INFO: task kworker/u8:5:18991 blocked for more than 143 seconds.
      Tainted: G             L       syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:5    state:D stack:20848 pid:18991 tgid:18991 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_write_slowpath+0x4c6/0x12f0 kernel/locking/rwsem.c:1215
 __down_write_common kernel/locking/rwsem.c:1347 [inline]
 __down_write kernel/locking/rwsem.c:1356 [inline]
 down_write+0x1bb/0x1f0 kernel/locking/rwsem.c:1632
 rdma_dev_exit_net+0x174/0x6b0 drivers/infiniband/core/device.c:1156
 ops_exit_list net/core/net_namespace.c:200 [inline]
 ops_undo_list+0x2ee/0xab0 net/core/net_namespace.c:253
 cleanup_net+0x499/0x920 net/core/net_namespace.c:706
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz-executor:21222 blocked for more than 143 seconds.
      Tainted: G             L       syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25192 pid:21222 tgid:21222 ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 rwsem_down_read_slowpath+0x5b3/0xb90 kernel/locking/rwsem.c:1114
 __down_read_common kernel/locking/rwsem.c:1291 [inline]
 __down_read kernel/locking/rwsem.c:1304 [inline]
 down_read+0xe8/0x4c0 kernel/locking/rwsem.c:1576
 rdma_dev_init_net+0x2fa/0x580 drivers/infiniband/core/device.c:1226
 ops_init+0x1e2/0x5f0 net/core/net_namespace.c:137
 setup_net+0x118/0x3a0 net/core/net_namespace.c:443
 copy_net_ns+0x340/0x7a0 net/core/net_namespace.c:582
 create_new_namespaces+0x3ea/0xac0 kernel/nsproxy.c:132
 unshare_nsproxy_namespaces+0xf6/0x210 kernel/nsproxy.c:234
 ksys_unshare+0x44f/0x980 kernel/fork.c:3291
 __do_sys_unshare kernel/fork.c:3357 [inline]
 __se_sys_unshare kernel/fork.c:3355 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3355
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff4287a0827
RSP: 002b:00007ffec02118c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007ff428a25f40 RCX: 00007ff4287a0827
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007ff428a267b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffec0211b08 R15: 0000000000000000
 </TASK>

Showing all locks held in the system:
locks held by ksoftirqd/1/23: 1, last CPU#1:
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: ieee80211_rx_napi+0x9a/0x400 net/mac80211/rx.c:5789
locks held by kworker/1:1/29: 3, last CPU#1:
 #0: ffff88813ff2dd48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90000a47d08 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x21a/0x1a10 net/netfilter/nf_conntrack_core.c:1530
locks held by pr/ttyS0/31: 1, last CPU#1:
 #0: ffffffff8ffd7658 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline]
 #0: ffffffff8ffd7658 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:493 [inline]
 #0: ffffffff8ffd7658 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 kernel/printk/printk.c:291
locks held by khungtaskd/32: 1, last CPU#0:
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by kworker/u8:3/51: 3, last CPU#0:
 #0: ffff88813ff6c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90000bc7d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:218 [inline]
 #1: ffffc90000bc7d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: __schedule+0x2b79/0x6990 kernel/sched/core.c:7376
 #2: ffff8880551c0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 #2: ffff8880551c0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:596
locks held by kworker/u8:4/62: 3, last CPU#0:
 #0: ffff88813ff6c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc9000203fd08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff888026fe1258 (&devlink->lock_key#4){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834
locks held by kworker/u8:9/4589: 3, last CPU#0:
 #0: ffff88813ff6c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc9000f947d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88807cd2d258 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834
locks held by klogd/4976: 1, last CPU#0:
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: avc_has_perm_noaudit+0x56/0x470 security/selinux/avc.c:1163
locks held by getty/5376: 2, on CPU#0:
 #0: ffff88801f6a90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000322e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1540 drivers/tty/n_tty.c:2211
locks held by sshd-session/5603: 4, last CPU#0:
 #0: ffff88802b14aa20 (sk_lock-AF_INET
){+.+.}-{0:0}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:677
 #1: ffff8880b8024828 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:218 [inline]
 #1: ffff8880b8024828 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2b79/0x6990 kernel/sched/core.c:7376
 #2: ffff8880b8024828 (psi_seq){-.-.}-{0:0}, at: psi_enqueue kernel/sched/stats.h:159 [inline]
