INFO: task syz.0.6948:25276 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.6948 state:D stack:27888 pid:25276 ppid:20415 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747
nfsd_svc+0x61/0xab0 fs/nfsd/nfssvc.c:783
write_threads+0x2ea/0x350 fs/nfsd/nfsctl.c:424
nfsctl_transaction_write+0x105/0x150 fs/nfsd/nfsctl.c:114
vfs_write+0x2dc/0x9a0 fs/read_write.c:582
ksys_write+0x14d/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa77f99e159
RSP: 002b:00007fa7808d7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fa77fc26090 RCX: 00007fa77f99e159
RDX: 0000000000000002 RSI: 0000200000000140 RDI: 0000000000000005
RBP: 00007fa77fa3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa77fc26128 R14: 00007fa77fc26090 R15: 00007ffc9d824528
Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8cb2e230 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffffffff8cb2ea50 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/27:
#0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6669
1 lock held by dhcpcd/3933:
#0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
2 locks held by kworker/0:6/4326:
#0: ffff888017472138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc900041d7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
3 locks held by kworker/1:14/4673:
3 locks held by kworker/u4:8/5334:
#0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc9000d827d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263
1 lock held by getty/7173:
3 locks held by kworker/u4:18/22145:
#0: ffff8881452b8138 ((wq_completion)cfg80211){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90003677d00 ((work_completion)(&(&rdev->dfs_update_channels_wk)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: cfg80211_dfs_channels_update_work+0xc8/0x610 net/wireless/mlme.c:932
3 locks held by syz.0.6948/25275:
#0: ffff888062c62368 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 fs/file.c:1038
#1: ffff888055b8c460 (sb_writers#43){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 fs/read_write.c:580
#2: ffffffff8cdccf08 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb3/0xb80 fs/nfsd/nfsctl.c:846
3 locks held by syz.0.6948/25276:
#0: ffff888067624ae8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 fs/file.c:1038
#1: ffff888055b8c460 (sb_writers#43){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 fs/read_write.c:580
#2: ffffffff8cdccf08 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_svc+0x61/0xab0 fs/nfsd/nfssvc.c:783
2 locks held by syz.7.7572/27814:
#0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3506
#1: ffffffff8cb33578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
#1: ffffffff8cb33578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962
1 lock held by syz.3.7577/27832:
#0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x3f3/0x1ed0 drivers/net/tun.c:3118
1 lock held by syz.3.7577/27837:
#0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x27f/0x1bf0 net/ipv4/devinet.c:1080
1 lock held by syz.2.7578/27834:
#0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
3 locks held by syz.2.7578/27836:
#0: ffffffff8ddb7a50 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860
#1: ffffffff8ddb7868 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
#1: ffffffff8ddb7868 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x107/0x790 net/netlink/genetlink.c:848
#2: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: team_nl_cmd_options_set+0xab/0xe80 drivers/net/team/team.c:2578
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0xf0e/0xf50 kernel/hung_task.c:377
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 15067 Comm: kworker/u4:2 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: bat_events batadv_nc_worker
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:84 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x6e/0x290 mm/kasan/generic.c:189
Code: 49 ba 00 00 00 00 00 fc ff df 4f 8d 1c 16 4c 8d 44 3e ff 4d 89 c1 49 c1 e9 03 4b 8d 1c 21 49 89 df 4d 29 df 49 83 ff 10 7f 29 <4d> 85 ff 0f 84 38 01 00 00 4c 89 cb 48 f7 d3 4c 01 f3 41 80 3b 00
RSP: 0018:ffffc900034b7750 EFLAGS: 00000083
RAX: 0000000000000001 RBX: fffffbfff2166664 RCX: ffffffff8164166e
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90b33318
RBP: ffffc900034b79c8 R08: ffffffff90b3331f R09: 1ffffffff2166663
R10: dffffc0000000000 R11: fffffbfff2166663 R12: dffffc0000000001
R13: ffff88801d6c3c00 R14: 1ffffffff2166663 R15: 0000000000000001
FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f06f71f9de8 CR3: 000000007717a000 CR4: 00000000003506e0
DR0: 0000000000000004 DR1: 00000000000001f8 DR2: 0000000000000001
DR3: 0000000000000048 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
instrument_atomic_read include/linux/instrumented.h:72 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
hlock_class kernel/locking/lockdep.c:228 [inline]
__lock_acquire+0x116e/0x7ea0 kernel/locking/lockdep.c:5167
lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:126 [inline]
_raw_spin_lock_bh+0x32/0x50 kernel/locking/spinlock.c:178
spin_lock_bh include/linux/spinlock.h:356 [inline]
batadv_nc_purge_paths+0xe2/0x3a0 net/batman-adv/network-coding.c:442
batadv_nc_worker+0x31e/0x600 net/batman-adv/network-coding.c:720
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295