INFO: task syz.8.3955:18942 blocked for more than 146 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.3955 state:R running task stack:25248 pid:18942 tgid:18941 ppid:18557 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5388 [inline]
__schedule+0x1840/0x57a0 kernel/sched/core.c:7189
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7513
irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
irqentry_exit+0x14f/0x8e0 kernel/entry/common.c:164
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:console_flush_one_record arch/x86/include/asm/irqflags.h:-1 [inline]
RIP: 0010:console_flush_all+0x7d2/0xaf0 kernel/printk/printk.c:3343
Code: ff ff e8 21 da 20 00 90 0f 0b 90 e9 9c fc ff ff e8 13 da 20 00 e8 ee de fd 09 48 85 db 74 c0 e8 04 da 20 00 fb 48 8b 5c 24 18 <48> 8b 44 24 28 42 80 3c 20 00 4d 8d 77 58 74 08 4c 89 f7 e8 96 17
RSP: 0018:ffffc900015f7a40 EFLAGS: 00000283
RAX: ffffffff81a4662c RBX: ffffc900015f7ba0 RCX: 0000000000080000
RDX: ffffc9000f73e000 RSI: 000000000000788e RDI: 000000000000788f
RBP: ffffc900015f7b50 R08: ffffffff902f88f7 R09: 1ffffffff205f11e
R10: dffffc0000000000 R11: fffffbfff205f11f R12: dffffc0000000000
R13: 0000000000000001 R14: 0000000000000000 R15: ffffffff8f217b60
__console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
console_unlock+0xd1/0x1c0 kernel/printk/printk.c:3413
do_fb_ioctl+0x7bc/0x800 drivers/video/fbdev/core/fb_chrdev.c:94
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8c4039ce59
RSP: 002b:00007f8c411be028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f8c40615fa0 RCX: 00007f8c4039ce59
RDX: 0000200000000040 RSI: 0000000000004601 RDI: 0000000000000007
RBP: 00007f8c40432d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8c40616038 R14: 00007f8c40615fa0 R15: 00007f8c4073fa48
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8e95c780 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
6 locks held by kworker/u9:0/50:
#0: ffff88806abb0940 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#0: ffff88806abb0940 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
#1: ffffc90000ba7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#1: ffffc90000ba7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
#2: ffff8880883c8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
#3: ffff8880883c80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5764
#4: ffffffff8ff42e40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#4: ffffffff8ff42e40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x145/0x320 net/bluetooth/hci_conn.c:1411
#5: ffff88804c3b2af8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x92/0x570 net/bluetooth/l2cap_core.c:1779
4 locks held by udevd/4999:
2 locks held by getty/5388:
#0: ffff888036bdf0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1380 drivers/tty/n_tty.c:2211
1 lock held by sshd-session/5615:
6 locks held by kworker/u8:12/6779:
#0: ffff88813fe7c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#0: ffff88813fe7c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
#1: ffffc9000359fc40 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#1: ffffc9000359fc40 ((work_completion)(&buf->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
#2: ffff88801ae9a0b8 (&buf->lock){+.+.}-{4:4}, at: flush_to_ldisc+0x38/0x6c0 drivers/tty/tty_buffer.c:474
#3: ffff88803477b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref+0x1c/0x90 drivers/tty/tty_ldisc.c:263
#4: ffff88803477b2c8 (&tty->termios_rwsem){++++}-{4:4}, at: class_rwsem_read_constructor include/linux/rwsem.h:259 [inline]
#4: ffff88803477b2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_receive_buf_common+0x82/0x12d0 drivers/tty/n_tty.c:1678
#5: ffffc90004086370 (&ldata->output_lock){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#5: ffffc90004086370 (&ldata->output_lock){+.+.}-{4:4}, at: commit_echoes+0x4e/0x220 drivers/tty/n_tty.c:736
2 locks held by kworker/u8:18/9245:
7 locks held by kworker/0:1/13330:
#0: ffff8880202fe940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#0: ffff8880202fe940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
#1: ffffc90002527c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#1: ffffc90002527c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
#2: ffff88802aa7b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#2: ffff88802aa7b1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5899
#3: ffff88804d53b1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#3: ffff88804d53b1d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 drivers/usb/core/hub.c:2336
#4: ffff8880203191a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
#4: ffff8880203191a0 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1174 [inline]
#4: ffff8880203191a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1372
#5: ffffffff8f83bc80 (input_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#5: ffffffff8f83bc80 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x2fa/0x610 drivers/input/input.c:2204
