INFO: task syz-executor:11783 blocked for more than 147 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:24984 pid:11783 tgid:11783 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x60e0 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 bus_attr_store+0x74/0xb0 drivers/base/bus.c:172 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:142 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1070 fs/read_write.c:688 ksys_write+0x12a/0x250 fs/read_write.c:740 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0fa475cece RSP: 002b:00007ffecac3b8d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555594184500 RCX: 00007f0fa475cece RDX: 0000000000000001 RSI: 00007ffecac3b960 RDI: 0000000000000005 RBP: 00007f0fa483343f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffecac3b960 R14: 00007f0fa5544620 R15: 0000000000000003 Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8e7e93e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #0: ffffffff8e7e93e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #0: ffffffff8e7e93e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 3 locks held by kworker/u8:2/35: #0: ffff88813fe9c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90000ab7d08 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:313 4 locks held by kworker/u8:6/641: #0: ffff88801cac9148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc9000215fd08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffffffff905f6910 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:675 #3: ffff888087c11528 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_destruct+0x151/0x3f0 drivers/net/wireguard/device.c:249 2 locks held by getty/5567: #0: ffff8880343fe0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 4 locks held by syz-executor/11768: #0: ffff88803819c420 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888032c0a888 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff888028c9fe18 (kn->active#53){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888028c9fe18 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb67a88 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0xfe/0x700 drivers/net/netdevsim/bus.c:184 7 locks held by syz-executor/11783: #0: ffff88803819c420 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:740 #1: ffff888073325488 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x2c2/0x5f0 fs/kernfs/file.c:343 #2: ffff888028c9fd28 (kn->active#52){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888028c9fd28 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x332/0x5f0 fs/kernfs/file.c:344 #3: ffffffff8fb67a88 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x480 drivers/net/netdevsim/bus.c:234 #4: ffff888023ebf0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #4: ffff888023ebf0e8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1106 [inline] #4: ffff888023ebf0e8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xaa/0x600 drivers/base/dd.c:1304 #5: ffff888023eb8250 (&devlink->lock_key#24){+.+.}-{4:4}, at: nsim_drv_remove+0x4a/0x1e0 drivers/net/netdevsim/dev.c:1778 #6: ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #6: ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x146/0x360 net/core/dev.c:2162 1 lock held by syz.2.1168/11923: #0: ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3436 4 locks held by syz-executor/11980: #0: ffff88807d698ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:500 #1: ffff88807d6980c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 net/bluetooth/hci_sync.c:5346 #2: ffffffff908a7268 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline] #2: ffffffff908a7268 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x280 net/bluetooth/hci_conn.c:2644 #3: ffff88804aedc2f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x770 net/bluetooth/l2cap_core.c:1755 2 locks held by syz-executor/11991: #0: ffff888059e7cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xb0 net/bluetooth/hci_core.c:500 #1: ffff888059e7c0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x35c/0x1240 net/bluetooth/hci_sync.c:5346 6 locks held by syz-executor/12007: #0: ffffffff905f6910 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577 #1: ffffffff9022ac90 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x28c/0x590 drivers/infiniband/core/device.c:1186 #2: ffffffff9022aa10 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x2ff/0x590 drivers/infiniband/core/device.c:1191 #3: ffff888026374fb0 (&device->compat_devs_mutex){+.+.}-{4:4}, at: add_one_compat_dev+0x112/0x820 drivers/infiniband/core/device.c:950 #4: ffff8880263752a8 (&rxe->usdev_lock){+.+.