INFO: task hung in flush_delayed_work

Status: upstream: reported on 2026/07/05 17:03
Reported-by: syzbot+ca8f1372ec534fc9d0f3@syzkaller.appspotmail.com
First crash: 71d, last: 14h24m
Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 INFO: task hung in flush_delayed_work (3) 1 1 94d 94d 0/3 upstream: reported on 2026/06/13 08:22
upstream INFO: task hung in flush_delayed_work prio:high ocfs2 1 syz, C error done 466 272d 678d 0/29 upstream: reported C repro on 2024/11/06 08:07
linux-5.15 INFO: task hung in flush_delayed_work 1 1 747d 747d 0/3 auto-obsoleted due to no activity on 2024/12/07 07:17
linux-6.1 INFO: task hung in flush_delayed_work (2) 1 1 221d 221d 0/3 auto-obsoleted due to no activity on 2026/05/17 02:06
linux-6.1 INFO: task hung in flush_delayed_work 1 1 691d 691d 0/3 auto-obsoleted due to no activity on 2025/01/31 15:23

Sample crash report:
INFO: task syz.9.3619:18598 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.3619      state:D stack:23912 pid:18598 ppid:17954  flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 __flush_work+0x92f/0xac0 kernel/workqueue.c:3475
 flush_work kernel/workqueue.c:3496 [inline]
 flush_delayed_work+0x131/0x180 kernel/workqueue.c:3620
 fsnotify_destroy_group+0x235/0x350 fs/notify/group.c:76
 inotify_release+0x45/0x70 fs/notify/inotify/inotify_user.c:309
 __fput+0x221/0x940 fs/file_table.c:418
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x986/0x2530 kernel/exit.c:890
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 get_signal+0x12a6/0x1390 kernel/signal.c:2915
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:318
 exc_page_fault+0x8c/0x100 arch/x86/mm/fault.c:1519
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f7ffa253bd7
RSP: 002b:00007f7ff85d7120 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f7ffa39e159
RDX: 00007f7ff85d7140 RSI: 00007f7ff85d7270 RDI: 000000000000000b
RBP: 00007f7ffa43503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f7ffa626038 R14: 00007f7ffa625fa0 R15: 00007fff3c7216e8
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/u4:1/12:
 #0: ffff88802c273938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff88802c273938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc90000117d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc90000117d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xce/0x1550 net/ipv6/addrconf.c:4188
1 lock held by khungtaskd/29:
 #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6635
5 locks held by kworker/u5:0/51:
 #0: ffff888076ca3d38 ((wq_completion)hci7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888076ca3d38 ((wq_completion)hci7){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc90000bbfd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc90000bbfd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffff888063408e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1cc/0x380 net/bluetooth/hci_sync.c:332
 #3: ffff8880634080b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x864/0xe60 net/bluetooth/hci_sync.c:5786
 #4: ffffffff8e53eb68 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2001 [inline]
 #4: ffffffff8e53eb68 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x17b/0x330 net/bluetooth/hci_conn.c:1269
3 locks held by kworker/0:1H/56:
3 locks held by kworker/u4:4/60:
1 lock held by dhcpcd/5436:
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
2 locks held by getty/10078:
 #0: ffff8880317220a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900040dd2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
2 locks held by kworker/u4:12/11658:
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000c207d00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000c207d00 (connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
4 locks held by kworker/u4:13/11661:
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000c4a7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000c4a7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
 #3: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline]
 #3: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 kernel/rcu/tree_exp.h:1004
2 locks held by kworker/u4:14/11663:
 #0: ffff888019ee5138 ((wq_completion)quota_events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888019ee5138 ((wq_completion)quota_events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000c227d00 ((quota_release_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000c227d00 ((quota_release_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
2 locks held by kworker/u4:15/11665:
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000c267d00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000c267d00 ((reaper_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
7 locks held by kworker/u5:2/13765:
 #0: ffff88803050a138 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff88803050a138 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000396fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000396fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffff8881a34d4e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1cc/0x380 net/bluetooth/hci_sync.c:332
 #3: ffff8881a34d40b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x864/0xe60 net/bluetooth/hci_sync.c:5786
 #4: ffffffff8e53eb68 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2001 [inline]
 #4: ffffffff8e53eb68 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x17b/0x330 net/bluetooth/hci_conn.c:1269
 #5: ffff88806be23b38 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_conn_del+0x7b/0x630 net/bluetooth/l2cap_core.c:1793
