INFO: task kworker/u10:28:29470 blocked for more than 146 seconds. Tainted: G U L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u10:28 state:D stack:24984 pid:29470 tgid:29470 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x60e0 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 linkwatch_event+0x51/0xc0 net/core/link_watch.c:313 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz-executor:334 blocked for more than 146 seconds. Tainted: G U L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:27560 pid:334 tgid:334 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x60e0 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 rtnl_net_lock include/linux/rtnetlink.h:130 [inline] inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] __sys_sendto+0x4aa/0x520 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3a09f5cece RSP: 002b:00007fffc4fcad18 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555561217500 RCX: 00007f3a09f5cece RDX: 0000000000000028 RSI: 00007f3a0ad44670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007fffc4fcad94 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f3a0ad44670 R15: 0000000000000000 Showing all locks held in the system: 2 locks held by kworker/0:0/9: 2 locks held by kworker/0:1/10: 3 locks held by kworker/1:0/24: #0: ffff88813fe62148 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc900001e7d08 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x91/0x11d0 net/wireless/reg.c:2462 1 lock held by khungtaskd/31: #0: ffffffff8e7e9220 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #0: ffffffff8e7e9220 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #0: ffffffff8e7e9220 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 1 lock held by khugepaged/38: #0: ffffffff8e939328 (lock#5){+.+.}-{4:4}, at: __lru_add_drain_all+0x6a/0x650 mm/swap.c:840 2 locks held by kworker/0:2/1209: 4 locks held by syz-executor/5807: #0: ffff888077f65e48 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x11d/0x590 mm/mmap_lock.c:310 #1: ffff888037d38518 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x17a/0x440 mm/memory.c:3589 #2: ffff88807894ef08 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1093 [inline] #2: ffff88807894ef08 (mapping.invalidate_lock#2){++++}-{4:4}, at: ext4_page_mkwrite+0x36c/0x1980 fs/ext4/inode.c:6618 #3: ffff88807894ebf8 (&ei->i_data_sem){++++}-{4:4}, at: ext4_da_map_blocks fs/ext4/inode.c:1954 [inline] #3: ffff88807894ebf8 (&ei->i_data_sem){++++}-{4:4}, at: ext4_da_get_block_prep+0x738/0x1240 fs/ext4/inode.c:2020 4 locks held by kworker/1:1/12671: #0: ffff88805cc2fd48 ((wq_completion)wg-kex-wg2#22){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc900051bfd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff888037325348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff88807c1de648 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 2 locks held by kworker/0:3/15402: 3 locks held by kworker/u10:3/15879: 3 locks held by kworker/u10:4/15902: 3 locks held by kworker/u10:8/17707: 6 locks held by kworker/u10:10/17711: 4 locks held by kworker/u10:16/17724: 3 locks held by kworker/u10:32/17740: 3 locks held by kworker/u10:40/20605: 3 locks held by kworker/0:4/22726: 5 locks held by kworker/u10:0/26259: 3 locks held by kworker/u10:1/26260: 4 locks held by kworker/u10:2/26261: 10 locks held by kworker/u10:5/26262: 3 locks held by kworker/u10:6/26263: 3 locks held by kworker/u10:7/26264: 2 locks held by kworker/u10:9/26265: 4 locks held by kworker/u10:12/26267: 4 locks held by kworker/u10:13/26268: 3 locks held by kworker/u10:15/26269: 2 locks held by kworker/u10:17/26270: 4 locks held by kworker/u10:20/26272: 2 locks held by kworker/u10:21/26273: #0: ffff88813fea4148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90003e07d08 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 3 locks held by kworker/u10:23/26275: 3 locks held by kworker/u10:24/26276: #0: ffff888033d0f948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc900036dfd08 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4738 3 locks held by kworker/u10:25/26277: 1 lock held by syz-executor/27786: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3436 2 locks held by kworker/0:5/27991: 1 lock held by syz-executor/28073: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3436 1 lock held by syz-executor/28361: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3436 2 locks held by kworker/0:6/28504: 5 locks held by kworker/u10:27/29469: 3 locks held by kworker/u10:28/29470: #0: ffff88813fea4148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90006ce7d08 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:313 4 locks held by kworker/u10:29/29471: 4 locks held