INFO: task syz.5.3768:22739 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.3768 state:D stack:26040 pid:22739 tgid:22734 ppid:21612 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 nfsd_nl_listener_set_doit+0x53d/0x1ab0 fs/nfsd/nfsctl.c:2057 genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114 genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline] genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2576 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x8ef/0xa80 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x7f0/0xb20 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800 __sock_sendmsg net/socket.c:818 [inline] ____sys_sendmsg+0x54e/0x850 net/socket.c:2715 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769 __sys_sendmsg net/socket.c:2801 [inline] __do_sys_sendmsg net/socket.c:2806 [inline] __se_sys_sendmsg net/socket.c:2804 [inline] __x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2804 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcdb179f559 RSP: 002b:00007fcdb271b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fcdb1a25fa0 RCX: 00007fcdb179f559 RDX: 0000000020040000 RSI: 0000200000000040 RDI: 000000000000000a RBP: 00007fcdb1836b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fcdb1a26038 R14: 00007fcdb1a25fa0 R15: 00007fffb7cc8ba8 Showing all locks held in the system: locks held by ksoftirqd/0/15: 1, last CPU#0: #0: ffff8880b8428618 (hrtimer_bases.lock){-.-.}-{2:2}, at: class_raw_spinlock_constructor include/linux/spinlock.h:559 [inline] #0: ffff8880b8428618 (hrtimer_bases.lock){-.-.}-{2:2}, at: __hrtimer_rearm_deferred+0x99/0x4b0 kernel/time/hrtimer.c:2189 locks held by pr/ttyS0/32: 2, last CPU#1: #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:493 [inline] #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 #1: ffffffff9bda1af8 (&port_lock_key){-.-.}-{3:3}, at: __uart_port_lock_irqsave include/linux/serial_core.h:613 [inline] #1: ffffffff9bda1af8 (&port_lock_key){-.-.}-{3:3}, at: univ8250_console_device_lock+0x67/0xc0 drivers/tty/serial/8250/8250_core.c:413 locks held by khungtaskd/33: 1, last CPU#0: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by getty/5387: 2, on CPU#1: #0: ffff88803871f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz.2.3491/21308: 2, on CPU#1: #0: ffffffff912db128 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217 #1: ffffffff9009e720 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x53d/0x1ab0 fs/nfsd/nfsctl.c:2057 locks held by kworker/u8:23/21560: 4, last CPU#1: #0: ffff88808ed0d948 ((wq_completion)krds_cp_wq#22/6#2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88808ed0d948 ((wq_completion)krds_cp_wq#22/6#2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88808ed0d948 ((wq_completion)krds_cp_wq#22/6#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88808ed0d948 ((wq_completion)krds_cp_wq#22/6#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004f17c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004f17c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004f17c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004f17c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888054563380 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff88803bff9de0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff88803bff9de0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:30/21570: 4, last CPU#1: #0: ffff88808ed0f948 ((wq_completion)krds_cp_wq#22/2#2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88808ed0f948 ((wq_completion)krds_cp_wq#22/2#2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88808ed0f948 ((wq_completion)krds_cp_wq#22/2#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88808ed0f948 ((wq_completion)krds_cp_wq#22/2#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005017c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005017c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005017c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005017c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88805454d880 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff88803bffaba0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff88803bffaba0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by syz.5.3768/22739: 2, on CPU#1: #0: ffffffff912db128 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1217 #1: ffffffff9009e720 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0x53d/0x1ab0 fs/nfsd/nfsctl.c:2057 locks held by kworker/u8:48/23636: 4, last CPU#1: #0: ffff888034c12948 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888034c12948 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888034c12948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888034c12948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005dcfc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005dcfc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005dcfc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005dcfc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888066a759c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule+0xd4/0xfc0 net/batman-adv/bat_iv_ogm.c:1010 #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by kworker/u8:53/23641: 3, last CPU#1: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005e1fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005e1fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005e1fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005e1fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888048c1e258 (&devlink->lock_key#9){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:56/23647: 4, last CPU#1: #0: ffff88808ed0f148 ((wq_completion)krds_cp_wq#22/3#2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88808ed0f148 ((wq_completion)krds_cp_wq#22/3#2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88808ed0f148 ((wq_completion)krds_cp_wq#22/3#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88808ed0f148 ((wq_completion)krds_cp_wq#22/3#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900038bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900038bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900038bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900038bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88805454d580 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff88804ab99020 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff88804ab99020 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:58/23649: 3, on CPU#1: #0: