INFO: task syz.4.19:6774 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.19 state:D stack:28992 pid:6774 tgid:6770 ppid:6386 task_flags:0x400040 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x16f3/0x4c20 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7307
rt_mutex_slowlock_block+0x5ba/0x6d0 kernel/locking/rtmutex.c:1647
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline]
rt_mutex_slowlock+0x2b1/0x6e0 kernel/locking/rtmutex.c:1800
__rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:536 [inline]
mutex_lock_nested+0x16a/0x1d0 kernel/locking/rtmutex_api.c:547
blk_trace_remove kernel/trace/blktrace.c:406 [inline]
blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
blkdev_common_ioctl+0xdf4/0x2560 block/ioctl.c:630
blkdev_ioctl+0x4f9/0x6d0 block/ioctl.c:699
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9159f9e719
RSP: 002b:00007f91591fd038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f915a156058 RCX: 00007f9159f9e719
RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000004
RBP: 00007f915a01139e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f915a156058 R15: 00007ffea9302e08
Showing all locks held in the system:
1 lock held by khungtaskd/38:
#0: ffffffff8d5aa4c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5aa4c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5aa4c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
4 locks held by kworker/u8:2/43:
6 locks held by kworker/u8:5/152:
3 locks held by kworker/u8:6/1180:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90004f3fba0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90004f3fba0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffffffff8e862eb8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303
4 locks held by kworker/u8:9/2244:
#0: ffff888019ad4938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff888019ad4938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc900068ffba0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc900068ffba0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffffffff8e855fa0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x820 net/core/net_namespace.c:669
#3: ffffffff8e862eb8 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
#3: ffffffff8e862eb8 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x990 net/core/net_namespace.c:248
2 locks held by getty/5560:
#0: ffff88823bf360a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x444/0x1400 drivers/tty/n_tty.c:2222
3 locks held by kworker/0:4/6389:
#0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90004527ba0 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90004527ba0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffffffff8e862eb8 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
2 locks held by syz.4.19/6771:
1 lock held by syz.4.19/6774:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.5.20/6934:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.5.20/6935:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.6.21/6937:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.6.21/6938:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.7.22/6941:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.7.22/6943:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.9.24/6945:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.9.24/6946:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.8.23/6948:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.8.23/6949:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.1.25/7226:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.1.25/7227:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.0.26/7235:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.0.26/7236:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.2.27/7270:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.2.27/7271:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.3.28/7273:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.3.28/7274:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.4.29/7280:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.4.29/7281:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.5.30/7322:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.5.30/7323:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.6.31/7326:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.6.31/7327:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.7.32/7453:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.7.32/7456:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.8.33/7454:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.8.33/7457:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.9.34/7464:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.9.34/7465:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.0.35/7467:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.0.35/7468:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
1 lock held by syz.1.36/7470:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xfb/0x1f0 kernel/trace/blktrace.c:613
1 lock held by syz.1.36/7471:
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
#0: ffff888024677438 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:727
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf60/0xfa0 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6771 Comm: syz.4.19 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__list_del_entry_valid_or_report+0xbe/0x190 lib/list_debug.c:71
Code: 1f 0f 85 92 00 00 00 4d 8d 7e 08 4d 89 fc 49 c1 ec 03 43 80 3c 2c 00 74 08 4c 89 ff e8 fb c7 9d fd 49 39 1f 0f 85 9e 00 00 00 01 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 48 c7 c7 00 df
RSP: 0018:ffffc90004daf458 EFLAGS: 00000246
RAX: 1ffffd400043be61 RBX: ffffea00021df308 RCX: 0000000000000000
RDX: 1ffffffff1dac72c RSI: dffffc0000000000 RDI: ffffea00021df310
RBP: 0000000000000000 R08: 0000000000000080 R09: ffff8880b8842301
R10: dffffc0000000000 R11: fffffbfff1dac52f R12: 1ffffd400043be6a
R13: dffffc0000000000 R14: ffffea00021df348 R15: ffffea00021df350
FS: 00007f915921e6c0(0000) GS:ffff888126dfc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056342f7dd328 CR3: 00000000621fe000 CR4: 00000000003526f0
Call Trace:
__list_del_entry_valid include/linux/list.h:132 [inline]
__list_del_entry include/linux/list.h:223 [inline]
list_del include/linux/list.h:237 [inline]
__rmqueue_pcplist+0x1347/0x1b90 mm/page_alloc.c:3277
rmqueue_pcplist mm/page_alloc.c:3309 [inline]
rmqueue mm/page_alloc.c:3340 [inline]
get_page_from_freelist+0x9ef/0x2960 mm/page_alloc.c:3881
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5183
alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2416
alloc_frozen_pages_noprof mm/mempolicy.c:2487 [inline]
alloc_pages_noprof+0xcf/0x1e0 mm/mempolicy.c:2507
relay_alloc_buf kernel/relay.c:121 [inline]
relay_create_buf kernel/relay.c:161 [inline]
relay_open_buf+0x288/0xe50 kernel/relay.c:389
relay_open+0x427/0x920 kernel/relay.c:518
do_blk_trace_setup+0x561/0x980 kernel/trace/blktrace.c:572
blk_trace_setup+0x116/0x1f0 kernel/trace/blktrace.c:614
blk_trace_ioctl+0x181/0x430 kernel/trace/blktrace.c:712
blkdev_ioctl+0x420/0x6d0 block/ioctl.c:694
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xff/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9159f9e719
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f915921e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f915a155f80 RCX: 00007f9159f9e719
RDX: 0000000020000380 RSI: 00000000c0481273 RDI: 0000000000000004
RBP: 00007f915a01139e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f915a155f80 R15: 00007ffea9302e08