by kworker/u10:30/29472: 1 lock held by syz-executor/31393: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3436 3 locks held by kworker/u10:31/31681: 3 locks held by kworker/u10:33/31682: 3 locks held by kworker/u10:35/31684: 4 locks held by kworker/u10:36/31685: #0: ffff888058dc0148 ((wq_completion)wg-kex-wg2#21){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc9000590fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff888037325348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807c1de648 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 2 locks held by kworker/0:7/32280: 1 lock held by syz-executor/332: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8bb/0x2380 net/core/rtnetlink.c:4071 1 lock held by syz-executor/334: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 4 locks held by kworker/u11:5/340: 4 locks held by kworker/1:7/341: #0: ffff88801285d548 ((wq_completion)wg-kex-wg2#24){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90003bafd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff888045f9d348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x22b/0x950 drivers/net/wireguard/noise.c:742 #3: ffff88802abc1708 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x2f8/0x950 drivers/net/wireguard/noise.c:753 2 locks held by kworker/u11:6/342: 1 lock held by syz-executor/368: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz-executor/371: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz-executor/373: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz-executor/376: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 3 locks held by kworker/0:8/380: 1 lock held by syz-executor/393: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 1 lock held by syz-executor/396: #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff90611f28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 2 locks held by kworker/0:10/410: ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G U L syzkaller #0 PREEMPT(full) Tainted: [U]=USER, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xd25/0x1050 kernel/hung_task.c:515 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 29469 Comm: kworker/u10:27 Tainted: G U L syzkaller #0 PREEMPT(full) Tainted: [U]=USER, [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: events_unbound nsim_dev_trap_report_work RIP: 0010:check_preemption_disabled+0x20/0xe0 lib/smp_processor_id.c:54 Code: 90 90 90 90 90 90 90 90 90 90 41 54 55 53 48 83 ec 08 65 8b 1d 35 1c 80 08 65 f7 05 26 1c 80 08 ff ff ff 7f 74 0f 48 83 c4 08 <89> d8 5b 5d 41 5c e9 85 17 03 00 9c 58 f6 c4 02 74 ea 65 4c 8b 25 RSP: 0018:ffffc90000007580 EFLAGS: 00000092 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffffff8de54759 RDI: ffffffff8c1aee20 RBP: ffffffff8e7e9220 R08: 00000000db147cf1 R09: 0000000000000007 R10: 0000000000000006 R11: 0000000000000000 R12: 0000000000000002 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124351000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6d572d8e9c CR3: 000000000e598000 CR4: 00000000003526f0 Call Trace: lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline] lock_acquire kernel/locking/lockdep.c:5870 [inline] lock_acquire+0x1df/0x380 kernel/locking/lockdep.c:5825 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4501 [inline] slab_alloc_node mm/slub.c:4830 [inline] kmem_cache_alloc_node_noprof+0x25a/0x6f0 mm/slub.c:4882 kmalloc_reserve+0x148/0x350 net/core/skbuff.c:613 __alloc_skb+0x185/0x710 net/core/skbuff.c:713 __netdev_alloc_skb+0x7a/0x960 net/core/skbuff.c:775 netdev_alloc_skb include/linux/skbuff.h:3485 [inline] dev_alloc_skb include/linux/skbuff.h:3498 [inline] __ieee80211_beacon_get+0xba1/0x1ee0 net/mac80211/tx.c:5656 ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:5778 ieee80211_beacon_get include/net/mac80211.h:5720 [inline] mac80211_hwsim_beacon_tx+0x4d6/0xa00 drivers/net/wireless/virtual/mac80211_hwsim.c:2361 __iterate_interfaces+0x2e6/0x650 net/mac80211/util.c:760 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:796 mac80211_hwsim_beacon+0x105/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2395 __run_hrtimer kernel/time/hrtimer.c:1785 [inline] __hrtimer_run_queues+0x50e/0xa70 kernel/time/hrtimer.c:1849 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1866 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622 do_softirq kernel/softirq.c:523 [inline] do_softirq+0xac/0xe0 kernel/softirq.c:510 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:395 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:891 [inline] nsim_dev_trap_report_work+0x8c7/0xd10 drivers/net/netdevsim/dev.c:922 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3439 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245