INFO: task kworker/u8:16:5937 blocked for more than 143 seconds. Not tainted 6.15.0-rc5-syzkaller-00043-gd76bb1ebb558 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:16 state:D stack:21368 pid:5937 tgid:5937 ppid:2 task_flags:0x4208060 flags:0x00004000 Workqueue: events_unbound flush_to_ldisc Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x16e2/0x4cd0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0x165/0x360 kernel/sched/core.c:6860 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 commit_echoes drivers/tty/n_tty.c:740 [inline] n_tty_receive_char+0x683/0xc30 drivers/tty/n_tty.c:1421 n_tty_receive_buf_standard+0x5e2/0x5150 drivers/tty/n_tty.c:1590 __receive_buf drivers/tty/n_tty.c:1624 [inline] n_tty_receive_buf_common+0xab3/0x12f0 drivers/tty/n_tty.c:1723 tty_port_default_receive_buf+0x6e/0xa0 drivers/tty/tty_port.c:37 receive_buf drivers/tty/tty_buffer.c:445 [inline] flush_to_ldisc+0x2c2/0x810 drivers/tty/tty_buffer.c:495 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 1 lock held by kthreadd/2: 4 locks held by kworker/R-netns/8: #0: ffff88801aef6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801aef6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc900000d7c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc900000d7c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8f2e7c90 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x145/0xbd0 net/core/net_namespace.c:608 #3: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1c/0x1d0 drivers/net/wireguard/device.c:416 1 lock held by khungtaskd/31: #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6764 3 locks held by kworker/u8:3/53: 3 locks held by kworker/u8:7/1164: 3 locks held by kworker/R-ipv6_/3168: #0: ffff88802fa72948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88802fa72948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc9000b507c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000b507c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0 net/ipv6/addrconf.c:4195 1 lock held by klogd/5188: 1 lock held by udevd/5199: 2 locks held by dhcpcd/5493: 2 locks held by dhcpcd/5494: 2 locks held by getty/5592: #0: ffff8880305bb0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002ffe2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 2 locks held by kworker/0:7/5922: 4 locks held by kworker/u8:9/5930: 3 locks held by kworker/u8:11/5932: #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc9000458fc60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000458fc60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303 1 lock held by kworker/u8:14/5935: 6 locks held by kworker/u8:16/5937: #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc900045bfc60 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc900045bfc60 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffff88801a0a10b8 (&buf->lock){+.+.}-{4:4}, at: flush_to_ldisc+0x38/0x810 drivers/tty/tty_buffer.c:467 #3: ffff8880516220a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1c/0x90 drivers/tty/tty_ldisc.c:263 #4: ffff8880516222e8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_receive_buf_common+0x84/0x12f0 drivers/tty/n_tty.c:1686 #5: ffffc9000679d380 (&ldata->output_lock){+.+.}-{4:4}, at: commit_echoes drivers/tty/n_tty.c:740 [inline] #5: ffffc9000679d380 (&ldata->output_lock){+.+.}-{4:4}, at: n_tty_receive_char+0x683/0xc30 drivers/tty/n_tty.c:1421 4 locks held by kworker/u8:17/5938: 4 locks held by kworker/u8:20/5941: 3 locks held by kworker/1:17/6226: 1 lock held by syz.0.485/7844: 2 locks held by syz.0.497/7901: 2 locks held by syz.0.938/9702: 1 lock held by syz.1.972/9849: #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline] #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390 2 locks held by syz.0.988/9905: 1 lock held by syz.3.1001/9956: 1 lock held by syz.0.1015/10017: 1 lock held by syz.2.1352/11281: #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline] #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390 1 lock held by syz.4.1367/11325: #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline] #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390 2 locks held by syz.1.1380/11366: 1 lock held by syz.1.1392/11421: #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline] #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390 1 lock held by syz.2.1406/11470: #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline] #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390 1 lock held by syz.1.1407/11472: #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline] #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390 2 locks