INFO: task syz.0.251:8883 blocked for more than 143 seconds. Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.251 state:D stack:28744 pid:8883 tgid:8826 ppid:5817 task_flags:0x400040 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x168f/0x4c70 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0x165/0x360 kernel/sched/core.c:6860 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917 rwsem_down_write_slowpath+0xbec/0x1030 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write_nested+0x1b5/0x200 kernel/locking/rwsem.c:1694 inode_lock_nested include/linux/fs.h:902 [inline] filename_create+0x1f9/0x470 fs/namei.c:4132 do_mkdirat+0xa0/0x590 fs/namei.c:4384 __do_sys_mkdirat fs/namei.c:4409 [inline] __se_sys_mkdirat fs/namei.c:4407 [inline] __x64_sys_mkdirat+0x87/0xa0 fs/namei.c:4407 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2f7198e969 RSP: 002b:00007f2f72818038 EFLAGS: 00000246 ORIG_RAX: 0000000000000102 RAX: ffffffffffffffda RBX: 00007f2f71bb6080 RCX: 00007f2f7198e969 RDX: 0000000000000010 RSI: 00002000000000c0 RDI: ffffffffffffff9c RBP: 00007f2f71a10ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f2f71bb6080 R15: 00007ffd83ae0778 INFO: task syz.0.251:8890 blocked for more than 144 seconds. Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.251 state:D stack:28952 pid:8890 tgid:8826 ppid:5817 task_flags:0x400040 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x168f/0x4c70 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0x165/0x360 kernel/sched/core.c:6860 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917 rwsem_down_read_slowpath+0x552/0x880 kernel/locking/rwsem.c:1084 __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x98/0x2e0 kernel/locking/rwsem.c:1526 inode_lock_shared include/linux/fs.h:877 [inline] lookup_slow+0x46/0x70 fs/namei.c:1833 walk_component+0x2d2/0x400 fs/namei.c:2138 lookup_last fs/namei.c:2636 [inline] path_lookupat+0x163/0x430 fs/namei.c:2660 filename_lookup+0x212/0x570 fs/namei.c:2689 user_path_at+0x3a/0x60 fs/namei.c:3120 do_mount fs/namespace.c:4218 [inline] __do_sys_mount fs/namespace.c:4432 [inline] __se_sys_mount+0x2d3/0x410 fs/namespace.c:4409 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2f7198e969 RSP: 002b:00007f2f727f7038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f2f71bb6160 RCX: 00007f2f7198e969 RDX: 0000200000000000 RSI: 00002000000064c0 RDI: 0000000000000000 RBP: 00007f2f71a10ab1 R08: 0000200000006540 R09: 0000000000000000 R10: 0000000000040420 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f2f71bb6160 R15: 00007ffd83ae0778 Showing all locks held in the system: 1 lock held by ksoftirqd/0/15: 1 lock held by khungtaskd/31: #0: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8df3dee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6764 3 locks held by kworker/u8:5/1037: #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc9000382fc60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000382fc60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303 6 locks held by kworker/u8:6/1152: #0: ffff88801aef3948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801aef3948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc90003c1fc60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90003c1fc60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8f2dbd50 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x145/0xbd0 net/core/net_namespace.c:608 #3: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: caif_exit_net+0x6a/0x4a0 net/caif/caif_dev.c:528 #4: ffff8880293e2880 (&caifn->caifdevs.lock){+.+.