INFO: task hung in vcs_open

Status: upstream: reported on 2026/08/03 15:31
Reported-by: syzbot+0b26cf09ae715791b68d@syzkaller.appspotmail.com
First crash: 92d, last: 12h20m
▶ ▼ Similar bugs (15)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in vcs_open (5) serial 1 2 1338d 1342d 0/29 auto-obsoleted due to no activity on 2023/06/04 04:45
upstream INFO: task hung in vcs_open (9) kernel 1 11 540d 705d 0/29 auto-obsoleted due to no activity on 2025/08/10 23:55
upstream INFO: task hung in vcs_open (3) serial 1 1 2081d 2081d 0/29 auto-closed as invalid on 2021/05/22 19:06
upstream INFO: task hung in vcs_open serial 1 32 2251d 2384d 0/29 closed as dup on 2020/08/05 10:53
linux-6.1 INFO: task hung in vcs_open 1 3 13d 63d 0/3 upstream: reported on 2026/09/01 17:44
upstream INFO: task hung in vcs_open (2) serial 1 1 2231d 2231d 0/29 auto-closed as invalid on 2020/12/23 12:34
linux-6.6 INFO: task hung in vcs_open 1 1 3d18h 3d18h 0/2 upstream: reported on 2026/10/31 05:40
upstream INFO: task hung in vcs_open (7) serial 1 1 961d 961d 0/29 auto-obsoleted due to no activity on 2024/06/15 13:53
linux-4.19 INFO: task hung in vcs_open 1 11 2187d 2500d 0/1 auto-closed as invalid on 2021/03/07 01:31
upstream INFO: task hung in vcs_open (10) prio:low kernel 1 83 70d 158d 0/29 auto-obsoleted due to no activity on 2026/11/03 16:58
upstream INFO: task hung in vcs_open (4) serial 1 2 1492d 1555d 0/29 auto-obsoleted due to no activity on 2023/01/02 16:56
linux-4.14 INFO: task hung in vcs_open 1 3 2345d 2429d 0/1 auto-closed as invalid on 2020/09/30 10:12
upstream INFO: task hung in vcs_open (6) serial 1 2 1111d 1175d 0/29 auto-obsoleted due to no activity on 2024/01/17 08:03
linux-4.19 INFO: task hung in vcs_open (2) 1 1 1470d 1470d 0/1 auto-obsoleted due to no activity on 2023/02/22 05:12
upstream INFO: task hung in vcs_open (8) nilfs serial 1 syz, C inconclusive 7 762d 768d 28/29 fixed on 2024/11/12 23:31

Sample crash report:
INFO: task syz.0.280:6076 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.280       state:D stack:27088 pid: 6076 ppid:  5308 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
 __down_common+0x289/0x3b0 kernel/locking/semaphore.c:228
 down+0x7e/0xd0 kernel/locking/semaphore.c:63
 console_lock+0x29/0x70 kernel/printk/printk.c:2557
 vcs_open+0x59/0xc0 drivers/tty/vt/vc_screen.c:764
 chrdev_open+0x585/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7f7/0xf90 fs/open.c:826
 do_open fs/namei.c:3659 [inline]
 path_openat+0x2718/0x2fb0 fs/namei.c:3793
 do_filp_open+0x1df/0x400 fs/namei.c:3820
 do_sys_openat2+0x14b/0x500 fs/open.c:1255
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fa5fa02d34e
RSP: 002b:00007fa5f8280b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fa5f82816c0 RCX: 00007fa5fa02d34e
RDX: 0000000000048002 RSI: 00007fa5f8280c00 RDI: ffffffffffffff9c
RBP: 00007fa5f8280c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007fa5fa2f3218 R14: 00007fa5fa2f3180 R15: 00007ffef84be3f8
 </TASK>
INFO: task syz.4.287:6175 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.287       state:D stack:25296 pid: 6175 ppid:  5802 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
 __down_common+0x289/0x3b0 kernel/locking/semaphore.c:228
 down+0x7e/0xd0 kernel/locking/semaphore.c:63
 console_lock kernel/printk/printk.c:2557 [inline]
 unregister_console+0xa8/0x360 kernel/printk/printk.c:3139
 uart_remove_one_port+0x29f/0x7c0 drivers/tty/serial/serial_core.c:3072
 serial8250_unregister_port+0xac/0x240 drivers/tty/serial/8250/8250_core.c:1153
 pnp_device_remove+0x78/0x250 drivers/pnp/driver.c:133
 __device_release_driver drivers/base/dd.c:1247 [inline]
 device_release_driver_internal+0x44c/0x710 drivers/base/dd.c:1282
 unbind_store+0x2e2/0x300 drivers/base/bus.c:193
 kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:2179 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x748/0xd70 fs/read_write.c:594
 ksys_write+0x153/0x260 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f6a09ee9b19
RSP: 002b:00007f6a08140028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f6a0a16ffa0 RCX: 00007f6a09ee9b19
RDX: 0000000000000005 RSI: 0000200000000400 RDI: 000000000000000c
RBP: 00007f6a09f81af8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6a0a170038 R14: 00007f6a0a16ffa0 R15: 00007ffea5d63c18
 </TASK>
INFO: task syz.4.287:6197 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.287       state:D stack:27632 pid: 6197 ppid:  5802 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 device_lock include/linux/device.h:809 [inline]
 __device_driver_lock drivers/base/dd.c:1064 [inline]
 device_driver_attach+0xd1/0x1d0 drivers/base/dd.c:1095
 bind_store+0x33b/0x380 drivers/base/bus.c:216
 kernfs_fop_write_iter+0x3a8/0x500 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:2179 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x748/0xd70 fs/read_write.c:594
 ksys_write+0x153/0x260 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f6a09ee9b19