 #6: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
 #6: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
3 locks held by kworker/0:15/15788:
2 locks held by kworker/1:11/15800:
 #0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc90004cafd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc90004cafd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
1 lock held by syz-executor/17951:
4 locks held by syz-executor/17957:
1 lock held by syz.3.3617/18573:
1 lock held by syz.8.3629/18639:
 #0: ffff8880630540e0 (&type->s_umount_key#32){++++}-{3:3}, at: do_remount fs/namespace.c:2924 [inline]
 #0: ffff8880630540e0 (&type->s_umount_key#32){++++}-{3:3}, at: path_mount+0xcb8/0xfa0 fs/namespace.c:3705
3 locks held by syz-executor/18690:
 #0: ffff88802ef06418 (sb_writers#10){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #1: ffff88805d8b2c88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 fs/kernfs/file.c:343
 #2: ffffffff8d15bd28 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:369 [inline]
 #2: ffffffff8d15bd28 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xe9/0x230 kernel/cgroup/cgroup.c:1677
4 locks held by syz-executor/18695:
3 locks held by syz-executor/18743:
 #0: ffff88802ef06418 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline]
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 fs/namei.c:3937
 #2: ffffffff8d15bd28 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:369 [inline]
 #2: ffffffff8d15bd28 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xe9/0x230 kernel/cgroup/cgroup.c:1677
3 locks held by syz-executor/18754:
 #0: ffff88802ef06418 (sb_writers#10){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #1: ffff8881a724c488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 fs/kernfs/file.c:343
 #2: ffffffff8d15bd28 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:369 [inline]
 #2: ffffffff8d15bd28 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xe9/0x230 kernel/cgroup/cgroup.c:1677
2 locks held by syz-executor/19105:
 #0: ffff88802ef06418 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline]
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 fs/namei.c:3937
2 locks held by syz-executor/19107:
 #0: ffff88802ef06418 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline]
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 fs/namei.c:3937
2 locks held by syz-executor/19164:
 #0: ffff88802ef06418 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline]
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 fs/namei.c:3937
2 locks held by syz-executor/19169:
 #0: ffff88802ef06418 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline]
 #1: ffff8880772355a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x20f/0x450 fs/namei.c:3937
1 lock held by syz-executor/19460:
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/19461:
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/19521:
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/19526:
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 18573 Comm: syz.3.3617 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:zone_statistics+0xeb/0x170 mm/page_alloc.c:-1
Code: 70 4c 89 f8 48 c1 e8 03 80 3c 10 00 74 14 4c 89 ff 4d 89 fd 49 89 d7 e8 e3 0b 0c 00 4c 89 fa 4d 89 ef 49 8b 07 65 48 01 58 20 <48> 83 f5 05 41 80 3c 14 00 74 08 4c 89 f7 e8 c2 0b 0c 00 49 8b 06
RSP: 0018:ffffc90004d67668 EFLAGS: 00000206
RAX: 0000000000042240 RBX: 0000000000000001 RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffff88823fff7e00 RDI: ffff88813fffae00
RBP: 0000000000000000 R08: ffff8880b8e42403 R09: 1ffff110171c8480
R10: dffffc0000000000 R11: ffffed10171c8481 R12: 1ffff11047ffefce
R13: 0000000000000001 R14: ffff88823fff7e70 R15: ffff88813fffae70
FS:  00007f0b527f26c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c230000 CR3: 00000000211c2000 CR4: 00000000003506f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 rmqueue_pcplist mm/page_alloc.c:2799 [inline]
 rmqueue mm/page_alloc.c:2831 [inline]
 get_page_from_freelist+0x6ee/0x22a0 mm/page_alloc.c:3218
 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
 alloc_slab_page+0x5d/0x180 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:2081
 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 slab_alloc mm/slub.c:3503 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
 kmem_cache_alloc+0x109/0x2c0 mm/slub.c:3519
 kmem_cache_zalloc include/linux/slab.h:711 [inline]
 locks_alloc_lock fs/locks.c:271 [inline]
 flock_lock_inode+0x23b/0x1730 fs/locks.c:1039
 flock_lock_inode_wait fs/locks.c:2018 [inline]
 locks_lock_inode_wait+0x117/0x480 fs/locks.c:2045
 locks_lock_file_wait include/linux/filelock.h:346 [inline]
 __do_sys_flock fs/locks.c:2115 [inline]
 __se_sys_flock+0x4bb/0x620 fs/locks.c:2069
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0b5199e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0b527f2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000049
RAX: ffffffffffffffda RBX: 00007f0b51c25fa0 RCX: 00007f0b5199e159
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000004
RBP: 00007f0b51a3503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0b51c26038 R14: 00007f0b51c25fa0 R15: 00007ffe7b969738
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/14 18:44 linux-6.6.y 79643295eba1 81a27d1a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in flush_delayed_work
2026/07/05 17:03 linux-6.6.y da47cbc25466 fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in flush_delayed_work
* Struck through repros no longer work on HEAD.