}-{4:4}, at: caif_exit_net+0x7d/0x4a0 net/caif/caif_dev.c:529 #5: ffffffff8df439b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:304 [inline] #5: ffffffff8df439b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f4/0x730 kernel/rcu/tree_exp.h:998 4 locks held by kworker/u8:7/3024: #0: ffff88801d6e1948 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801d6e1948 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc9000ad57c60 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000ad57c60 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffff88807b5620e0 (&type->s_umount_key#93){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:562 #3: ffff88805895c250 (&jfs_ip->commit_mutex){+.+.}-{4:4}, at: jfs_commit_inode+0x1ca/0x530 fs/jfs/inode.c:102 1 lock held by dhcpcd/5483: #0: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x323/0x1b50 net/ipv4/devinet.c:1121 2 locks held by getty/5577: #0: ffff888030e540a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002ffe2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 3 locks held by kworker/0:4/5869: #0: ffff88801a080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801a080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc90004587c60 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90004587c60 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8df43880 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x570 kernel/rcu/tree.c:3774 5 locks held by syz.0.251/8827: 2 locks held by syz.0.251/8883: #0: ffff88807b562420 (sb_writers#26){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:556 #1: ffff88805895c600 (&type->i_mutex_dir_key#15/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:902 [inline] #1: ffff88805895c600 (&type->i_mutex_dir_key#15/1){+.+.}-{4:4}, at: filename_create+0x1f9/0x470 fs/namei.c:4132 1 lock held by syz.0.251/8890: #0: ffff88805895c600 (&type->i_mutex_dir_key#15){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:877 [inline] #0: ffff88805895c600 (&type->i_mutex_dir_key#15){++++}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1833 5 locks held by kworker/u8:10/11841: 3 locks held by kworker/u8:11/12568: #0: ffff888030595948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff888030595948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc9001876fc60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9001876fc60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0 net/ipv6/addrconf.c:4198 1 lock held by syz-executor/13893: #0: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 net/core/rtnetlink.c:4064 1 lock held by syz-executor/14722: #0: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f2e8888 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 net/core/rtnetlink.c:4064 2 locks held by syz.7.441/15163: 5 locks held by syz.7.441/15241: 7 locks held by syz.4.438/15178: #0: ffff8880664780e0 (&type->s_umount_key#61/1){+.+.}-{4:4}, at: alloc_super+0x204/0x970 fs/super.c:344 #1: ffff888066478610 (sb_internal#4){.+.+}-{0:0}, at: btrfs_rebuild_free_space_tree+0xb1/0x4e0 fs/btrfs/free-space-tree.c:1317 #2: ffff888049e9e4d0 (btrfs_trans_num_writers){++++}-{0:0}, at: join_transaction+0x164/0xd70 fs/btrfs/transaction.c:320 #3: ffff888049e9e4f8 (btrfs_trans_num_extwriters){++++}-{0:0}, at: join_transaction+0x164/0xd70 fs/btrfs/transaction.c:320 #4: ffff8880b89399d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:605 #5: ffff8880643948d8 (&fs_devs->device_list_mutex){+.+.}-{4:4}, at: write_all_supers+0x12ab/0x3d10 fs/btrfs/disk-io.c:4102 #6: ffff8881412b2828 (&p->pi_lock){-.-.