held by syz.0.1420/11521: 6 locks held by syz.3.1788/12928: 2 locks held by syz.2.1795/12952: #0: ffffffff8f2e7c90 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x317/0x590 net/core/net_namespace.c:514 #1: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: mpls_net_exit+0x79/0x270 net/mpls/af_mpls.c:2706 1 lock held by syz.0.1796/12965: #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline] #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390 2 locks held by syz-executor/12987: #0: ffffffff8f2e7c90 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x317/0x590 net/core/net_namespace.c:514 #1: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2029 3 locks held by syz-executor/12990: 1 lock held by syz.1.1802/12992: #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:633 [inline] #0: ffffffff8f2f47c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390 4 locks held by kworker/u8:0/12996: 4 locks held by kworker/u8:1/12998: 2 locks held by kworker/u8:2/12999: #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc9000afe7c60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc9000afe7c60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 2 locks held by kworker/u8:4/13000: 3 locks held by modprobe/13001: 5 locks held by syz-executor/13002: 4 locks held by kworker/u8:5/13004: 2 locks held by syz-executor/13005: 3 locks held by udevd/13006: 3 locks held by kworker/u8:6/13007: ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc5-syzkaller-00043-gd76bb1ebb558 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline] watchdog+0xfee/0x1030 kernel/hung_task.c:437 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 53 Comm: kworker/u8:3 Not tainted 6.15.0-rc5-syzkaller-00043-gd76bb1ebb558 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/29/2025 Workqueue: bat_events batadv_tt_purge RIP: 0010:unwind_next_frame+0x7f/0x2390 arch/x86/kernel/unwind_orc.c:471 Code: 89 44 24 58 80 3c 28 00 74 08 4c 89 ef e8 29 1b b0 00 4d 8b 7e 38 4d 89 f4 49 c1 ec 03 41 0f b6 04 2c 84 c0 0f 85 de 1b 00 00 <41> 8b 06 85 c0 0f 84 32 02 00 00 89 84 24 84 00 00 00 4c 89 bc 24 RSP: 0018:ffffc900000068d8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffffff8a3aa738 RCX: 54ebd05207b54b00 RDX: dffffc0000000000 RSI: ffffffff8a3aa738 RDI: ffffc900000069a8 RBP: dffffc0000000000 R08: ffffc90000006a70 R09: 000000000000000d R10: ffffc900000069f8 R11: ffffffff81acbbf0 R12: 1ffff92000000d35 R13: ffffc900000069e0 R14: ffffc900000069a8 R15: ffffc90000007568 FS: 0000000000000000(0000) GS:ffff8881260cb000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe4930b8000 CR3: 000000000dd36000 CR4: 00000000003526f0 Call Trace: arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2380 [inline] slab_free mm/slub.c:4642 [inline] kmem_cache_free+0x192/0x3f0 mm/slub.c:4744 kfree_skb_reason include/linux/skbuff.h:1279 [inline] kfree_skb include/linux/skbuff.h:1288 [inline] ip6_mc_input+0x9c3/0xbe0 net/ipv6/ip6_input.c:591 ip_sabotage_in+0x1de/0x270 net/bridge/br_netfilter_hooks.c:993 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc2/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK+0x206/0x3a0 include/linux/netfilter.h:312 __netif_receive_skb_one_core net/core/dev.c:5887 [inline] __netif_receive_skb+0xd3/0x380 net/core/dev.c:6000 netif_receive_skb_internal net/core/dev.c:6086 [inline] netif_receive_skb+0x1cb/0x790 net/core/dev.c:6145 NF_HOOK+0x9d/0x390 include/linux/netfilter.h:315 br_handle_frame_finish+0x1489/0x1950 net/bridge/br_input.c:-1 br_nf_hook_thresh+0x3bf/0x490 net/bridge/br_netfilter_hooks.c:-1 br_nf_pre_routing_finish_ipv6+0x948/0xd00 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:314 [inline] br_nf_pre_routing_ipv6+0x37e/0x6b0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_bridge_pre net/bridge/br_input.c:282 [inline] br_handle_frame+0x97f/0x14c0 net/bridge/br_input.c:433 __netif_receive_skb_core+0x10de/0x4180 net/core/dev.c:5773 __netif_receive_skb_one_core net/core/dev.c:5885 [inline] __netif_receive_skb+0x72/0x380 net/core/dev.c:6000 process_backlog+0x60e/0x14f0 net/core/dev.c:6352 __napi_poll+0xc4/0x480 net/core/dev.c:7324 napi_poll net/core/dev.c:7388 [inline] net_rx_action+0x6ea/0xdf0 net/core/dev.c:7510 handle_softirqs+0x283/0x870 kernel/softirq.c:579 do_softirq+0xec/0x180 kernel/softirq.c:480 __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline] batadv_tt_purge+0x4d1/0x9e0 net/batman-adv/translation-table.c:3510 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xadb/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 net_ratelimit: 14267 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:8a:c9:83:89:80:fd, vlan:0)