INFO: task syz-executor:5627 blocked for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22552 pid:5627  tgid:5627  ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 __schedule_loop kernel/sched/core.c:7268 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7283
 bit_wait+0x11/0xd0 kernel/sched/wait_bit.c:240
 __wait_on_bit+0xb9/0x310 kernel/sched/wait_bit.c:52
 out_of_line_wait_on_bit+0x13b/0x190 kernel/sched/wait_bit.c:67
 wait_on_bit include/linux/wait_bit.h:77 [inline]
 gfs2_glock_wait+0xbd/0x2a0 fs/gfs2/glock.c:1268
 gfs2_glock_nq_init fs/gfs2/glock.h:253 [inline]
 __gfs2_lookup+0x134/0x2a0 fs/gfs2/inode.c:998
 __lookup_slow+0x2b7/0x410 fs/namei.c:1915
 lookup_slow+0x53/0x70 fs/namei.c:1932
 walk_component fs/namei.c:2278 [inline]
 lookup_last fs/namei.c:2785 [inline]
 path_lookupat+0x3f5/0x8c0 fs/namei.c:2809
 filename_lookup+0x256/0x5d0 fs/namei.c:2838
 user_path_at+0x40/0x160 fs/namei.c:3643
 ksys_umount fs/namespace.c:2062 [inline]
 __do_sys_umount fs/namespace.c:2070 [inline]
 __se_sys_umount fs/namespace.c:2068 [inline]
 __x64_sys_umount+0xf6/0x170 fs/namespace.c:2068
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f561e59e097
RSP: 002b:00007fff29627958 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 00007f561e6321ca RCX: 00007f561e59e097
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff29627a10
RBP: 00007fff29627a10 R08: 0000000000000000 R09: 00000000ffffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff29628b00
R13: 00007f561e6321ca R14: 000000000005e00b R15: 00007fff2962acc0
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
 #0: ffffffff8e95cce0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e95cce0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #0: ffffffff8e95cce0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
5 locks held by kworker/u8:3/48:
 #0: ffff88801bafe140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
 #0: ffff88801bafe140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3397
 #1: ffffc90000b87c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3290 [inline]
 #1: ffffc90000b87c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3397
 #2: ffffffff8fdb9228 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 net/core/net_namespace.c:673
 #3: ffffffff8fdc7f00 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0xe5/0x9e0 net/core/dev.c:13062
 #4: ffffffff8e962fe8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
 #4: ffffffff8e962fe8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:961
2 locks held by getty/5380:
 #0: ffff8880326200a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 drivers/tty/n_tty.c:2211
1 lock held by syz-executor/5627:
 #0: ffff888053314760 (&type->i_mutex_dir_key#22){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1044 [inline]
 #0: ffff888053314760 (&type->i_mutex_dir_key#22){++++}-{4:4}, at: lookup_slow+0x46/0x70 fs/namei.c:1931
4 locks held by kworker/1:5/5783:
 #0: ffff888022293540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
 #0: ffff888022293540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3397
 #1: ffffc90004b37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3290 [inline]
 #1: ffffc90004b37c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3397
 #2: ffff88802a0981d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
 #2: ffff88802a0981d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 drivers/usb/core/hub.c:5899
 #3: ffff88801b38c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
 #3: ffff88801b38c1d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1076
4 locks held by udevd/6220:
 #0: ffff888041147ab8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 fs/seq_file.c:183
 #1: ffff888056099c80 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 fs/kernfs/file.c:172
 #2: ffff88804064bd28 (kn->active#31){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
 #2: ffff88804064bd28 (kn->active#31){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:173
 #3: ffff88801b38c1d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1045 [inline]
 #3: ffff88801b38c1d8 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
2 locks held by kworker/u8:18/8496:
 #0: ffff88801d7c5140 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
 #0: ffff88801d7c5140 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3397
 #1: ffffc900030a7c40 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3290 [inline]
 #1: ffffc900030a7c40 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3397
2 locks held by syz-executor/10994:
 #0: ffffffff8fdb9228 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:575
 #1: ffffffff8fdc7f00 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146
2 locks held by syz.1.1043/11075:
 #0: ffff88807aa57540 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1029 [inline]
 #0: ffff88807aa57540 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release net/socket.c:721 [inline]
 #0: ffff88807aa57540 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x9b/0x240 net/socket.c:1514
 #1: ffffffff8fdc7f00 (rtnl_mutex){+.+.}-{4:4}, at: mrtsock_destruct+0xeb/0x320 net/ipv4/ipmr.c:1381
1 lock held by syz.4.1051/11114:
 #0: ffffffff8fdc7f00 (rtnl_mutex){+.+.}-{4:4}, at: do_ip_setsockopt+0xefa/0x2ea0 net/ipv4/ip_sockglue.c:1077
2 locks held by dhcpcd-run-hook/11137:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xfd3/0x1030 kernel/hung_task.c:561
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 11138 Comm: dhcpcd-run-hook Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:srso_alias_safe_ret+0x5/0x7 arch/x86/lib/retpoline.S:213
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8d 64 24 08 <c3> cc e8 f4 ff ff ff 0f 0b cc cc cc cc cc cc cc cc cc cc cc cc cc
RSP: 0018:ffffc90003706f38 EFLAGS: 00000293
RAX: ffffffff8ba0a283 RBX: 0000000000000005 RCX: ffff88802f57dd00
RDX: 0000000000000000 RSI: 00007ffdb9e1bfff RDI: 00007fba3f310fff
RBP: ffffc90003707130 R08: ffff88802f57dd00 R09: 0000000000000005
R10: 0000000000000004 R11: 0000000000000000 R12: ffff88803691d830
R13: 00007ffdb9e1bfff R14: 00007fba3f310fff R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88812529e000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdb9e3af10 CR3: 0000000079b6f000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 mas_validate_limits lib/maple_tree.c:6833 [inline]
 mt_validate+0xcb3/0x41f0 lib/maple_tree.c:6947
 validate_mm+0xd4/0x4c0 mm/vma.c:652
 __split_vma+0x916/0xa50 mm/vma.c:570
 vms_gather_munmap_vmas+0x32d/0x1380 mm/vma.c:1427
 __mmap_setup mm/vma.c:2439 [inline]
 __mmap_region mm/vma.c:2753 [inline]
 mmap_region+0x921/0x22a0 mm/vma.c:2857
 do_mmap+0xc39/0x10c0 mm/mmap.c:560
 vm_mmap_pgoff+0x2c9/0x4f0 mm/util.c:581
 ksys_mmap_pgoff+0x51e/0x760 mm/mmap.c:606
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fba3f2fc242
Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00
RSP: 002b:00007ffdb9e3aef8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fba3f21e000 RCX: 00007fba3f2fc242
RDX: 0000000000000005 RSI: 0000000000086000 RDI: 00007fba3f21e000
RBP: 0000000000000812 R08: 0000000000000003 R09: 0000000000010000
R10: 0000000000000812 R11: 0000000000000206 R12: 00007ffdb9e3af48
R13: 00007fba3f2d00c0 R14: 00007ffdb9e3b300 R15: 00000fffb73c75e2
 </TASK>