INFO: task syz-executor:22733 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21800 pid:22733 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x15ae/0x4700 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 __synchronize_srcu+0x339/0x3d0 kernel/rcu/srcutree.c:1386
 hci_unregister_dev+0x148/0x520 net/bluetooth/hci_core.c:2708
 vhci_release+0x170/0x1c0 drivers/bluetooth/hci_vhci.c:701
 __fput+0x221/0x940 fs/file_table.c:418
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x986/0x2530 kernel/exit.c:890
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 get_signal+0x12a6/0x1390 kernel/signal.c:2927
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa3fbd5fd8e
RSP: 002b:00007ffc5dcdba38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 0000000000000020 RBX: 00005555602aa500 RCX: 00007fa3fbd5fd8e
RDX: 0000000000000020 RSI: 00007fa3fcb54670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffc5dcdbab4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fa3fcb54670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:22770 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21800 pid:22770 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x15ae/0x4700 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 __synchronize_srcu+0x339/0x3d0 kernel/rcu/srcutree.c:1386
 hci_unregister_dev+0x148/0x520 net/bluetooth/hci_core.c:2708
 vhci_release+0x170/0x1c0 drivers/bluetooth/hci_vhci.c:701
 __fput+0x221/0x940 fs/file_table.c:418
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x986/0x2530 kernel/exit.c:890
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 get_signal+0x12a6/0x1390 kernel/signal.c:2927
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f961ef5fd8e
RSP: 002b:00007ffc0fa755b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 0000000000000040 RBX: 000055556676c500 RCX: 00007f961ef5fd8e
RDX: 0000000000000040 RSI: 00007f961fd54670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffc0fa75634 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f961fd54670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:22996 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22344 pid:22996 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x15ae/0x4700 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 __synchronize_srcu+0x339/0x3d0 kernel/rcu/srcutree.c:1386
 hci_unregister_dev+0x148/0x520 net/bluetooth/hci_core.c:2708
 vhci_release+0x170/0x1c0 drivers/bluetooth/hci_vhci.c:701
 __fput+0x221/0x940 fs/file_table.c:418
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x986/0x2530 kernel/exit.c:890
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 get_signal+0x12a6/0x1390 kernel/signal.c:2927
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f681855fd8e
RSP: 002b:00007ffc5135a208 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 000000000000004c RBX: 00005555779d1500 RCX: 00007f681855fd8e
RDX: 000000000000004c RSI: 00007f6819354670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffc5135a284 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f6819354670 R15: 0000000000000000
 </TASK>

Showing all locks held in the system:
1 lock held by kthreadd/2:
 #0: ffffffff8df5c110 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x21d0/0x3da0 kernel/fork.c:2606
1 lock held by khungtaskd/29:
 #0: ffffffff8df322e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8df322e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8df322e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6669
2 locks held by kworker/0:2/173:
2 locks held by getty/5537:
 #0: ffff8880330720a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000327e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
2 locks held by kworker/0:8/8196:
3 locks held by kworker/u4:24/10103:
 #0: ffff888018871938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888018871938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000ca9fd00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000ca9fd00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8df5c110 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x21d0/0x3da0 kernel/fork.c:2606
1 lock held by syz-executor/11477:
3 locks held by kworker/u4:7/20638:
1 lock held by syz.1.4682/21624:
3 locks held by kworker/0:0H/22590:
2 locks held by kworker/0:3H/22753:
1 lock held by syz-executor/23311:
 #0: ffffffff8df5c110 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837
6 locks held by syz-executor/23312:
3 locks held by syz-executor/23340:
 #0: ffff8880317ce418 (sb_writers#10){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #1: ffff88805eac5c88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 fs/kernfs/file.c:343
 #2: ffffffff8df5bf28 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:369 [inline]
 #2: ffffffff8df5bf28 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xe9/0x230 kernel/cgroup/cgroup.c:1677
3 locks held by syz-executor/23476:
 #0: ffffffff8f1bb450 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x347/0x530 net/core/net_namespace.c:520
 #1: ffff88806bce66b0 (k-sk_lock-AF_RXRPC){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1784 [inline]
 #1: ffff88806bce66b0 (k-sk_lock-AF_RXRPC){+.+.}-{0:0}, at: rxrpc_bind+0x90/0x440 net/rxrpc/af_rxrpc.c:145
 #2: ffff8880516981d8 (&rxnet->local_mutex){+.+.}-{3:3}, at: rxrpc_lookup_local+0xc9/0x1700 net/rxrpc/local_object.c:262
1 lock held by udevd/23477:
 #0: ffffffff8df5c110 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837
1 lock held by udevd/23479:
 #0: ffffffff8df5c110 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837
1 lock held by udevd/23481:
 #0: ffffffff8df5c110 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837
1 lock held by rm/23489:
 #0: ffffffff8df5c110 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 21621 Comm: syz.1.4682 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x0/0x90 kernel/kcov.c:310
Code: c0 4c 89 01 48 c7 44 11 08 03 00 00 00 48 89 7c 11 10 48 89 74 11 18 48 89 44 11 20 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <f3> 0f 1e fa 48 8b 04 24 65 48 8b 15 60 e0 7b 7e 65 8b 0d 61 e0 7b
RSP: 0018:ffffc9000fb77d78 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 1ffff92001f6efb4 RCX: 5666cb9e02388300
RDX: ffffc9000d121000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000fb77ec0 R08: ffffffff8f6bc82f R09: 1ffffffff1ed7905
R10: dffffc0000000000 R11: fffffbfff1ed7906 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: ffffc9000fb77f58
FS:  00007fa0fe71e6c0(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b3341cff8 CR3: 000000007ab38000 CR4: 00000000003506f0
DR0: 0000000000010000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 handle_signal arch/x86/kernel/signal.c:267 [inline]
 arch_do_signal_or_restart+0x463/0x7b0 arch/x86/kernel/signal.c:312
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa0fd7bead0
Code: 83 c0 16 83 e0 f7 74 12 50 48 8d 3d 52 33 07 00 e8 65 65 f9 ff 0f 1f 44 00 00 c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <83> ff 21 74 0b c3 66 2e 0f 1f 84 00 00 00 00 00 55 53 48 89 f3 48
RSP: 002b:00007fa0fe71da78 EFLAGS: 00000246 ORIG_RAX: 0000000000000049
RAX: 0000000000000000 RBX: 00007fa0fda25fa0 RCX: 00007fa0fd79f559
RDX: 00007fa0fe71da80 RSI: 00007fa0fe71dbb0 RDI: 0000000000000021
RBP: 00007fa0fd836b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa0fda26038 R14: 00007fa0fda25fa0 R15: 00007fff2b37aef8
 </TASK>