INFO: task syz.3.697:7640 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.697 state:D stack:27912 pid:7640 ppid:5777 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x15ae/0x4660 kernel/sched/core.c:6701 schedule+0xbd/0x170 kernel/sched/core.c:6775 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747 nfsd_svc+0x65/0xab0 fs/nfsd/nfssvc.c:788 write_threads+0x393/0x510 fs/nfsd/nfsctl.c:417 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113 vfs_write+0x299/0x9a0 fs/read_write.c:582 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fc6dd59de99 RSP: 002b:00007fc6db7d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fc6dd826090 RCX: 00007fc6dd59de99 RDX: 0000000000000002 RSI: 0000200000000140 RDI: 0000000000000004 RBP: 00007fc6dd633eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc6dd826128 R14: 00007fc6dd826090 R15: 00007fff23472a68 Showing all locks held in the system: 1 lock held by khungtaskd/29: #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633 2 locks held by kworker/u4:2/30: 10 locks held by kworker/0:2/172: 2 locks held by kworker/u4:9/3428: 2 locks held by kworker/u4:12/4292: #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc9000eb87d00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc9000eb87d00 (connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 2 locks held by getty/5534: #0: ffff88803197a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217 2 locks held by syz-executor/5776: #0: ffff88801fb740e0 (&type->s_umount_key#60){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline] #0: ffff88801fb740e0 (&type->s_umount_key#60){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline] #0: ffff88801fb740e0 (&type->s_umount_key#60){+.+.}-{3:3}, at: deactivate_super+0xa4/0xe0 fs/super.c:513 #1: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_shutdown_threads+0x53/0x1a0 fs/nfsd/nfssvc.c:638 2 locks held by kworker/1:4/5820: 3 locks held by syz.3.697/7637: #0: ffff888023da4348 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040 #1: ffff88805ba2a418 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580 #2: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843 3 locks held by syz.3.697/7640: #0: ffff88802671bc48 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040 #1: ffff88805ba2a418 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580 #2: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_svc+0x65/0xab0 fs/nfsd/nfssvc.c:788 2 locks held by syz-executor/7939: #0: ffff88802d8f80e0 (&type->s_umount_key#60){+.+.}-{3:3}, at: __super_lock fs/super.c:56 [inline] #0: ffff88802d8f80e0 (&type->s_umount_key#60){+.+.}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline] #0: ffff88802d8f80e0 (&type->s_umount_key#60){+.+.}-{3:3}, at: deactivate_super+0xa4/0xe0 fs/super.c:513 #1: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_shutdown_threads+0x53/0x1a0 fs/nfsd/nfssvc.c:638 3 locks held by syz.0.814/8227: #0: ffff88802eaefc48 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040 #1: ffff888079a90418 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580 #2: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843 3 locks held by syz.5.815/8237: #0: ffff88823bdb6ec8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040 #1: ffff888027864418 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580 #2: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843 1 lock held by udevd/8404: 3 locks held by syz.7.845/8608: #0: ffff8880213ecd48 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040 #1: ffff88802c432418 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580 #2: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: write_versions+0x96/0xe00 fs/nfsd/nfsctl.c:676 3 locks held by syz.7.845/8609: #0: ffff88802deea0c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040 #1: ffff88802c432418 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580 #2: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843 3 locks held by syz.7.845/8610: #0: ffff888025b78348 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040 #1: ffff88802c432418 (sb_writers#17){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580 #2: ffffffff8d3e17a8 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_svc+0x65/0xab0 fs/nfsd/nfssvc.c:788 1 lock held by syz.4.1069/9720: #0: ffffffff8d137640 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:4089 1 lock held by syz.3.1068/9724: 2 locks held by dhcpcd-run-hook/9743: ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xf59/0xfa0 kernel/hung_task.c:379 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 172 Comm: kworker/0:2 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:preempt_count_sub+0x0/0x160 kernel/sched/core.c:5869 Code: 03 38 c1 0f 8c 6e ff ff ff 48 c7 c7 60 b1 8c 8e e8 75 08 83 00 89 df e9 5b ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1e fa 55 53 48 bb 00 00 00 00 00 fc ff df 48 c7 c0 80 24 2f RSP: 0000:ffffc90000006d10 EFLAGS: 00000246 RAX: ffffffff813bc0d3 RBX: ffffc90002df0001 RCX: ffff88801bbe3c00 RDX: 0000000000000100 RSI: ffffc90002df74c0 RDI: 0000000000000001 RBP: 0000000000000001 R08: ffff88801bbe3c00 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000100 R12: ffffc90002df74c0 R13: ffffc90000006de8 R14: ffffc90002df7508 R15: ffffc90000006df8 FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1946456010 CR3: 000000000cf32000 CR4: 00000000003506f0 Call Trace: unwind_next_frame+0x1d1b/0x2990 arch/x86/kernel/unwind_orc.c:672 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1811 [inline] slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837 slab_free mm/slub.c:3830 [inline] __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843 skb_kfree_head net/core/skbuff.c:946 [inline] skb_free_head net/core/skbuff.c:958 [inline] skb_release_data+0x609/0x7f0 net/core/skbuff.c:988 skb_release_all net/core/skbuff.c:1054 [inline] __kfree_skb net/core/skbuff.c:1068 [inline] consume_skb+0xb2/0x110 net/core/skbuff.c:1284 nft_synproxy_eval_v4+0x36b/0x4e0 net/netfilter/nft_synproxy.c:-1 nft_synproxy_do_eval+0x332/0x550 net/netfilter/nft_synproxy.c:140 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x44b/0x1620 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x29b/0x380 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:259 [inline] NF_HOOK+0x21d/0x3b0 include/linux/netfilter.h:302 NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:304 __netif_receive_skb_one_core net/core/dev.c:5646 [inline] __netif_receive_skb+0xcc/0x290 net/core/dev.c:5760 process_backlog+0x380/0x710 net/core/dev.c:6088 __napi_poll+0xbb/0x460 net/core/dev.c:6650 napi_poll net/core/dev.c:6717 [inline] net_rx_action+0x65f/0xcc0 net/core/dev.c:6853 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 __do_softirq kernel/softirq.c:612 [inline] invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:console_flush_all+0x883/0xcf0 arch/x86/include/asm/irqflags.h:-1 Code: ed 01 00 00 e8 be 81 1b 00 4d 85 ff 48 8b 5c 24 38 75 07 e8 af 81 1b 00 eb 06 e8 a8 81 1b 00 fb 49 bf 00 00 00 00 00 fc ff df <48> 8b 44 24 58 42 0f b6 04 38 84 c0 0f 85 2f 02 00 00 80 3b 01 0f RSP: 0000:ffffc90002df6bc0 EFLAGS: 00000287 RAX: ffffffff816bf328 RBX: ffffc90002df6d3f RCX: 0000000000100000 RDX: ffffc9001882c000 RSI: 00000000000183f4 RDI: 00000000000183f5 RBP: ffffc90002df6d10 R08: ffffffff911eb507 R09: 1ffffffff223d6a0 R10: dffffc0000000000 R11: fffffbfff223d6a1 R12: ffffffff8d8cdf60 R13: 1ffffffff19f96d8 R14: ffffffff8d8cdfb8 R15: dffffc0000000000 console_unlock+0xad/0x350 kernel/printk/printk.c:3069 vprintk_emit+0x497/0x610 kernel/printk/printk.c:2341 dev_vprintk_emit+0x339/0x3f0 drivers/base/core.c:4970 dev_printk_emit+0xef/0x140 drivers/base/core.c:4981 _dev_info+0x11f/0x170 drivers/base/core.c:5039 usb_serial_device_remove+0x14d/0x1e0 drivers/usb/serial/bus.c:99 device_remove drivers/base/dd.c:626 [inline] __device_release_driver drivers/base/dd.c:1351 [inline] device_release_driver_internal+0x408/0x6f0 drivers/base/dd.c:1374 bus_remove_device+0x43b/0x520 drivers/base/bus.c:624 device_del+0x51f/0x910 drivers/base/core.c:3889 usb_serial_disconnect+0x296/0x4c0 drivers/usb/serial/usb-serial.c:1200 usb_unbind_interface+0x207/0x870 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:628 [inline] __device_release_driver drivers/base/dd.c:1351 [inline] device_release_driver_internal+0x458/0x6f0 drivers/base/dd.c:1374 bus_remove_device+0x43b/0x520 drivers/base/bus.c:624 device_del+0x51f/0x910 drivers/base/core.c:3889 usb_disable_device+0x3ee/0x8a0 drivers/usb/core/message.c:1474 usb_disconnect+0x340/0x8a0 drivers/usb/core/hub.c:2315 hub_port_connect drivers/usb/core/hub.c:5369 [inline] hub_port_connect_change drivers/usb/core/hub.c:5669 [inline] port_event drivers/usb/core/hub.c:5833 [inline] hub_event+0x1d69/0x4a80 drivers/usb/core/hub.c:5915 process_one_work kernel/workqueue.c:2653 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293