INFO: task rcu_tasks_kthre:12 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:rcu_tasks_kthre state:D stack:27888 pid:12 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138 __synchronize_srcu+0x2b3/0x350 kernel/rcu/srcutree.c:1243 rcu_tasks_wait_gp+0x49f/0xac0 kernel/rcu/tasks.h:693 rcu_tasks_one_gp+0xd27/0xef0 kernel/rcu/tasks.h:534 rcu_tasks_kthread+0x6e/0x90 kernel/rcu/tasks.h:562 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8cb2e230 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8cb2ea50 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517 1 lock held by khungtaskd/28: #0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6669 2 locks held by getty/4031: #0: ffff88802ff3a098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 drivers/tty/n_tty.c:2198 3 locks held by kworker/1:3/4279: #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90004217d00 (fqdir_free_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffffffff8cb33440 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x48/0x5e0 kernel/rcu/tree.c:4023 2 locks held by kworker/0:5/4327: #0: ffff888017472138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90004767d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 4 locks held by kworker/u4:17/12977: #0: ffff88801761e938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90004c27d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd49ed0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:594 #3: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: fib_net_exit_batch+0x1c/0x90 net/ipv4/fib_frontend.c:1652 3 locks held by syz.4.5636/23744: 1 lock held by syz.4.5636/23750: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz.5.5639/23751: ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xf0e/0xf50 kernel/hung_task.c:377 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 23751 Comm: syz.5.5639 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 RIP: 0010:kasan_check_range+0x1b2/0x290 mm/kasan/generic.c:-1 Code: 01 f3 49 89 df 49 8d 5f 07 4d 85 ff 49 0f 49 df 48 83 e3 f8 49 29 df 74 0e 41 80 3b 00 75 69 49 ff c3 49 ff cf 75 f2 5b 41 5c <41> 5e 41 5f 5d c3 45 84 ff 0f 85 91 00 00 00 41 f7 c7 00 ff 00 00 RSP: 0018:ffffc90000007640 EFLAGS: 00000056 RAX: 0000000000000001 RBX: 000000000000004a RCX: ffffffff81640c12 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90b33248 RBP: ffffc900000078a8 R08: ffffffff90b3324f R09: 1ffffffff2166649 R10: dffffc0000000000 R11: fffffbfff216664a R12: ffff88802c75c6c4 R13: ffff88802c75bc00 R14: 1ffffffff2166649 R15: 0000000000000001 FS: 00007f62967f66c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f62967d5d58 CR3: 0000000060adf000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: instrument_atomic_read include/linux/instrumented.h:72 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] hlock_class kernel/locking/lockdep.c:228 [inline] check_wait_context kernel/locking/lockdep.c:4802 [inline] __lock_acquire+0x712/0x7ea0 kernel/locking/lockdep.c:5121 lock_acquire+0x1bc/0x4a0 kernel/locking/lockdep.c:5790 seqcount_lockdep_reader_access+0xcd/0x1d0 include/linux/seqlock.h:102 ktime_get+0x31/0x270 kernel/time/timekeeping.c:846 hrtimer_forward_now include/linux/hrtimer.h:509 [inline] perf_swevent_hrtimer+0x4f8/0x630 kernel/events/core.c:10982 __run_hrtimer kernel/time/hrtimer.c:1751 [inline] __hrtimer_run_queues+0x4e7/0xc90 kernel/time/hrtimer.c:1815 hrtimer_interrupt+0x399/0x980 