INFO: task syz.9.5129:27298 blocked for more than 143 seconds. Not tainted 6.13.0-rc6-syzkaller-00059-g643e2e259c2b #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.9.5129 state:D stack:27824 pid:27298 tgid:27297 ppid:20514 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0xe58/0x5ad0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6848 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905 __mutex_lock_common kernel/locking/mutex.c:665 [inline] __mutex_lock+0x62b/0xa60 kernel/locking/mutex.c:735 nfsd_nl_version_set_doit+0xc5/0x7a0 fs/nfsd/nfsctl.c:1813 genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2542 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] ____sys_sendmsg+0x9ae/0xb40 net/socket.c:2583 ___sys_sendmsg+0x135/0x1e0 net/socket.c:2637 __sys_sendmsg+0x16e/0x220 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4f9bd85d29 RSP: 002b:00007f4f9cb4a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f4f9bf75fa0 RCX: 00007f4f9bd85d29 RDX: 0000000000004010 RSI: 00000000200004c0 RDI: 0000000000000005 RBP: 00007f4f9be01b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4f9bf75fa0 R15: 00007ffc3b745228 INFO: task syz.0.5152:27415 blocked for more than 144 seconds. Not tainted 6.13.0-rc6-syzkaller-00059-g643e2e259c2b #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.5152 state:D stack:27248 pid:27415 tgid:27414 ppid:24375 flags:0x00400006 Call Trace: context_switch kernel/sched/core.c:5369 [inline] __schedule+0xe58/0x5ad0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6848 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905 __mutex_lock_common kernel/locking/mutex.c:665 [inline] __mutex_lock+0x62b/0xa60 kernel/locking/mutex.c:735 nfsd_nl_listener_set_doit+0xe3/0x1b40 fs/nfsd/nfsctl.c:1964 genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x165/0x410 net/netlink/af_netlink.c:2542 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1347 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1891 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] ____sys_sendmsg+0x9ae/0xb40 net/socket.c:2583 ___sys_sendmsg+0x135/0x1e0 net/socket.c:2637 __sys_sendmsg+0x16e/0x220 net/socket.c:2669 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcae3385d29 RSP: 002b:00007fcae11f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fcae3575fa0 RCX: 00007fcae3385d29 RDX: 0000000000004000 RSI: 00000000200020c0 RDI: 0000000000000003 RBP: 00007fcae3401b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fcae3575fa0 R15: 00007fff304b0338 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8ddbad40 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8ddbad40 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ddbad40 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6744 2 locks held by kworker/u9:0/54: #0: ffff888025761148 ((wq_completion)nbd3-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90000bf7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:1/5145: #0: ffff88802567e148 ((wq_completion)nbd0-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000fb47d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:2/5844: #0: ffff888025704948 ((wq_completion)nbd2-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90003f4fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:3/5852: #0: ffff888025723148 ((wq_completion)nbd4-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000400fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:4/5853: #0: ffff888025612948 ((wq_completion)nbd1-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000402fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:5/6303: #0: ffff888025948148 ((wq_completion)nbd8-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900180dfd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:6/6339: #0: ffff888025767948 ((wq_completion)nbd5-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000fbe7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:7/6421: #0: ffff888025996148 ((wq_completion)nbd7-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900183d7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:8/6528: #0: ffff888025929948 ((wq_completion)nbd6-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000bedfd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:9/6590: #0: ffff88802594e948 ((wq_completion)nbd10-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000bc6fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:10/6745: #0: ffff888062bb4948 ((wq_completion)nbd17-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000483fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:11/7052: #0: ffff8880259ac948 ((wq_completion)nbd9-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90003bafd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:12/7278: #0: ffff88802594f148 ((wq_completion)nbd13-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90002fd7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:13/7283: #0: ffff888025a5b148 ((wq_completion)nbd11-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90003307d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:14/7363: #0: ffff888025a79948 ((wq_completion)nbd12-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90002e57d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:15/7463: #0: ffff888025ac5948 ((wq_completion)nbd14-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000b967d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:16/7502: #0: ffff888026094148 ((wq_completion)nbd15-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000b8d7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:17/7689: #0: ffff88802938a148 ((wq_completion)nbd18-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000be2fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:18/7692: #0: ffff8880124c8148 ((wq_completion)nbd19-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000bd6fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:19/7914: #0: ffff888027020148 ((wq_completion)nbd16-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90003437d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:20/8008: #0: ffff888011c77148 ((wq_completion)nbd20-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900032a7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:21/8032: #0: ffff888063eac948 ((wq_completion)nbd22-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90003277d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:22/8066: #0: ffff88806f264948 ((wq_completion)nbd21-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900031f7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:23/8167: #0: ffff88806434b148 ((wq_completion)nbd24-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900047a7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:24/8184: #0: ffff88805bb59948 ((wq_completion)nbd23-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90002e87d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:25/8253: #0: ffff888064f7a148 ((wq_completion)nbd26-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90002f87d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:26/8261: #0: ffff888030bcc948 ((wq_completion)nbd25-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900030b7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:27/8355: #0: ffff888063cef148 ((wq_completion)nbd28-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900031e7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:28/8470: #0: ffff88806de09948 ((wq_completion)nbd34-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900183a7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:29/8577: #0: ffff8880786a9948 ((wq_completion)nbd31-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9001927fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:30/9711: #0: ffff888033688948 ((wq_completion)nbd27-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000bc3fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:31/11864: #0: ffff8880589ce148 ((wq_completion)nbd29-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90018357d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:32/11928: #0: ffff888058b7b948 ((wq_completion)nbd30-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f2bfd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by getty/12710: #0: ffff888030e320a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900048bd2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211 2 locks held by kworker/u9:33/13001: #0: ffff88807d8b0148 ((wq_completion)nbd33-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000bd0fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:34/13057: #0: ffff88802ad23948 ((wq_completion)nbd32-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000b5b7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:35/13365: #0: ffff888034863948 ((wq_completion)nbd37-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900030c7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:36/13374: #0: ffff888028764148 ((wq_completion)nbd35-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90003037d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:37/13463: #0: ffff888063800148 ((wq_completion)nbd36-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f5d7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:38/13499: #0: ffff8880277a1148 ((wq_completion)nbd51-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000fbc7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:39/13514: #0: ffff88806e119948 ((wq_completion)nbd38-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f7d7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/R-nbd39/13540: #0: ffff8880297ba948 ((wq_completion)nbd39-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90018087d18 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:40/13546: #0: ffff88804919a948 ((wq_completion)nbd40-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900180b7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:41/13611: #0: ffff88807e158148 ((wq_completion)nbd41-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90018387d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:42/14044: #0: ffff88807fca7148 ((wq_completion)nbd42-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90019477d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:43/14130: #0: ffff888030e51148 ((wq_completion)nbd43-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90018ccfd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:44/14208: #0: ffff8880630f7948 ((wq_completion)nbd44-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900189ffd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:45/14588: #0: ffff888078e5a948 ((wq_completion)nbd45-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000bb0fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:46/14722: #0: ffff888012787148 ((wq_completion)nbd46-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000be9fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:47/15142: #0: ffff888011c70948 ((wq_completion)nbd47-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90018cbfd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:48/15281: #0: ffff8880243c1948 ((wq_completion)nbd48-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90018b97d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:49/15328: #0: ffff88807f2db148 ((wq_completion)nbd49-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f5e7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:50/15349: #0: ffff888028773948 ((wq_completion)nbd50-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f5c7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:51/15380: #0: ffff88806434c948 ((wq_completion)nbd52-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90017fd7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:52/15597: #0: ffff888035399948 ((wq_completion)nbd54-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900195dfd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:53/15727: #0: ffff888064a64148 ((wq_completion)nbd53-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90019197d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:54/15783: #0: ffff88809b1a4948 ((wq_completion)nbd65-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900188b7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:55/15893: #0: ffff888022ae5148 ((wq_completion)nbd55-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000fbb7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:56/15904: #0: ffff88807d60c148 ((wq_completion)nbd56-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f8d7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:57/16028: #0: ffff88806cf2c148 ((wq_completion)nbd57-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f42fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:58/16056: #0: ffff88807e34c948 ((wq_completion)nbd58-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000bdffd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:59/16084: #0: ffff888043671148 ((wq_completion)nbd59-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90018c6fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:60/16118: #0: ffff888063963148 ((wq_completion)nbd60-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9001938fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:61/16176: #0: ffff888062da4948 ((wq_completion)nbd61-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90018e77d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:62/16301: #0: ffff88806e11a148 ((wq_completion)nbd62-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc90019047d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:63/16452: #0: ffff8880249e5948 ((wq_completion)nbd63-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f56fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:64/16485: #0: ffff888064ff9948 ((wq_completion)nbd64-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000f46fd80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:66/16572: #0: ffff888067110148 ((wq_completion)nbd66-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc900187d7d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:67/16603: #0: ffff888063bbe948 ((wq_completion)nbd67-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000b517d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 2 locks held by kworker/u9:68/16627: #0: ffff88807d798948 ((wq_completion)nbd68-recv){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000b137d80 ((work_completion)(&args->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 3 locks held by kworker/u8:27/22993: 5 locks held by kworker/u8:28/22995: #0: ffff88801baed948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000afd7d80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 #2: ffffffff8faaa150 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xbb/0xbd0 net/core/net_namespace.c:602 #3: ffffffff8fac0148 (rtnl_mutex){+.+.