INFO: task hung in n_tty_receive_char

Status: upstream: reported on 2026/08/26 11:37
Reported-by: syzbot+6dc430817392efb632c2@syzkaller.appspotmail.com
First crash: 3d17h, last: 3d17h
Similar bugs (4)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in n_tty_receive_char (3) serial 1 7 395d 523d 0/29 auto-obsoleted due to no activity on 2025/10/28 08:26
upstream INFO: task hung in n_tty_receive_char (2) serial 1 1 623d 623d 0/29 auto-obsoleted due to no activity on 2025/03/15 02:18
upstream INFO: task hung in n_tty_receive_char serial 1 5 741d 808d 0/29 auto-obsoleted due to no activity on 2024/11/16 15:14
linux-5.15 INFO: task hung in n_tty_receive_char 1 1 27d 27d 0/3 upstream: reported on 2026/08/02 14:26

Sample crash report:
INFO: task kworker/u4:19:5798 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:19   state:D stack:22432 pid:5798  ppid:2      flags:0x00004000
Workqueue: events_unbound flush_to_ldisc
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 schedule+0xb9/0x180 kernel/sched/core.c:6639
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747
 commit_echoes drivers/tty/n_tty.c:766 [inline]
 n_tty_receive_char+0x5ed/0xbb0 drivers/tty/n_tty.c:1420
 n_tty_receive_buf_standard+0x5fb/0x4d90 drivers/tty/n_tty.c:1589
 __receive_buf drivers/tty/n_tty.c:1623 [inline]
 n_tty_receive_buf_common+0xc08/0x1470 drivers/tty/n_tty.c:1721
 tty_port_default_receive_buf+0x69/0x90 drivers/tty/tty_port.c:39
 receive_buf drivers/tty/tty_buffer.c:515 [inline]
 flush_to_ldisc+0x2b9/0x800 drivers/tty/tty_buffer.c:565
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Showing all locks held in the system:
2 locks held by kworker/u4:0/9:
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8cb2e4f0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8cb2ed10 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/28:
 #0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6527
3 locks held by kworker/0:2/127:
 #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
 #1: ffffc90002e17d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
 #2: ffff88807c559240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x283/0x3320 drivers/net/netdevsim/fib.c:1491
1 lock held by udevd/3639:
1 lock held by dhcpcd/3934:
2 locks held by getty/4030:
 #0: ffff88814dcb0098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 drivers/tty/n_tty.c:2198
2 locks held by kworker/u4:14/4481:
 #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
 #1: ffffc9000508fd00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
2 locks held by kworker/u4:17/4617:
 #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
 #1: ffffc900057cfd00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
6 locks held by kworker/u4:19/5798:
 #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
 #1: ffffc900060ffd00 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
 #2: ffff8880176280b8 (&buf->lock){+.+.}-{3:3}, at: flush_to_ldisc+0x34/0x800 drivers/tty/tty_buffer.c:537
 #3: ffff8880232d9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x18/0x80 drivers/tty/tty_ldisc.c:264
 #4: ffff8880232d92e8 (&tty->termios_rwsem){++++}-{3:3}, at: n_tty_receive_buf_common+0x79/0x1470 drivers/tty/n_tty.c:1684
 #5: ffffc90000b84380 (&ldata->output_lock){+.+.}-{3:3}, at: commit_echoes drivers/tty/n_tty.c:766 [inline]
 #5: ffffc90000b84380 (&ldata->output_lock){+.+.}-{3:3}, at: n_tty_receive_char+0x5ed/0xbb0 drivers/tty/n_tty.c:1420
2 locks held by kworker/u4:20/7641:
5 locks held by syz.7.5608/27483:
2 locks held by syz.9.5638/27607:
 #0: ffff8880232d9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffff8880232d92e8 (&tty->termios_rwsem){++++}-{3:3}, at: n_tty_ioctl+0xa3/0x2e0 drivers/tty/n_tty.c:2502
1 lock held by syz.8.5738/28009:
1 lock held by syz-executor/28102:
2 locks held by udevd/28128:
1 lock held by syz.6.5786/28161:
1 lock held by syz.2.5787/28167:

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xf0e/0xf50 kernel/hung_task.c:377
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/26 11:36 linux-6.1.y 05208478041c 6a91adb4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in n_tty_receive_char
* Struck through repros no longer work on HEAD.