INFO: task syz.2.13760:5988 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.13760 state:D stack:27944 pid:5988 tgid:5981 ppid:5609 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5526 [inline]
__schedule+0x1259/0x6920 kernel/sched/core.c:7277
__schedule_loop kernel/sched/core.c:7354 [inline]
schedule+0xdd/0x2c0 kernel/sched/core.c:7369
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7426
__mutex_lock_common kernel/locking/mutex.c:726 [inline]
__mutex_lock+0xccb/0x1bd0 kernel/locking/mutex.c:821
nfsd_nrthreads+0x57/0xd0 fs/nfsd/nfssvc.c:252
write_threads+0x34a/0x600 fs/nfsd/nfsctl.c:445
nfsctl_transaction_write+0x106/0x1a0 fs/nfsd/nfsctl.c:114
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fce8539e159
RSP: 002b:00007fce862bf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fce85626090 RCX: 00007fce8539e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007fce8543503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fce85626128 R14: 00007fce85626090 R15: 00007ffe2d6eabe8
Showing all locks held in the system:
locks held by khungtaskd/32: 1, last CPU#0:
#0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by getty/5362: 2, on CPU#1:
#0: ffff88802a0810a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900032262e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
locks held by udevd/17929: 2, last CPU#0:
#0: ffff88801da80460 (sb_writers){.+.+}-{0:0}, at: filename_setxattr+0xbf/0x1d0 fs/xattr.c:688
#1: ffff88807e9a8e98 (&sb->s_type->i_mutex_key#4){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1024 [inline]
#1: ffff88807e9a8e98 (&sb->s_type->i_mutex_key#4){+.+.}-{4:4}, at: vfs_setxattr+0x120/0x390 fs/xattr.c:343
locks held by syz-executor/28527: 1, last CPU#1:
#0: ffff888033ec4ce0 (&xt[i].mutex){+.+.}-{4:4}, at: xt_find_table_lock+0x5a/0x520 net/netfilter/x_tables.c:1336
locks held by syz-executor/1667: 7, last CPU#1:
#0: ffffffff8ef3d970 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline]
#0: ffffffff8ef3d970 (dup_mmap_sem){++++}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline]
#0: ffffffff8ef3d970 (dup_mmap_sem){++++}-{0:0}, at: copy_process+0x4806/0x8370 kernel/fork.c:2310
#1: ffff88802b48b6b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
#1: ffff88802b48b6b8 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716
#2: ffff88807d229078 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
#2: ffff88807d229078 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723
#3: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290
#4: ffff888075c8e258 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline]
#4: ffff888075c8e258 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x10f/0x320 mm/pgtable-generic.c:404
#5: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#5: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#5: ffffffff8edec4a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x2f/0x310 mm/pgtable-generic.c:290
#6: ffff888026e1a678 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pte_range mm/memory.c:1354 [inline]
#6: ffff888026e1a678 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pmd_range mm/memory.c:1490 [inline]
#6: ffff888026e1a678 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_pud_range mm/memory.c:1527 [inline]
#6: ffff888026e1a678 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_p4d_range mm/memory.c:1551 [inline]
#6: ffff888026e1a678 (ptlock_ptr(ptdesc)#2/1){+.+.}-{3:3}, at: copy_page_range+0xfd0/0x57c0 mm/memory.c:1637
locks held by syz.2.13760/5984: 3, on CPU#1:
#0: ffff888077b060f0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259
#1: ffff88823bf2c460 (sb_writers#22){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
#2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0 fs/nfsd/nfsctl.c:867
locks held by syz.2.13760/5988: 3, on CPU#1:
#0: ffff88807d1b09b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 fs/file.c:1259
#1: ffff88823bf2c460 (sb_writers#22){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:739
#2: ffffffff8f289500 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nrthreads+0x57/0xd0 fs/nfsd/nfssvc.c:252
locks held by syz.9.14568/8382: 3, last CPU#0:
#0: ffff88804cd82e48 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x11d/0x590 mm/mmap_lock.c:310
#1: ffff88803782a558 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x17a/0x440 mm/memory.c:3816
#2: ffff8880787e5fb8 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1089 [inline]
#2: ffff8880787e5fb8 (mapping.invalidate_lock#2){++++}-{4:4}, at: ext4_page_mkwrite+0x33a/0x1860 fs/ext4/inode.c:6904
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xcb1/0x1030 kernel/hung_task.c:561
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 17478 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:debug_smp_processor_id+0x0/0x20 lib/smp_processor_id.c:57
Code: 62 8c e8 a3 4f 51 f5 e8 0e a5 a4 f5 eb b1 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 48 c7 c6 00 2e 62 8c 48 c7 c7 40 2e 62 8c e9 f9 fe ff
RSP: 0018:ffffc9000dd87638 EFLAGS: 00000083
RAX: 0000000000000001 RBX: ffffffff8edec4a0 RCX: 0000000000000001
RDX: ffff8880692aa580 RSI: ffffffff84dd807f RDI: ffffffff8edec4a0
RBP: ffffffff84dd807f R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000200 R14: 0000000000000282 R15: 00000000000000d5
FS: 00007f37b47c1880(0000) GS:ffff888123c59000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f64ddbef2f8 CR3: 0000000073dd7000 CR4: 00000000003526f0
Call Trace:
rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline]
rcu_is_watching+0x13/0xc0 kernel/rcu/tree.c:753
trace_lock_release include/trace/events/lock.h:68 [inline]
lock_release+0x24d/0x310 kernel/locking/lockdep.c:5954
rcu_lock_release include/linux/rcupdate.h:319 [inline]
rcu_read_unlock include/linux/rcupdate.h:880 [inline]
avc_reclaim_node security/selinux/avc.c:487 [inline]
avc_alloc_node+0x3e4/0x670 security/selinux/avc.c:507
avc_insert security/selinux/avc.c:617 [inline]
avc_compute_av+0x101/0x820 security/selinux/avc.c:992
avc_perm_nonode+0xb1/0x180 security/selinux/avc.c:1116
avc_has_perm_noaudit+0x2d4/0x3b0 security/selinux/avc.c:1159
selinux_inode_permission+0x8d4/0x1130 security/selinux/hooks.c:3282
security_inode_permission+0xda/0x250 security/security.c:1842
lookup_inode_permission_may_exec fs/namei.c:698 [inline]
may_lookup fs/namei.c:1961 [inline]
link_path_walk+0x2a5/0x1cc0 fs/namei.c:2604
path_lookupat+0x74/0xc40 fs/namei.c:2812
filename_lookup+0x202/0x590 fs/namei.c:2842
vfs_statx+0xff/0x3f0 fs/stat.c:353
vfs_fstatat+0x77/0xe0 fs/stat.c:373
__do_sys_newfstatat+0x9d/0x120 fs/stat.c:538
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f37b4111b0a
Code: 48 8b 15 f1 f2 0d 00 f7 d8 64 89 02 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 48 8b 15 b9 f2 0d 00 f7
RSP: 002b:00007ffcc0766958 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 0000000000006180 RCX: 00007f37b4111b0a
RDX: 00007ffcc0766980 RSI: 000056039f958620 RDI: 00000000ffffff9c
RBP: 0000000000000000 R08: 0000000000000000 R09: 000056039f9b8910
R10: 0000000000000100 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 000056039f958620 R15: 000056039f9bfd50