}-{4:4}, at: cleanup_net+0x503/0xbd0 net/core/net_namespace.c:638 #4: ffffffff8ddc6678 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x282/0x3b0 kernel/rcu/tree_exp.h:297 3 locks held by kworker/u8:30/23028: #0: ffff88814d9bd948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x12cd/0x1b30 kernel/workqueue.c:3204 #1: ffffc9000b0afd80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8bb/0x1b30 kernel/workqueue.c:3205 #2: ffffffff8fac0148 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4755 1 lock held by syz.7.4304/24168: #0: ffffffff8ddc6678 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a4/0x3b0 kernel/rcu/tree_exp.h:329 2 locks held by syz-executor/24640: #0: ffff8880246c60e0 (&type->s_umount_key#52){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline] #0: ffff8880246c60e0 (&type->s_umount_key#52){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline] #0: ffff8880246c60e0 (&type->s_umount_key#52){++++}-{4:4}, at: deactivate_super+0xd6/0x100 fs/super.c:505 #1: ffffffff8e1bb3c8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:625 2 locks held by syz-executor/26151: #0: ffff88806dab20e0 (&type->s_umount_key#52){++++}-{4:4}, at: __super_lock fs/super.c:56 [inline] #0: ffff88806dab20e0 (&type->s_umount_key#52){++++}-{4:4}, at: __super_lock_excl fs/super.c:71 [inline] #0: ffff88806dab20e0 (&type->s_umount_key#52){++++}-{4:4}, at: deactivate_super+0xd6/0x100 fs/super.c:505 #1: ffffffff8e1bb3c8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:625 1 lock held by syz.9.5129/27298: 2 locks held by syz.0.5152/27415: 2 locks held by syz.3.5322/28347: #0: ffffffff8fb5e9d0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8e1bb3c8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_get_doit+0x139/0x710 fs/nfsd/nfsctl.c:2121 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.13.0-rc6-syzkaller-00059-g643e2e259c2b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline] watchdog+0xf14/0x1240 kernel/hung_task.c:397 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 27298 Comm: syz.9.5129 Not tainted 6.13.0-rc6-syzkaller-00059-g643e2e259c2b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:55 [inline] RIP: 0010:stack_access_ok+0x0/0x200 arch/x86/kernel/unwind_orc.c:393 Code: 8b 8d 28 ff ff ff 44 8b 85 30 ff ff ff e9 b0 fe ff ff 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <48> b8 00 00 00 00 00 fc ff df 41 57 41 56 4c 8d 77 08 41 55 41 54 RSP: 0018:ffffc90000a187a0 EFLAGS: 00000283 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff90ba1512 RDX: 0000000000000008 RSI: ffffc9000b0df9a8 RDI: ffffc90000a18818 RBP: ffffc9000b0df9a8 R08: 0000000000000001 R09: ffffffff90ba1516 R10: ffffc90000a18818 R11: 000000000000e2da R12: ffffc90000a18868 R13: ffffc90000a18818 R14: ffffc9000b0df9d8 R15: ffffc9000b0df9d0 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558eee7dada8 CR3: 000000003376c000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: deref_stack_reg arch/x86/kernel/unwind_orc.c:403 [inline] unwind_next_frame+0x15dd/0x20c0 arch/x86/kernel/unwind_orc.c:648 arch_stack_walk+0x95/0x100 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kmem_cache_free+0x152/0x4c0 mm/slub.c:4715 kfree_skbmem+0x1a4/0x1f0 net/core/skbuff.c:1148 __kfree_skb net/core/skbuff.c:1205 [inline] consume_skb net/core/skbuff.c:1436 [inline] consume_skb+0xcc/0x100 net/core/skbuff.c:1430 mac80211_hwsim_tx_frame+0x1f3/0x2a0 drivers/net/wireless/virtual/mac80211_hwsim.c:2216 __mac80211_hwsim_beacon_tx drivers/net/wireless/virtual/mac80211_hwsim.c:2232 [inline] mac80211_hwsim_beacon_tx+0x592/0xa10 drivers/net/wireless/virtual/mac80211_hwsim.c:2315 __iterate_interfaces+0x2e5/0x640 net/mac80211/util.c:758 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:794 mac80211_hwsim_beacon+0x105/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2345 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1820 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x31/0x80 kernel/locking/spinlock.c:194 Code: f5 53 48 8b 74 24 10 48 89 fb 48 83 c7 18 e8 06 60 59 f6 48 89 df e8 4e df 59 f6 f7 c5 00 02 00 00 75 23 9c 58 f6 c4 02 75 37 01 00 00 00 e8 65 cf 4a f6 65 8b 05 86 f2 e6 74 85 c0 74 16 5b RSP: 0018:ffffc9000b0df240 EFLAGS: 00000246 RAX: 0000000000000002 RBX: ffff888021f25098 RCX: 1ffffffff2d39b6b RDX: 0000000000000000 RSI: ffffffff8b4cd300 RDI: ffffffff8bb17080 RBP: 0000000000000246 R08: 0000000000000001 R09: fffffbfff2d36f9e R10: ffffffff969b7cf7 R11: 0000000000000001 R12: ffffc9000b0df404 R13: dffffc0000000000 R14: ffffc9000b0df428 R15: 000000000000001e spin_unlock_irqrestore include/linux/spinlock.h:406 [inline] unlock_page_lruvec_irqrestore include/linux/memcontrol.h:1520 [inline] folios_put_refs+0x52e/0x7b0 mm/swap.c:954 free_pages_and_swap_cache+0x36d/0x510 mm/swap_state.c:332 __tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136 tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu+0xe9/0x590 mm/mmu_gather.c:373 zap_pte_range mm/memory.c:1714 [inline] zap_pmd_range mm/memory.c:1753 [inline] zap_pud_range mm/memory.c:1782 [inline] zap_p4d_range mm/memory.c:1803 [inline] unmap_page_range+0x1c6e/0x3cf0 mm/memory.c:1824 unmap_single_vma+0x194/0x2b0 mm/memory.c:1870 unmap_vmas+0x22f/0x490 mm/memory.c:1914 exit_mmap+0x1c6/0xb20 mm/mmap.c:1672 __mmput+0x12a/0x4c0 kernel/fork.c:1348 mmput+0x62/0x70 kernel/fork.c:1370 exit_mm kernel/exit.c:570 [inline] do_exit+0x9ba/0x2d70 kernel/exit.c:925 do_group_exit+0xd3/0x2a0 kernel/exit.c:1087 get_signal+0x2576/0x2610 kernel/signal.c:3017 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4f9bd85d29 Code: Unable to access opcode bytes at 0x7f4f9bd85cff. RSP: 002b:00007f4f9cb4a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: 0000000000000030 RBX: 00007f4f9bf75fa0 RCX: 00007f4f9bd85d29 RDX: 0000000000004010 RSI: 00000000200004c0 RDI: 0000000000000005 RBP: 00007f4f9be01b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4f9bf75fa0 R15: 00007ffc3b745228