INFO: task syz-executor:8157 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:20656 pid: 8157 ppid: 8147 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
rwsem_down_write_slowpath+0xc87/0x1260 kernel/locking/rwsem.c:1165
mmap_write_lock include/linux/mmap_lock.h:71 [inline]
mpol_rebind_mm+0x33/0x2c0 mm/mempolicy.c:381
cpuset_attach+0x336/0x620 kernel/cgroup/cpuset.c:2376
cgroup_migrate_execute+0x7eb/0x1010 kernel/cgroup/cgroup.c:2597
cgroup_attach_task+0x53e/0x7b0 kernel/cgroup/cgroup.c:2892
__cgroup1_procs_write+0x2ee/0x3f0 kernel/cgroup/cgroup-v1.c:527
cgroup_file_write+0x2c3/0x660 kernel/cgroup/cgroup.c:3966
kernfs_fop_write_iter+0x379/0x4c0 fs/kernfs/file.c:296
call_write_iter include/linux/fs.h:2173 [inline]
new_sync_write fs/read_write.c:507 [inline]
vfs_write+0x745/0xd60 fs/read_write.c:594
ksys_write+0x152/0x260 fs/read_write.c:647
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f058e37358e
RSP: 002b:00007ffdb40e5fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555583285500 RCX: 00007f058e37358e
RDX: 0000000000000001 RSI: 00007ffdb40e6060 RDI: 0000000000000003
RBP: 00007ffdb40e65d0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffdb40e6060 R14: 00007ffdb40e6590 R15: 00007ffdb40e65d0
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8c31c720 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
1 lock held by klogd/3551:
2 locks held by getty/3946:
#0: ffff88814cded098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
#1: ffffc900026562e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x5df/0x1a70 drivers/tty/n_tty.c:2158
1 lock held by kworker/dying/4189:
#0: ffffffff8c3421b0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x25e/0x20c0 kernel/exit.c:830
1 lock held by kworker/dying/4290:
#0: ffffffff8c3421b0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x25e/0x20c0 kernel/exit.c:830
1 lock held by napi/wg2-0/4637:
#0: ffffffff8c3421b0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x25e/0x20c0 kernel/exit.c:830
1 lock held by syz-executor/5648:
#0: ffffffff8c3421b0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x25e/0x20c0 kernel/exit.c:830
2 locks held by syz-executor/5661:
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: dup_mmap kernel/fork.c:503 [inline]
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1466 [inline]
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x22c/0x13f0 kernel/fork.c:1518
#1: ffff88807dc32428 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline]
#1: ffff88807dc32428 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:504 [inline]
#1: ffff88807dc32428 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1466 [inline]
#1: ffff88807dc32428 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x249/0x13f0 kernel/fork.c:1518
4 locks held by kworker/u4:13/6857:
#0: ffff888016dcd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1: ffffc9000329fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2: ffffffff8d429850 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589
#3: ffff888019f9d3e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_destruct+0x112/0x300 drivers/net/wireguard/device.c:233
3 locks held by kworker/u4:22/6876:
2 locks held by syz-executor/7397:
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: dup_mmap kernel/fork.c:503 [inline]
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1466 [inline]
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x22c/0x13f0 kernel/fork.c:1518
#1: ffff8880777c4728 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline]
#1: ffff8880777c4728 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:504 [inline]
#1: ffff8880777c4728 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1466 [inline]
#1: ffff8880777c4728 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x249/0x13f0 kernel/fork.c:1518
2 locks held by syz-executor/7398:
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: dup_mmap kernel/fork.c:503 [inline]
