INFO: task kworker/u8:5:352 blocked for more than 143 seconds.
Tainted: G U I syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:5 state:D stack:23544 pid:352 tgid:352 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: netns cleanup_net
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7026
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
__flush_workqueue+0x3e2/0x1230 kernel/workqueue.c:4029
rxrpc_destroy_all_locals+0x40/0x180 net/rxrpc/local_object.c:475
rxrpc_exit_net+0x8b/0xc0 net/rxrpc/net_ns.c:115
ops_exit_list net/core/net_namespace.c:199 [inline]
ops_undo_list+0x2ee/0xab0 net/core/net_namespace.c:252
cleanup_net+0x41b/0x8b0 net/core/net_namespace.c:695
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
process_scheduled_works kernel/workqueue.c:3346 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e3c42e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e3c42e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e3c42e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:5/352:
#0: ffff88801ba9f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc900030d7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffffffff900d38b0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x8b0 net/core/net_namespace.c:669
2 locks held by getty/5593:
#0: ffff88803462d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
1 lock held by syz.4.3911/14642:
#0: ffffffff900d38b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x2d6/0x690 net/core/net_namespace.c:576
1 lock held by syz.0.3950/14821:
#0: ffff88805911b008 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff88805911b008 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:661
1 lock held by syz.5.3961/14876:
#0: ffffffff900d38b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x2d6/0x690 net/core/net_namespace.c:576
1 lock held by syz.2.3997/15076:
#0: ffff888148f82488 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff888148f82488 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:661
1 lock held by syz.7.4061/15410:
#0: ffff888057478d88 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff888057478d88 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:661
1 lock held by syz.6.4074/15464:
#0: ffffffff900d38b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x2d6/0x690 net/core/net_namespace.c:576
1 lock held by syz.8.4124/15710:
#0: ffffffff900d38b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x2d6/0x690 net/core/net_namespace.c:576
1 lock held by syz.1.4131/15806:
#0: ffffffff8e3cf878 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:343
4 locks held by syz-executor/16042:
#0:
ffff88808ac6cdc8 (&hdev->req_lock
){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0x90 net/bluetooth/hci_core.c:499
#1: ffff88808ac6c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3ae/0x11d0 net/bluetooth/hci_sync.c:5291
#2: ffffffff9035d988 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2118 [inline]
#2: ffffffff9035d988 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x260 net/bluetooth/hci_conn.c:2602
#3: ffff888050605338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x730 net/bluetooth/l2cap_core.c:1762
1 lock held by syz.1.4171/16120:
#0: ffff88804aab0208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#0: ffff88804aab0208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: __sock_release+0x86/0x270 net/socket.c:661
8 locks held by syz.3.4184/16211:
1 lock held by syz.3.4184/16212:
#0: ffff88808e020d08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x117/0x530 mm/mmap_lock.c:238
1 lock held by syz.9.4187/16238:
1 lock held by syz.9.4189/16252:
#0: ffffffff8e3cf878
(rcu_state.exp_mutex
){+.+.}-{4:4}
, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:343
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G U I syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3f/0x1170 kernel/hung_task.c:495
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 16211 Comm: syz.3.4184 Tainted: G U I syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [I]=FIRMWARE_WORKAROUND
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline]
RIP: 0010:__orc_find+0x7e/0xf0 arch/x86/kernel/unwind_orc.c:102
Code: ea 3f 48 c1 fe 02 48 01 f2 48 d1 fa 48 8d 5c 95 00 48 89 da 48 c1 ea 03 0f b6 34 0a 48 89 da 83 e2 07 83 c2 03 40 38 f2 7c 05 <40> 84 f6 75 4b 48 63 13 48 01 da 49 39 d5 73 af 4c 8d 63 fc 49 39