 #2: ffff8880b8024828 (psi_seq){-.-.}-{0:0}, at: enqueue_task+0x1dc/0x4f0 kernel/sched/core.c:2199
 #3: ffffffff9cc4f1c8 (&____s->seqcount#2){----}-{0:0}, at: clockevents_program_event+0x23e/0x820 kernel/time/clockevents.c:363
locks held by syz-executor/5604: 2, last CPU#0:
 #0: ffff88803489b440 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:586 [inline]
 #0: ffff88803489b440 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1299
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x9a/0x470 mm/pgtable-generic.c:302
locks held by syz-executor/5616: 1, last CPU#0:
 #0: ffffffff901d8140 (fs_reclaim){+.+.}-{0:0}, at: might_alloc include/linux/sched/mm.h:316 [inline]
 #0: ffffffff901d8140 (fs_reclaim){+.+.}-{0:0}, at: slab_pre_alloc_hook mm/slub.c:4673 [inline]
 #0: ffffffff901d8140 (fs_reclaim){+.+.}-{0:0}, at: slab_alloc_node mm/slub.c:5011 [inline]
 #0: ffffffff901d8140 (fs_reclaim){+.+.}-{0:0}, at: kmem_cache_alloc_lru_noprof+0x5f/0x6a0 mm/slub.c:5066
locks held by syz-executor/5622: 1, last CPU#0:
 #0: ffff888034d9ece0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x5a/0x520 net/netfilter/x_tables.c:1336
locks held by syz-executor/7110: 3, last CPU#0:
 #0: ffffffff901493b0 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1540 [inline]
 #0: ffffffff901493b0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm kernel/fork.c:1593 [inline]
 #0: ffffffff901493b0 (dup_mmap_sem){++++}-{0:0}, at: copy_process+0x79fc/0x84c0 kernel/fork.c:2319
 #1: ffff88807ab7b440 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:548 [inline]
 #1: ffff88807ab7b440 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716
 #2: ffff888078395900 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:538 [inline]
 #2: ffff888078395900 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723
locks held by kworker/u8:5/18991: 4, on CPU#0:
 #0: ffff88801dec0948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900049afd08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff91f029c8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:677
 #3: ffffffff91b31928 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_exit_net+0x174/0x6b0 drivers/infiniband/core/device.c:1156
locks held by kworker/0:0/19766: 2, last CPU#0:
 #0: ffff8880b803c720 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140 kernel/sched/core.c:677
 #1: ffff8880b8024828 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:218 [inline]
 #1: ffff8880b8024828 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2b79/0x6990 kernel/sched/core.c:7376
locks held by kworker/u8:14/20293: 3, last CPU#0:
 #0: ffff88813ff6c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc9000d83fd08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88807f250258 (&devlink->lock_key#6){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834
locks held by syz-executor/21096: 6, last CPU#0:
 #0: ffffffff9cf85b08 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_msg+0x168/0x6f0 drivers/infiniband/core/netlink.c:164
 #1: ffffffff91b472e8 (link_ops_rwsem){++++}-{4:4}, at: nldev_newlink+0x2f0/0x630 drivers/infiniband/core/nldev.c:1849
 #2: ffffffff91b31ba8 (devices_rwsem){++++}-{4:4}, at: enable_device_and_get+0x103/0x3f0 drivers/infiniband/core/device.c:1365
 #3: ffffffff91b31928 (rdma_nets_rwsem){++++}-{4:4}, at: add_compat_devs drivers/infiniband/core/device.c:1058 [inline]
 #3: ffffffff91b31928 (rdma_nets_rwsem){++++}-{4:4}, at: enable_device_and_get+0x2ce/0x3f0 drivers/infiniband/core/device.c:1381
 #4: ffff888037ed5020 (&device->compat_devs_mutex){+.+.}-{4:4}, at: add_one_compat_dev+0x112/0x820 drivers/infiniband/core/device.c:976
 #5: ffff88801dea7180 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x39/0xb40 fs/kernfs/dir.c:833
locks held by syz-executor/21222: 3, on CPU#1:
 #0: ffffffff91f029c8 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x31e/0x7a0 net/core/net_namespace.c:578
 #1: ffffffff91b31ba8 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x287/0x580 drivers/infiniband/core/device.c:1221
 #2: ffffffff91b31928 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x2fa/0x580 drivers/infiniband/core/device.c:1226
locks held by kworker/u8:17/21355: 2, on CPU#1:
 #0: ffff88813ff6c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc9000742fd08 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
locks held by kworker/u8:19/21360: 4, last CPU#0:
 #0: ffff88803518b948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90007167d08 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff888031a9f1c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:1010 [inline]
 #2: ffff888031a9f1c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:1005 [inline]
