz-executor/18588: 4, last CPU#0:
#0: ffff88802b118510 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:494
#1: ffff888026fb6510 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline]
#1: ffff888026fb6510 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2918 [inline]
#1: ffff888026fb6510 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2942 [inline]
#1: ffff888026fb6510 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: filename_unlinkat+0x2ad/0x610 fs/namei.c:5560
#2: ffff888033886bf0 (&sb->s_type->i_lock_key){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff888033886bf0 (&sb->s_type->i_lock_key){+.+.}-{3:3}, at: d_delete+0x47/0x130 fs/dcache.c:2686
#3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8e3c3880 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
locks held by syz.8.3812/19757: 3, on CPU#0:
#0: ffff88802bd92d28 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x252/0x320 fs/file.c:1259
#1: ffff88802b2c2510 (sb_writers#9){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2731 [inline]
#1: ffff88802b2c2510 (sb_writers#9){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#2: ffff88805b010078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
locks held by udevd/19977: 3, last CPU#0:
#0: ffff88802b593b48 (kn->active#5){++++}-{0:0}, at: kernfs_fop_open+0x5a/0xcf0 fs/kernfs/file.c:612
#1: ffff88801c2fced8 (&kernfs_locks->node_mutex[count]){+.+.}-{4:4}, at: kernfs_node_lock fs/kernfs/kernfs-internal.h:229 [inline]
#1: ffff88801c2fced8 (&kernfs_locks->node_mutex[count]){+.+.}-{4:4}, at: kernfs_open_file_mutex_lock fs/kernfs/file.c:51 [inline]
#1: ffff88801c2fced8 (&kernfs_locks->node_mutex[count]){+.+.}-{4:4}, at: kernfs_get_open_node fs/kernfs/file.c:531 [inline]
#1: ffff88801c2fced8 (&kernfs_locks->node_mutex[count]){+.+.}-{4:4}, at: kernfs_fop_open+0x70d/0xcf0 fs/kernfs/file.c:711
#2: ffff8880b8640228 ((&pcs->lock)){+.+.}-{3:3}, at: alloc_from_pcs mm/slub.c:4769 [inline]
#2: ffff8880b8640228 ((&pcs->lock)){+.+.}-{3:3}, at: slab_alloc_node mm/slub.c:4909 [inline]
#2: ffff8880b8640228 ((&pcs->lock)){+.+.}-{3:3}, at: __kmalloc_cache_noprof+0x17e/0x670 mm/slub.c:5482
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 67 Comm: kworker/u8:4 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Workqueue: 0x0 (events_unbound)
RIP: 0010:lock_release+0x15/0x3c0 kernel/locking/lockdep.c:5915
Code: 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 83 ec 30 49 89 f5 <49> 89 fe 65 48 8b 05 40 b1 21 11 48 89 44 24 28 0f 1f 44 00 00 65
RSP: 0000:ffffc9000152fa78 EFLAGS: 00000086
RAX: 0000000000000000 RBX: ffff8880b863b880 RCX: 0000000080000002
RDX: b1000000000c0063 RSI: ffffffff8b5114b0 RDI: ffff8880b863b8e0
RBP: ffffc9000152fcd8 R08: ffffffff8fd0c47f R09: 1ffffffff1fa188f
R10: dffffc0000000000 R11: fffffbfff1fa1890 R12: ffff8880213754bc
R13: ffffffff8b5114b0 R14: ffff88801b310000 R15: ffff8880213754b8
FS: 0000000000000000(0000) GS:ffff8881259f2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055555b0c8a38 CR3: 000000000e1b0000 CR4: 00000000003526f0
Call Trace:
prepare_lock_switch kernel/sched/core.c:5218 [inline]
context_switch kernel/sched/core.c:5507 [inline]
__schedule+0x16d5/0x5530 kernel/sched/core.c:7231
__schedule_loop kernel/sched/core.c:7308 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7323
worker_thread+0xd36/0x10d0 kernel/workqueue.c:3558
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245