#6: ffffffff8e962aa8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
#6: ffffffff8e962aa8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:961
3 locks held by kworker/0:9/16803:
#0: ffff8880202fe940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#0: ffff8880202fe940 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
#1: ffff8880b8624588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:933
#2: ffff8880b8628fb0 (lock#6){..-.}-{3:3}, at: local_lock_acquire include/linux/local_lock_internal.h:46 [inline]
#2: ffff8880b8628fb0 (lock#6){..-.}-{3:3}, at: kcov_remote_stop+0x69/0x6d0 kernel/kcov.c:1030
2 locks held by kworker/0:16/17641:
#0: ffff88813fe3f140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#0: ffff88813fe3f140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
#1: ffffc90002517c40 (console_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
#1: ffffc90002517c40 (console_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3397
2 locks held by syz.5.3724/17911:
4 locks held by syz.1.3921/18763:
#0: ffff88803477b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffff88803477b128 (&tty->atomic_write_lock){+.+.}-{4:4}, at: tty_write_lock drivers/tty/tty_io.c:939 [inline]
#1: ffff88803477b128 (&tty->atomic_write_lock){+.+.}-{4:4}, at: iterate_tty_write drivers/tty/tty_io.c:958 [inline]
#1: ffff88803477b128 (&tty->atomic_write_lock){+.+.}-{4:4}, at: file_tty_write+0x1fb/0x9b0 drivers/tty/tty_io.c:1081
#2: ffff88803477b2c8 (&tty->termios_rwsem){++++}-{4:4}, at: class_rwsem_read_constructor include/linux/rwsem.h:259 [inline]
#2: ffff88803477b2c8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_write+0x1f2/0x1220 drivers/tty/n_tty.c:2349
#3: ffffc90004086370 (&ldata->output_lock){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#3: ffffc90004086370 (&ldata->output_lock){+.+.}-{4:4}, at: process_output_block drivers/tty/n_tty.c:513 [inline]
#3: ffffc90004086370 (&ldata->output_lock){+.+.}-{4:4}, at: n_tty_write+0x684/0x1220 drivers/tty/n_tty.c:2366
2 locks held by syz.8.3955/18942:
1 lock held by syz.7.4387/21296:
3 locks held by syz.2.4391/21315:
#0: ffff888055994180 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1029 [inline]
#0: ffff888055994180 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: __sock_release net/socket.c:721 [inline]
#0: ffff888055994180 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x82/0x220 net/socket.c:1515
#1: ffffffff8fe2de68 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 kernel/notifier.c:379
#2: ffff8880884b90d0 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nft_rcv_nl_event+0x148/0xe60 net/netfilter/nf_tables_api.c:12068
1 lock held by syz.0.4392/21319:
#0: ffffffff8e962978 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3828
4 locks held by syz-executor/21326:
1 lock held by dhcpcd/21327:
#0: ffff888029574260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff888029574260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3204
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x389/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 4999 Comm: udevd Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
RIP: 0010:mark_lock+0x3c/0x190 kernel/locking/lockdep.c:4731
Code: 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 94 b2 9c 12 <73> 10 48 69 c0 c8 00 00 00 48 8d 88 70 43 df 93 eb 42 83 3d 5b 42
RSP: 0018:ffffc90002e3f580 EFLAGS: 00000003
RAX: 0000000000000007 RBX: 0000000000000009 RCX: 0000000000000009
RDX: 0000000000000008 RSI: ffff88807fff0bb8 RDI: ffff88807fff0000
RBP: 0000000000000200 R08: ffffffff826f398c R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8e95c780 R12: 0000000000000004
R13: ffff88807fff0bb8 R14: ffff88807fff0000 R15: 0000000000000001
FS: 00007fa005d3d880(0000) GS:ffff8881252b9000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a653d4cce8 CR3: 000000007fa1e000 CR4: 00000000003526f0
Call Trace:
<TASK>
mark_usage kernel/locking/lockdep.c:4674 [inline]
__lock_acquire+0x683/0x2cd0 kernel/locking/lockdep.c:5191
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
kernfs_root+0x38/0x230 fs/kernfs/kernfs-internal.h:74
kernfs_active fs/kernfs/dir.c:40 [inline]
kernfs_dop_revalidate+0xd5/0x650 fs/kernfs/dir.c:1221
d_revalidate fs/namei.c:1030 [inline]
lookup_fast+0x25d/0x5d0 fs/namei.c:-1
walk_component fs/namei.c:2274 [inline]
link_path_walk+0x71f/0x1910 fs/namei.c:2652
path_openat+0x2c6/0x3890 fs/namei.c:4854
do_file_open+0x23e/0x4a0 fs/namei.c:4887
do_sys_openat2+0x113/0x200 fs/open.c:1364
do_sys_open fs/open.c:1370 [inline]
__do_sys_openat fs/open.c:1386 [inline]
__se_sys_openat fs/open.c:1381 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1381
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa0056a7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffe5fd2b3e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fa005d3d880 RCX: 00007fa0056a7407
RDX: 0000000000080000 RSI: 00007ffe5fd2b560 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055a628cfc7f5
R13: 000055a628cfc7f5 R14: 0000000000000001 R15: 0000000000000000
</TASK>