INFO: task syz.0.1515:10976 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.1515      state:D stack:27016 pid:10976 ppid:5792   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 write_versions+0x96/0xe00 fs/nfsd/nfsctl.c:676
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fca0dd9f559
RSP: 002b:00007fca0ecac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fca0e025fa0 RCX: 00007fca0dd9f559
RDX: 0000000000000007 RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007fca0de36b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fca0e026038 R14: 00007fca0e025fa0 R15: 00007ffe50474148
 </TASK>
INFO: task syz.0.1515:10978 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.1515      state:D stack:26856 pid:10978 ppid:5792   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fca0dd9f559
RSP: 002b:00007fca0ec8b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fca0e026090 RCX: 00007fca0dd9f559
RDX: 0000000000000005 RSI: 0000200000000340 RDI: 0000000000000004
RBP: 00007fca0de36b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fca0e026128 R14: 00007fca0e026090 R15: 00007ffe50474148
 </TASK>
INFO: task syz.0.1515:10982 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.1515      state:D stack:27016 pid:10982 ppid:5792   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 nfsd_svc+0x62/0xa00 fs/nfsd/nfssvc.c:788
 write_threads+0x393/0x510 fs/nfsd/nfsctl.c:417
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fca0dd9f559
RSP: 002b:00007fca0ec6a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fca0e026180 RCX: 00007fca0dd9f559
RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000005
RBP: 00007fca0de36b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fca0e026218 R14: 00007fca0e026180 R15: 00007ffe50474148
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/29:
 #0: ffffffff8e1322e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8e1322e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8e1322e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6669
2 locks held by kworker/u4:5/1032:
2 locks held by getty/9164:
 #0: ffff88802f7870a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9001949b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x43a/0x1400 drivers/tty/n_tty.c:2217
2 locks held by syz.1.980/9228:
 #0: ffff8880519b20e0 (&type->s_umount_key#88){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff8880519b20e0 (&type->s_umount_key#88){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff8880519b20e0 (&type->s_umount_key#88){++++}-{3:3}, at: deactivate_super+0xa4/0xe0 fs/super.c:510
 #1: ffffffff8e3e1b88 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_shutdown_threads+0x53/0x1a0 fs/nfsd/nfssvc.c:638
3 locks held by syz.0.1515/10976:
 #0: ffff88807bb7afc8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040
 #1: ffff88805d430418 (sb_writers#19){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #2: ffffffff8e3e1b88 (nfsd_mutex){+.+.}-{3:3}, at: write_versions+0x96/0xe00 fs/nfsd/nfsctl.c:676
3 locks held by syz.0.1515/10978:
 #0: ffff8880315320c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040
 #1: ffff88805d430418 (sb_writers#19){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #2: ffffffff8e3e1b88 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843
3 locks held by syz.0.1515/10982:
 #0: ffff88802c7094c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040
 #1: ffff88805d430418 (sb_writers#19){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #2: ffffffff8e3e1b88 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_svc+0x62/0xa00 fs/nfsd/nfssvc.c:788

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 1032 Comm: kworker/u4:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:19 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:107 [inline]
RIP: 0010:lock_release+0x122/0x8c0 kernel/locking/lockdep.c:5806
Code: 7e 49 8d 9e e4 0a 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 38 05 00 00 83 3b 00 0f 85 6e 04 00 00 4c 89 74 24 10 <43> c6 44 2f 08 00 48 c7 84 24 a0 00 00 00 00 00 00 00 9c 8f 84 24
RSP: 0018:ffffc900001f0ba0 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff888024c20ae4 RCX: 8aa5fa2dad2b2200
RDX: 0000000000000000 RSI: ffffffff8b3c5240 RDI: ffffffff8b3c5200
RBP: ffffc900001f0cb0 R08: ffffffff8f8dda6f R09: 1ffffffff1f1bb4d
R10: dffffc0000000000 R11: fffffbfff1f1bb4e R12: ffffffff81780c0f
R13: dffffc0000000000 R14: ffff888024c20000 R15: 1ffff9200003e180
FS:  0000000000000000(0000) GS:ffff8880b8d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcdd13f4158 CR3: 000000007515b000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 seqcount_lockdep_reader_access+0xe4/0x1d0 include/linux/seqlock.h:103
 timekeeping_get_delta kernel/time/timekeeping.c:254 [inline]
 timekeeping_get_ns kernel/time/timekeeping.c:388 [inline]
 ktime_get+0x7f/0x280 kernel/time/timekeeping.c:848
 clockevents_program_event+0xe6/0x310 kernel/time/clockevents.c:326
 hrtimer_update_softirq_timer kernel/time/hrtimer.c:1227 [inline]
 hrtimer_run_softirq+0x225/0x290 kernel/time/hrtimer.c:1838
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:memset_orig+0x42/0xac arch/x86/lib/memset_64.S:71
Code: c1 41 89 f9 41 83 e1 07 75 6c 48 89 d1 48 c1 e9 06 74 35 0f 1f 44 00 00 48 ff c9 48 89 07 48 89 47 08 48 89 47 10 48 89 47 18 <48> 89 47 20 48 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d8
RSP: 0018:ffffc900044cf5a0 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffff88807abe8000 RCX: 0000000000000020
RDX: 0000000000001000 RSI: 0000000000000000 RDI: ffffed100f57d7c0
RBP: ffff88813fffc310 R08: ffffea0001eafa37 R09: 0000000000000000
R10: ffffed100f57d000 R11: fffff940003d5f47 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000008000 R15: dffffc0000000000
 kasan_poison mm/kasan/shadow.c:150 [inline]
 kasan_unpoison+0x67/0x90 mm/kasan/shadow.c:190
 __kasan_unpoison_pages+0x24/0x30 mm/kasan/common.c:111
 kasan_unpoison_pages include/linux/kasan.h:121 [inline]
 post_alloc_hook+0xb8/0x200 mm/page_alloc.c:1566
 prep_new_page mm/page_alloc.c:1589 [inline]
 get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
 alloc_slab_page+0x5d/0x180 mm/slub.c:1903
 allocate_slab mm/slub.c:2050 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:2103
 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3275
 __slab_alloc mm/slub.c:3361 [inline]
 __slab_alloc_node mm/slub.c:3414 [inline]
 slab_alloc_node mm/slub.c:3508 [inline]
 __kmem_cache_alloc_node+0x122/0x260 mm/slub.c:3557
 __do_kmalloc_node mm/slab_common.c:1006 [inline]
 __kmalloc_node_track_caller+0xa4/0x230 mm/slab_common.c:1027
 kmalloc_reserve+0x116/0x240 net/core/skbuff.c:584
 __alloc_skb+0x138/0x2c0 net/core/skbuff.c:653
 alloc_skb include/linux/skbuff.h:1316 [inline]
 nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:748 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:805 [inline]
 nsim_dev_trap_report_work+0x253/0xa90 drivers/net/netdevsim/dev.c:851
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>