ffff88801d3b7948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801d3b7948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801d3b7948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801d3b7948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006057c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006057c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006057c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90006057c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4255 locks held by kworker/u8:59/23650: 3, last CPU#1: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006067c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006067c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006067c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90006067c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888078d91258 (&devlink->lock_key#11){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:61/23652: 2, last CPU#1: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006087c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006087c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006087c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90006087c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:65/23657: 4, last CPU#1: #0: ffff8880236ec148 ((wq_completion)krds_cp_wq#22/7#2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880236ec148 ((wq_completion)krds_cp_wq#22/7#2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880236ec148 ((wq_completion)krds_cp_wq#22/7#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff8880236ec148 ((wq_completion)krds_cp_wq#22/7#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005befc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005befc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005befc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005befc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888054563080 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff88804ab9f060 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff88804ab9f060 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:67/23659: 3, last CPU#1: #0: ffff88808ed0e948 ((wq_completion)krds_cp_wq#22/4#2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88808ed0e948 ((wq_completion)krds_cp_wq#22/4#2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88808ed0e948 ((wq_completion)krds_cp_wq#22/4#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88808ed0e948 ((wq_completion)krds_cp_wq#22/4#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900020bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900020bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900020bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900020bfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888054563980 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by syz.0.4195/25262: 2, on CPU#0: #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3598 #1: ffffffff8fd60328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #1: ffffffff8fd60328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2cb/0x760 kernel/rcu/tree_exp.h:966 locks held by syz.4.4198/25278: 2, last CPU#1: #0: ffff8880216c3440 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff8880216c3440 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1299 #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290 locks held by syz.3.4199/25290: 1, on CPU#0: #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x767/0xc00 net/core/rtnetlink.c:7175 locks held by dhcpcd-run-hook/25294: 3, last CPU#0: #0: ffffffff8fe33fd0 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline] #0: ffffffff8fe33fd0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10a/0x470 kernel/fork.c:1595 #1: ffff88807c640f80 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #1: ffff88807c640f80 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716 #2: ffff888079f6c080 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline] #2: ffff888079f6c080 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd2/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 23635 Comm: kworker/u8:47 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: krds_cp_wq#22/5 rds_connect_worker RIP: 0010:tick_program_event+0x40/0x120 kernel/time/tick-oneshot.c:29 Code: 00 00 00 00 fc ff df 49 bc ff ff ff ff ff ff ff 7f e8 84 83 0f 00 48 c7 c7 e0 0c 10 8c e8 78 82 3b 0a 65 4c 8b 3d 18 fd e2 12 <4d> 89 fe 4c 89 e7 48 89 de e8 22 89 0f 00 4c 39 e3 74 58 49 83 c7 RSP: 0018:ffffc90000007dc8 EFLAGS: 00000006 RAX: 0000000000000000 RBX: 000000cc3a004ee0 RCX: 8000000000000103 RDX: 8000000000000100 RSI: ffffffff8c100ce0 RDI: ffffffff8c6e1780 RBP: 0000000000000001 R08: 0000000000000100 R09: 1ffffffff22f8257 R10: dffffc0000000000 R11: fffffbfff22f8258 R12: 7fffffffffffffff R13: dffffc0000000000 R14: ffff8880b842864f R15: ffff8880b8423f40 FS: 0000000000000000(0000) GS:ffff888123a6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe11121b7e8 CR3: 00000000745a8000 CR4: 00000000003526f0 Call Trace: hrtimer_rearm kernel/time/hrtimer.c:2177 [inline] __hrtimer_rearm_deferred+0x36c/0x4b0 kernel/time/hrtimer.c:2197 hrtimer_rearm_deferred_tif include/linux/hrtimer_rearm.h:58 [inline] hrtimer_rearm_deferred include/linux/hrtimer_rearm.h:67 [inline] irqentry_hrtimer_rearm_deferred include/linux/irq-entry-common.h:471 [inline] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:509 [inline] irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:546 [inline] irqentry_exit+0x961/0x9b0 kernel/entry/common.c:154 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221 Code: f7 e8 fd 1f ad f5 f7 c3 00 02 00 00 74 05 e8 d0 b2 d9 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 84 19 9e f5 65 48 8b 05 1c 4d a4 08 48 85 c0 74 18 5b 41 5e c3 RSP: 0018:ffffc90000007f48 EFLAGS: 00000206 RAX: 0000000000000002 RBX: 0000000000000287 RCX: 8000000000000102 RDX: 0000000000000002 RSI: ffffffff8e486f08 RDI: 0000000000000001 RBP: 8000000000000101 R08: ffffffff917c12bf R09: 1ffffffff22f8257 R10: dffffc0000000000 R11: fffffbfff22f8258 R12: 0000000000000008 R13: 0000000000000009 R14: ffff8880b8428600 R15: 0000000000000000 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 do_softirq+0x77/0xd0 kernel/softirq.c:569 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 lock_sock include/net/sock.h:1717 [inline] __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 kernel_bind+0x13e/0x1c0 net/socket.c:3677 rds_tcp_conn_path_connect+0x53b/0x920 net/rds/tcp_connect.c:175 rds_connect_worker+0x1d8/0x290 net/rds/threads.c:176 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245