RSP: 0018:ffffc90000007508 EFLAGS: 00000206
RAX: ffffffff912267ec RBX: ffffffff909b7ca8 RCX: dffffc0000000000
RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffffffff909b7c8c
RBP: ffffffff909b7ca8 R08: ffffffff91226822 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000010940 R12: ffffffff909b7cac
R13: ffffffff820940bb R14: ffffffff909b7c8c R15: ffffffff909b7ca4
FS: 000055555a45e500(0000) GS:ffff888124a12000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000a000 CR3: 000000008f436000 CR4: 00000000003526f0
Call Trace:
orc_find arch/x86/kernel/unwind_orc.c:227 [inline]
unwind_next_frame+0x2ec/0x20a0 arch/x86/kernel/unwind_orc.c:494
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
kasan_save_track+0x14/0x30 mm/kasan/common.c:77
unpoison_slab_object mm/kasan/common.c:342 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:368
kasan_slab_alloc include/linux/kasan.h:252 [inline]
slab_post_alloc_hook mm/slub.c:4962 [inline]
slab_alloc_node mm/slub.c:5272 [inline]
kmem_cache_alloc_node_noprof+0x28a/0x770 mm/slub.c:5324
kmalloc_reserve+0x18b/0x2c0 net/core/skbuff.c:579
__alloc_skb+0x166/0x380 net/core/skbuff.c:670
skb_copy+0x1c9/0x3a0 net/core/skbuff.c:2125
mac80211_hwsim_tx_frame_no_nl.isra.0+0xb6e/0x13c0 drivers/net/wireless/virtual/mac80211_hwsim.c:1891
mac80211_hwsim_tx_frame+0x1f1/0x2a0 drivers/net/wireless/virtual/mac80211_hwsim.c:2258
__mac80211_hwsim_beacon_tx drivers/net/wireless/virtual/mac80211_hwsim.c:2275 [inline]
mac80211_hwsim_beacon_tx+0x595/0xa40 drivers/net/wireless/virtual/mac80211_hwsim.c:2359
__iterate_interfaces+0x2e5/0x650 net/mac80211/util.c:761
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:797
mac80211_hwsim_beacon+0x105/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2389
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x202/0xad0 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1858
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:console_flush_all+0x9a2/0xc60 kernel/printk/printk.c:3200
Code: 00 e8 a2 32 29 00 9c 5b 81 e3 00 02 00 00 31 ff 48 89 de e8 70 2d 21 00 48 85 db 0f 85 55 01 00 00 e8 f2 31 21 00 fb 4c 89 e0 <48> c1 e8 03 42 80 3c 38 00 0f 84 11 ff ff ff 4c 89 e7 e8 a7 c8 88
RSP: 0018:ffffc9000420ee88 EFLAGS: 00000293
RAX: ffffffff8f060678 RBX: 0000000000000000 RCX: ffffffff819b3800
RDX: ffff8880265b5ac0 RSI: ffffffff819b380e RDI: 0000000000000007
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffffffff8f060678
R13: ffffffff8f060620 R14: ffffc9000420ef18 R15: dffffc0000000000
__console_flush_and_unlock kernel/printk/printk.c:3258 [inline]
console_unlock+0xd8/0x210 kernel/printk/printk.c:3298
vprintk_emit+0x3d7/0x680 kernel/printk/printk.c:2423
_printk+0xc7/0x100 kernel/printk/printk.c:2448
seq_buf_do_printk lib/seq_buf.c:126 [inline]
seq_buf_do_printk+0x145/0x260 lib/seq_buf.c:115
mem_cgroup_print_oom_meminfo+0x2c2/0x570 mm/memcontrol.c:1598
dump_header+0x136/0x930 mm/oom_kill.c:469
oom_kill_process+0x272/0xa40 mm/oom_kill.c:1046
out_of_memory+0x350/0x1700 mm/oom_kill.c:1184
mem_cgroup_out_of_memory+0x118/0x130 mm/memcontrol.c:1650
mem_cgroup_oom mm/memcontrol.c:1673 [inline]
try_charge_memcg+0x695/0xd30 mm/memcontrol.c:2398
try_charge mm/memcontrol.c:2498 [inline]
charge_memcg+0x8a/0x230 mm/memcontrol.c:4701
mem_cgroup_swapin_charge_folio+0xbb/0x440 mm/memcontrol.c:4787
__read_swap_cache_async+0x397/0x500 mm/swap_state.c:481
swap_cluster_readahead+0x528/0x770 mm/swap_state.c:669
swapin_readahead+0x13a/0xd60 mm/swap_state.c:813
do_swap_page+0x86c/0x6340 mm/memory.c:4713
handle_pte_fault mm/memory.c:6180 [inline]
__handle_mm_fault+0x17d1/0x2aa0 mm/memory.c:6318
handle_mm_fault+0x589/0xd10 mm/memory.c:6487
do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x64/0xc0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7fde8c064d70
Code: 89 fa 48 c1 e2 04 48 29 fa 48 c1 e2 04 80 7c 10 20 00 0f 85 92 06 00 00 48 89 d8 48 8d 35 38 12 38 00 4c 29 c0 48 8d 5c 06 08 <8b> 13 85 d2 0f 85 e0 0d 00 00 41 8b 14 24 85 d2 0f 84 d4 0d 00 00
RSP: 002b:00007ffde4e96200 EFLAGS: 00010206
RAX: 00000000000000f0 RBX: 00007fde8c3e6098 RCX: 0000001b2f224000
RDX: 0000000000000001 RSI: 00007fde8c3e5fa0 RDI: 0000001b2f263fec
RBP: 0000000000000001 R08: 00007fde8c3e5fa0 R09: 0000000000000000
R10: 0000001b2f224218 R11: 0000000000000008 R12: 00007fde8c3e609c
R13: 00007fde8c3e6090 R14: 00000000000000fc R15: 0000000000000003