kernel/time/hrtimer.c:1877 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline] __sysvec_apic_timer_interrupt+0x153/0x5a0 arch/x86/kernel/apic/apic.c:1124 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:unwind_next_frame+0x715/0x1fd0 arch/x86/kernel/unwind_orc.c:-1 Code: 0f b6 04 2a 84 c0 0f 85 8a 12 00 00 41 0f b6 45 01 83 e0 03 ff 24 c5 b0 87 89 8a 48 89 54 24 18 4c 89 74 24 50 4c 89 7c 24 08 <4c> 89 64 24 20 48 8d 7b 08 49 89 ff 49 c1 ef 03 41 80 3c 2f 00 74 RSP: 0018:ffffc90004cfea40 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffc90004cfeae8 RCX: ffffffff8e8722f4 RDX: 1ffffffff1e44bb5 RSI: ffffffff8e8722f0 RDI: 0000000000000001 RBP: dffffc0000000000 R08: 0000000000000009 R09: 0000000000000009 R10: dffffc0000000000 R11: fffff5200099fd69 R12: ffffffff8f225da6 R13: ffffffff8f225daa R14: ffffffff8f225dab R15: 1ffffffff1e44bb5 arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 ____kasan_kmalloc mm/kasan/common.c:375 [inline] __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384 kmalloc include/linux/slab.h:563 [inline] kzalloc include/linux/slab.h:699 [inline] ref_tracker_alloc+0x14f/0x490 lib/ref_tracker.c:85 __netdev_tracker_alloc include/linux/netdevice.h:4049 [inline] netdev_hold include/linux/netdevice.h:4078 [inline] dst_init+0xb1/0x400 net/core/dst.c:52 dst_alloc+0x12a/0x160 net/core/dst.c:92 rt_dst_alloc net/ipv4/route.c:1689 [inline] __mkroute_output net/ipv4/route.c:2655 [inline] ip_route_output_key_hash_rcu+0x14e4/0x23f0 net/ipv4/route.c:2877 ip_route_output_key_hash+0x1ef/0x330 net/ipv4/route.c:2706 __ip_route_output_key include/net/route.h:137 [inline] ip_route_output_flow+0x26/0x150 net/ipv4/route.c:2936 ip_route_output_key include/net/route.h:147 [inline] ip_tunnel_xmit+0x9a2/0x25d0 net/ipv4/ip_tunnel.c:780 __gre_xmit net/ipv4/ip_gre.c:474 [inline] ipgre_xmit+0x7e4/0xb60 net/ipv4/ip_gre.c:669 __netdev_start_xmit include/linux/netdevice.h:4894 [inline] netdev_start_xmit include/linux/netdevice.h:4908 [inline] xmit_one net/core/dev.c:3695 [inline] dev_hard_start_xmit+0x292/0x8b0 net/core/dev.c:3711 __dev_queue_xmit+0x1b4b/0x3810 net/core/dev.c:4375 dev_queue_xmit include/linux/netdevice.h:3056 [inline] __bpf_tx_skb net/core/filter.c:2143 [inline] __bpf_redirect_no_mac net/core/filter.c:2177 [inline] __bpf_redirect+0x8c7/0x1110 net/core/filter.c:2200 ____bpf_clone_redirect net/core/filter.c:2482 [inline] bpf_clone_redirect+0x311/0x4a0 net/core/filter.c:2445 bpf_prog_208b094576c80b22+0x56/0x5b bpf_dispatcher_nop_func include/linux/bpf.h:1013 [inline] __bpf_prog_run include/linux/filter.h:608 [inline] bpf_prog_run include/linux/filter.h:615 [inline] bpf_test_run+0x2b6/0x830 net/bpf/test_run.c:402 bpf_prog_test_run_skb+0xdaf/0x18e0 net/bpf/test_run.c:1222 bpf_prog_test_run+0x31c/0x390 kernel/bpf/syscall.c:3695 __sys_bpf+0x62b/0x780 kernel/bpf/syscall.c:5053 __do_sys_bpf kernel/bpf/syscall.c:5139 [inline] __se_sys_bpf kernel/bpf/syscall.c:5137 [inline] __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5137 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f629859e199 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f62967f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 00007f6298825fa0 RCX: 00007f629859e199 RDX: 0000000000000050 RSI: 0000200000000080 RDI: 000000000000000a RBP: 00007f62986358e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6298826038 R14: 00007f6298825fa0 R15: 00007ffe9c21f318