}-{2:2}, at: class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:557 [inline] #6: ffff8881412b2828 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0x6e/0x1290 kernel/sched/core.c:4212 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline] watchdog+0xfee/0x1030 kernel/hung_task.c:437 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 14722 Comm: syz-executor Not tainted 6.15.0-rc7-syzkaller-00142-g4856ebd99715 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:lock_is_held_type+0x51/0x190 kernel/locking/lockdep.c:5931 Code: af 2e 04 00 0f 84 fe 00 00 00 65 8b 05 a8 51 23 07 85 c0 0f 85 ef 00 00 00 65 4c 8b 2c 25 08 a0 72 92 41 83 bd ec 0a 00 00 00 <0f> 85 d8 00 00 00 89 f5 49 89 fe 48 c7 04 24 00 00 00 00 9c 8f 04 RSP: 0018:ffffc900000079d8 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 9aa6e3140ad92d00 RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffff8df3dfa0 RBP: ffffc90000007aa8 R08: ffffffff8f7e0b77 R09: 1ffffffff1efc16e R10: dffffc0000000000 R11: fffffbfff1efc16f R12: dffffc0000000000 R13: ffff88802f269e00 R14: 1ffff92000000f44 R15: dffffc0000000000 FS: 000055557349d500(0000) GS:ffff8881260f6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2c1cc1f000 CR3: 000000006f4a0000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_is_held include/linux/lockdep.h:249 [inline] rcu_read_lock_sched_held+0x89/0x100 kernel/rcu/update.c:126 task_css_set include/linux/cgroup.h:422 [inline] task_dfl_cgroup include/linux/cgroup.h:491 [inline] cgroup_account_cputime include/linux/cgroup.h:717 [inline] update_curr_task+0x11c/0x330 kernel/sched/fair.c:1173 update_curr+0x380/0x8b0 kernel/sched/fair.c:1247 check_preempt_wakeup_fair+0x5c9/0xe20 kernel/sched/fair.c:8818 wakeup_preempt+0xf1/0x280 kernel/sched/core.c:2196 ttwu_do_activate+0x211/0x8b0 kernel/sched/core.c:3733 ttwu_queue kernel/sched/core.c:4000 [inline] try_to_wake_up+0x745/0x1290 kernel/sched/core.c:4328 hrtimer_wakeup+0x4e/0x60 kernel/time/hrtimer.c:1997 __run_hrtimer kernel/time/hrtimer.c:1761 [inline] __hrtimer_run_queues+0x52c/0xc60 kernel/time/hrtimer.c:1825 hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1887 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline] __sysvec_apic_timer_interrupt+0x108/0x410 arch/x86/kernel/apic/apic.c:1055 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2061 [inline] RIP: 0010:vprintk_emit+0x58f/0x7a0 kernel/printk/printk.c:2449 Code: 85 32 01 00 00 e8 d1 f2 1e 00 41 89 df 4d 85 f6 48 8b 1c 24 75 07 e8 c0 f2 1e 00 eb 06 e8 b9 f2 1e 00 fb 48 c7 c7 00 21 f3 8d <31> f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00 45 31 c9 53 e8 f9 3f RSP: 0018:ffffc9001b2ee9c0 EFLAGS: 00000293 RAX: ffffffff81a0fe27 RBX: ffffffff81a0fce4 RCX: ffff88802f269e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8df32100 RBP: ffffc9001b2eead0 R08: ffffffff8f7e0b77 R09: 1ffffffff1efc16e R10: dffffc0000000000 R11: fffffbfff1efc16f R12: dffffc0000000000 R13: 1ffff9200365dd3c R14: 0000000000000200 R15: 0000000000000025 _printk+0xcf/0x120 kernel/printk/printk.c:2475 netdev_info+0x10a/0x160 net/core/dev.c:12450 team_port_add drivers/net/team/team_core.c:1307 [inline] team_add_slave+0x22d7/0x2840 drivers/net/team/team_core.c:1989 do_set_master+0x533/0x6d0 net/core/rtnetlink.c:2946 do_setlink+0xd47/0x40d0 net/core/rtnetlink.c:3159 rtnl_changelink net/core/rtnetlink.c:3769 [inline] __rtnl_newlink net/core/rtnetlink.c:3928 [inline] rtnl_newlink+0x160b/0x1c70 net/core/rtnetlink.c:4065 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6955 netlink_rcv_skb+0x21c/0x490 net/netlink/af_netlink.c:2534 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x758/0x8d0 net/netlink/af_netlink.c:1339 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 __sys_sendto+0x3bd/0x520 net/socket.c:2180 __do_sys_sendto net/socket.c:2187 [inline] __se_sys_sendto net/socket.c:2183 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2183 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f65dcf907fc Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b RSP: 002b:00007ffd0c156550 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f65ddce4620 RCX: 00007f65dcf907fc RDX: 0000000000000028 RSI: 00007f65ddce4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffd0c1565a4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f65ddce4670 R15: 0000000000000000