RSP: 002b:00007f6a0811f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f6a0a170090 RCX: 00007f6a09ee9b19
RDX: 0000000000000005 RSI: 0000200000000480 RDI: 000000000000000d
RBP: 00007f6a09f81af8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6a0a170128 R14: 00007f6a0a170090 R15: 00007ffea5d63c18
 </TASK>
INFO: task syz.2.296:6251 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.296       state:D stack:27264 pid: 6251 ppid:  5719 flags:0x00024004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
 __down_common+0x289/0x3b0 kernel/locking/semaphore.c:228
 down+0x7e/0xd0 kernel/locking/semaphore.c:63
 console_lock+0x29/0x70 kernel/printk/printk.c:2557
 con_install+0x94/0x720 drivers/tty/vt/vt.c:3384
 tty_driver_install_tty drivers/tty/tty_io.c:1306 [inline]
 tty_init_dev+0xbb/0x470 drivers/tty/tty_io.c:1418
 tty_open_by_driver drivers/tty/tty_io.c:2085 [inline]
 tty_open+0x7e8/0xcd0 drivers/tty/tty_io.c:2132
 chrdev_open+0x585/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7f7/0xf90 fs/open.c:826
 do_open fs/namei.c:3659 [inline]
 path_openat+0x2718/0x2fb0 fs/namei.c:3793
 do_filp_open+0x1df/0x400 fs/namei.c:3820
 do_sys_openat2+0x14b/0x500 fs/open.c:1255
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f803a68334e
RSP: 002b:00007f8038918b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f80389196c0 RCX: 00007f803a68334e
RDX: 0000000000000002 RSI: 00007f8038918c00 RDI: ffffffffffffff9c
RBP: 00007f803a75aaf8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f803a949038 R14: 00007f803a948fa0 R15: 00007ffd3c6ee308
 </TASK>
INFO: task syz.6.307:6346 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.307       state:D stack:27856 pid: 6346 ppid:  5947 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
 chrdev_open+0x585/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7f7/0xf90 fs/open.c:826
 do_open fs/namei.c:3659 [inline]
 path_openat+0x2718/0x2fb0 fs/namei.c:3793
 do_filp_open+0x1df/0x400 fs/namei.c:3820
 do_sys_openat2+0x14b/0x500 fs/open.c:1255
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f4712043b19
RSP: 002b:00007f471029a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f47122c9fa0 RCX: 00007f4712043b19
RDX: 0000000000000001 RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007f47120dbaf8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f47122ca038 R14: 00007f47122c9fa0 R15: 00007fff2a0eaee8
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/0:0/7:
 #0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc90000cc7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffff8880878e8240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x283/0x3380 drivers/net/netdevsim/fib.c:1480
1 lock held by khungtaskd/27:
 #0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
5 locks held by kworker/u4:4/3073:
 #0: ffff8880179cd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc9000d947d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffffffff8e260ad0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589
 #3: ffff88803c8c13e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_destruct+0x112/0x300 drivers/net/wireguard/device.c:233
 #4: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #4: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845
2 locks held by kworker/u4:6/4305:
 #0: ffff888017879138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc900031bfd00 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
2 locks held by kworker/0:10/4880:
 #0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc9000344fd00 (console_work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
5 locks held by syz.9.222/5684:
6 locks held by syz.4.287/6175:
 #0: ffff888078356370 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff88802a0cc460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #2: ffff88805fa75488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #3: ffff88801cb47178 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #3: ffff88801cb47178 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1064 [inline]
 #3: ffff88801cb47178 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa1/0x710 drivers/base/dd.c:1279
 #4: ffffffff8d80c6e8 (serial_mutex){+.+.}-{3:3}, at: serial8250_unregister_port+0x49/0x240 drivers/tty/serial/8250/8250_core.c:1143
 #5: ffffffff8d8099c8 (port_mutex){+.+.}-{3:3}, at: uart_remove_one_port+0xda/0x7c0 drivers/tty/serial/serial_core.c:3041
4 locks held by syz.4.287/6197:
 #0: ffff88807d978370 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff88802a0cc460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #2: ffff88805e87bc88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #3: ffff88801cb47178 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #3: ffff88801cb47178 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1064 [inline]
 #3: ffff88801cb47178 (&dev->mutex){....}-{3:3}, at: device_driver_attach+0xd1/0x1d0 drivers/base/dd.c:1095