}-{4:4}, at: rxe_query_port+0x115/0x330 drivers/infiniband/sw/rxe/rxe_verbs.c:61 #5: ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: ib_get_eth_speed+0x12f/0xb40 drivers/infiniband/core/verbs.c:2053 2 locks held by syz-executor/12011: #0: ffffffff905f6910 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577 #1: ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x21e/0x780 net/ipv4/ip_tunnel.c:1146 2 locks held by syz-executor/12024: #0: ffffffff905f6910 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577 #1: ffffffff9060f268 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x21e/0x780 net/ipv4/ip_tunnel.c:1146 4 locks held by syz-executor/12029: #0: ffffffff905f6910 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577 #1: ffffffff9022ac90 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x28c/0x590 drivers/infiniband/core/device.c:1186 #2: ffffffff9022aa10 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x2ff/0x590 drivers/infiniband/core/device.c:1191 #3: ffff888026374fb0 (&device->compat_devs_mutex){+.+.}-{4:4}, at: add_one_compat_dev+0x112/0x820 drivers/infiniband/core/device.c:950 4 locks held by syz-executor/12033: #0: ffffffff905f6910 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577 #1: ffffffff9022ac90 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x28c/0x590 drivers/infiniband/core/device.c:1186 #2: ffffffff9022aa10 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x2ff/0x590 drivers/infiniband/core/device.c:1191 #3: ffff888026374fb0 (&device->compat_devs_mutex){+.+.}-{4:4}, at: add_one_compat_dev+0x112/0x820 drivers/infiniband/core/device.c:950 2 locks held by dhcpcd/12055: #0: ffff88804424f508 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline] #0: ffff88804424f508 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:661 #1: ffffffff8e7f4ff8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343 1 lock held by dhcpcd/12057: #0: ffff888057a96f48 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline] #0: ffff888057a96f48 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:661 1 lock held by dhcpcd/12058: #0: ffff88807d867508 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline] #0: ffff88807d867508 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:661 1 lock held by dhcpcd/12059: #0: ffff88807d8663c8 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1028 [inline] #0: ffff88807d8663c8 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release+0x86/0x260 net/socket.c:661 1 lock held by dhcpcd/12060: #0: ffff888079dbc260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff888079dbc260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197 1 lock held by dhcpcd/12061: #0: ffff88803385c260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff88803385c260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197 1 lock held by dhcpcd/12062: #0: ffff88803311c260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff88803311c260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197 1 lock held by dhcpcd/12063: #0: ffff88803311e260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff88803311e260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197 1 lock held by dhcpcd/12064: #0: ffff888033118260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff888033118260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197 1 lock held by dhcpcd/12065: #0: ffff888078212260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1709 [inline] #0: ffff888078212260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xd25/0x1050 kernel/hung_task.c:515 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 10614 Comm: syz.2.1140 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:p9_client_rpc+0x49f/0xc80 net/9p/client.c:593 Code: c9 f6 48 8b 74 24 28 48 8b 7c 24 30 ba 02 01 00 00 e8 65 df a1 f6 48 89 c3 41 0f b6 06 41 38 c5 7c 08 84 c0 0f 85 ad 06 00 00 <45> 8b 3c 24 bf 02 00 00 00 44 89 fe e8 50 1a c9 f6 41 83 ff 02 0f RSP: 0000:ffffc90003207720 EFLAGS: 00000246 RAX: 0000000000000000 RBX: fffffffffffffe00 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffff8de71ed4 RDI: 0000000000000001 RBP: ffffc90003207890 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffff88807ae14660 R13: 0000000000000003 R14: ffffed100f5c28cc R15: 000000000000006c FS: 00007fe12747f6c0(0000) GS:ffff88812434a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055a38a638660 CR3: 000000001296c000 CR4: 00000000003526f0 Call Trace: p9_client_flush.isra.0+0x1fe/0x420 net/9p/client.c:486 p9_client_rpc+0xa54/0xc80 net/9p/client.c:618 p9_client_version net/9p/client.c:807 [inline] p9_client_create+0x7a6/0xd40 net/9p/client.c:913 v9fs_session_init+0x40/0xce0 fs/9p/v9fs.c:442 v9fs_get_tree+0xb8/0xb50 fs/9p/vfs_super.c:97 vfs_get_tree+0x92/0x320 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline] do_new_mount_fc fs/namespace.c:3760 [inline] do_new_mount fs/namespace.c:3836 [inline] path_mount+0x7d0/0x23d0 fs/namespace.c:4146 do_mount fs/namespace.c:4159 [inline] __do_sys_mount fs/namespace.c:4348 [inline] __se_sys_mount fs/namespace.c:4325 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4325 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe12659c629 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe12747f028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fe126815fa0 RCX: 00007fe12659c629 RDX: 0000200000000240 RSI: 0000200000000180 RDI: 0000000000000000 RBP: 00007fe126632b39 R08: 0000200000000300 R09: 0000000000000000 R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe126816038 R14: 00007fe126815fa0 R15: 00007fff0a5e19e8