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1466 [inline]
#0: ffffffff8c3a6810 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x22c/0x13f0 kernel/fork.c:1518
#1: ffff88807f055528 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline]
#1: ffff88807f055528 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:504 [inline]
#1: ffff88807f055528 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1466 [inline]
#1: ffff88807f055528 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x249/0x13f0 kernel/fork.c:1518
7 locks held by syz-executor/8157:
#0: ffff8880799a6460 (sb_writers#11){.+.+}-{0:0}, at: vfs_write+0x295/0xd60 fs/read_write.c:590
#1: ffff8880606a2488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e5/0x4c0 fs/kernfs/file.c:287
#2: ffffffff8c341fc8 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xee/0x230 kernel/cgroup/cgroup.c:1662
#3: ffffffff8c1bae50 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_attach_lock kernel/cgroup/cgroup.c:2411 [inline]
#3: ffffffff8c1bae50 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x196/0x5c0 kernel/cgroup/cgroup.c:2921
#4: ffffffff8c3421b0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_attach_lock kernel/cgroup/cgroup.c:2413 [inline]
#4: ffffffff8c3421b0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_procs_write_start+0x1ac/0x5c0 kernel/cgroup/cgroup.c:2921
#5: ffffffff8c34fb08 (cpuset_mutex){+.+.}-{3:3}, at: cpuset_attach+0xad/0x620 kernel/cgroup/cpuset.c:2348
#6: ffff888075a45528 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:71 [inline]
#6: ffff888075a45528 (&mm->mmap_lock){++++}-{3:3}, at: mpol_rebind_mm+0x33/0x2c0 mm/mempolicy.c:381
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xe0f/0xe50 kernel/hung_task.c:369
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 3551 Comm: klogd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__phys_addr+0x3c/0x170 arch/x86/mm/physaddr.c:28
Code: 7f ff ff ff ff 48 89 de e8 b1 26 43 00 49 89 de 49 81 ee 00 00 00 80 0f 83 90 00 00 00 48 b8 00 00 00 00 80 77 00 00 48 01 c3 <48> 89 df 4c 89 f6 e8 89 24 43 00 4c 39 f3 0f 87 fc 00 00 00 48 c7
RSP: 0018:ffffc90002e5f5d8 EFLAGS: 00000207
RAX: 0000778000000000 RBX: 0000000026b52f00 RCX: ffff88807df75940
RDX: 0000000000000000 RSI: ffff888026b52f00 RDI: ffffffff7fffffff
RBP: ffffc90002e5f8b0 R08: ffff888026b52b80 R09: 000000008020001e
R10: dffffc0000000000 R11: fffffbfff1b12cf6 R12: ffffea0000000000
R13: ffff888026b52800 R14: ffff8880a6b52f00 R15: ffff888016c41780
FS: 00007f7c46c89c80(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f058e280b80 CR3: 000000007d9eb000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
virt_to_head_page include/linux/mm.h:911 [inline]
___cache_free+0x2a/0x120 mm/slub.c:3511
qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283
____kasan_kmalloc mm/kasan/common.c:479 [inline]
__kasan_kmalloc+0x2f/0xf0 mm/kasan/common.c:522
kmalloc_reserve net/core/skbuff.c:356 [inline]
__alloc_skb+0x22c/0x750 net/core/skbuff.c:427
alloc_skb include/linux/skbuff.h:1162 [inline]
alloc_skb_with_frags+0xa7/0x730 net/core/skbuff.c:6170
sock_alloc_send_pskb+0x87f/0x9a0 net/core/sock.c:2536
unix_dgram_sendmsg+0x5fc/0x18a0 net/unix/af_unix.c:1809
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
__sys_sendto+0x46d/0x620 net/socket.c:2072
__do_sys_sendto net/socket.c:2084 [inline]
__se_sys_sendto net/socket.c:2080 [inline]
__x64_sys_sendto+0xda/0xf0 net/socket.c:2080
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f7c46dd9407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffe2bfdcfc0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f7c46c89c80 RCX: 00007f7c46dd9407
RDX: 000000000000004d RSI: 00007ffe2bfdd100 RDI: 0000000000000003
RBP: 00007ffe2bfdd530 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffe2bfdd548
R13: 00007ffe2bfdd100 R14: 0000000000000032 R15: 00007ffe2bfdd100