 #2: ffff888031a9f1c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_send_outstanding_bat_ogm_packet+0x50f/0x7d0 net/batman-adv/bat_iv_ogm.c:1924
 #3: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_slide_own_bcast_window net/batman-adv/bat_iv_ogm.c:870 [inline]
 #3: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule_buff+0x583/0x15d0 net/batman-adv/bat_iv_ogm.c:949
locks held by syz-executor/21384: 3, on CPU#0:
 #0: ffffffff91f029c8 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x31e/0x7a0 net/core/net_namespace.c:578
 #1: ffffffff91b31ba8 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x287/0x580 drivers/infiniband/core/device.c:1221
 #2: ffffffff91b31928 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x2fa/0x580 drivers/infiniband/core/device.c:1226
locks held by syz-executor/21513: 3, on CPU#1:
 #0: ffffffff91f029c8 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x31e/0x7a0 net/core/net_namespace.c:578
 #1: ffffffff91b31ba8 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x287/0x580 drivers/infiniband/core/device.c:1221
 #2: ffffffff91b31928 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x2fa/0x580 drivers/infiniband/core/device.c:1226
locks held by kworker/0:2/21608: 2, last CPU#0:
 #0: ffff88813ff2dd48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc9000a667d08 ((gc_work).work){+.+.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:218 [inline]
 #1: ffffc9000a667d08 ((gc_work).work){+.+.}-{0:0}, at: __schedule+0x2b79/0x6990 kernel/sched/core.c:7376
locks held by syz.4.6627/21669: 2, last CPU#0:
 #0: ffff888069058340 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:586 [inline]
 #0: ffff888069058340 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1299
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x9a/0x470 mm/pgtable-generic.c:302
locks held by dhcpcd-run-hook/21664: 2, last CPU#0:
 #0: ffff88802b861bc0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:586 [inline]
 #0: ffff88802b861bc0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x124/0xa00 mm/mmap.c:1299
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8ffeb420 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x9a/0x470 mm/pgtable-generic.c:302
locks held by modprobe/21675: 1, last CPU#0:
 #0: ffff88813ff50f80 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:548 [inline]
 #0: ffff88813ff50f80 (&mm->mmap_lock){++++}-{4:4}, at: do_mprotect_pkey+0x254/0xdd0 mm/mprotect.c:902

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G             L       syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: pr/ttyS0 Tainted: G             L       syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:__raw_callee_save___pv_queued_spin_unlock+0x5/0x18
Code: 41 58 5f 5e 5a 59 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 52 <b8> 01 00 00 00 31 d2 f0 0f b0 17 75 06 5a c3 cc cc cc cc 56 0f b6
RSP: 0018:ffffc90000a08f48 EFLAGS: 00000046
RAX: 0000000001000002 RBX: ffff8880b8128840 RCX: 0000000001000002
RDX: ffff8880216ea580 RSI: ffffffff81ba73b2 RDI: ffff8880b8128840
RBP: ffff8880b8128848 R08: 0000000000000005 R09: 00000000000000ff
R10: 0000000000000001 R11: 6b636f6c2e736573 R12: ffff8880b8128850
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881225ac000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffde5738c80 CR3: 000000007350c000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __raw_callee_save_pv_queued_spin_unlock_traced+0x15/0x40
 pv_queued_spin_unlock arch/x86/include/asm/paravirt-spinlock.h:44 [inline]
 queued_spin_unlock arch/x86/include/asm/paravirt-spinlock.h:77 [inline]
 do_raw_spin_unlock+0x145/0x1e0 kernel/locking/spinlock_debug.c:142
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:209 [inline]
 _raw_spin_unlock_irqrestore+0x22/0x80 kernel/locking/spinlock.c:221
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline]
 __sysvec_apic_timer_interrupt+0x109/0x470 arch/x86/kernel/apic/apic.c:1068
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x9e/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:221
Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 86 f4 fe f5 48 89 df e8 0e 4b ff f5 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 <bf> 01 00 00 00 e8 05 11 ee f5 65 48 83 3d 04 10 cd 09 00 74 16 5b
RSP: 0018:ffffc90000a77ca0 EFLAGS: 00000246
RAX: 0000000000000006 RBX: ffffffff9cf19f40 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffffff8e61b3d9 RDI: ffffffff8c831680
RBP: 0000000000000246 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 205d323354202020 R12: 1ffff9200014ef97
R13: ffffffff90df3e40 R14: 0000000000000001 R15: dffffc0000000000
 nbcon_emit_one+0x15c/0x2b0 kernel/printk/nbcon.c:1165
 nbcon_kthread_func+0x5ef/0x7f0 kernel/printk/nbcon.c:1271
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>