2 locks held by syz.2.296/6251:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
 #1: ffff888024a131c0 (&tty->legacy_mutex){+.+.}-{3:3}, at: tty_init_dev+0x6f/0x470 drivers/tty/tty_io.c:1417
1 lock held by syz.6.307/6346:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.3.356/6786:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.8.359/6824:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.5.365/6888:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.1.375/6969:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.9.392/7320:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
3 locks held by kworker/u4:9/7506:
1 lock held by syz.4.422/7591:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.2.425/7610:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.7.429/7635:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.6.503/8134:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xd2/0x2c0 drivers/tty/pty.c:823
1 lock held by syz.3.510/8152:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.1.512/8160:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
1 lock held by syz.8.521/8193:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xd2/0x2c0 drivers/tty/pty.c:823
1 lock held by syz.4.538/8445:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xd2/0x2c0 drivers/tty/pty.c:823
3 locks held by kworker/0:18/8559:
3 locks held by kworker/0:20/8564:
 #0: ffff88802c955d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc9000530fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffffffff8e26ca48 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128
3 locks held by kworker/0:21/8565:
 #0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc9000531fd00 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffff88803c5f3400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x56/0xab0 drivers/net/netdevsim/dev.c:757
1 lock held by syz-executor/8656:
 #0: ffffffff8e26ca48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26ca48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
8 locks held by syz-executor/8770:
 #0: ffff88807ee9e460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #1: ffff88803c23fc88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #2: ffff888147afcda0 (kn->active#284){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1fd/0x500 fs/kernfs/file.c:288
 #3: ffffffff8dba4088 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd3/0x3a0 drivers/net/netdevsim/bus.c:344
 #4: ffff88803c5f2178 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #4: ffff88803c5f2178 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1064 [inline]
 #4: ffff88803c5f2178 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa1/0x710 drivers/base/dd.c:1279
 #5: ffff88803c5f3400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1359 [inline]
 #5: ffff88803c5f3400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_reload_destroy+0x109/0x230 drivers/net/netdevsim/dev.c:1561
 #6: ffffffff8e26ca48 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3b/0x150 drivers/net/netdevsim/netdev.c:381
 #7: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #7: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
1 lock held by syz.6.540/8781:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xd2/0x2c0 drivers/tty/pty.c:823
1 lock held by syz.9.567/8849:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: ptmx_open+0xd2/0x2c0 drivers/tty/pty.c:823
1 lock held by syz.7.568/8844:
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open_by_driver drivers/tty/tty_io.c:2049 [inline]
 #0: ffffffff8d7f6ee8 (tty_mutex){+.+.}-{3:3}, at: tty_open+0x20a/0xcd0 drivers/tty/tty_io.c:2132
2 locks held by dhcpcd-run-hook/8854:

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xe1b/0xe60 kernel/hung_task.c:369
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/03 11:34 linux-5.15.y 700e62ea909a 6969b601 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/10/27 06:46 linux-5.15.y 792fbe1537d8 168cb7a2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/09/08 19:30 linux-5.15.y 0996e0926f6b 243b72f1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/08/27 11:54 linux-5.15.y 945fa863f02c 69a01293 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/08/20 22:36 linux-5.15.y 0eb903b5b519 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/08/17 20:52 linux-5.15.y aabd761612db 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/08/17 13:15 linux-5.15.y aabd761612db 905244d6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/08/17 06:22 linux-5.15.y aabd761612db 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/08/15 06:09 linux-5.15.y aabd761612db 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
2026/08/03 15:30 linux-5.15.y 6e2fd6534337 6b7c9f71 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in vcs_open
* Struck through repros no longer work on HEAD.