INFO: task syz.7.888:9422 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.888 state:D stack:24912 pid:9422 ppid:7573 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x1553/0x45a0 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747
sync_bdevs+0x1af/0x330 block/bdev.c:1076
ksys_sync+0xc6/0x170 fs/sync.c:105
__ia32_sys_sync+0xe/0x20 fs/sync.c:113
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f87e659bf79
RSP: 002b:00007f87e74d9028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007f87e6815fa0 RCX: 00007f87e659bf79
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f87e6815fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f87e6816038 R14: 00007f87e6815fa0 R15: 00007fff1022e078
Showing all locks held in the system:
1 lock held by khungtaskd/29:
#0: ffffffff8d131fa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d131fa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d131fa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by kworker/u4:2/35:
5 locks held by kworker/1:3/2170:
#0: ffff888147e78d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888147e78d38 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711
#1: ffffc900052e7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc900052e7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711
#2: ffff88802508c190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:995 [inline]
#2: ffff88802508c190 (&dev->mutex){....}-{3:3}, at: hub_event+0x180/0x49f0 drivers/usb/core/hub.c:5861
#3: ffff88805a7ca190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:995 [inline]
#3: ffff88805a7ca190 (&dev->mutex){....}-{3:3}, at: __device_attach+0x89/0x420 drivers/base/dd.c:1005
#4: ffff88806557c160 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:995 [inline]
#4: ffff88806557c160 (&dev->mutex){....}-{3:3}, at: __device_attach+0x89/0x420 drivers/base/dd.c:1005
3 locks held by kworker/u4:6/2982:
2 locks held by getty/5529:
#0: ffff8880315520a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x433/0x1390 drivers/tty/n_tty.c:2217
1 lock held by udevd/5764:
#0: ffff888141f0e4c8 (&disk->open_mutex){+.+.}-{3:3}, at: blkdev_get_by_dev+0x121/0x600 block/bdev.c:805
2 locks held by kworker/0:8/7820:
#0:
ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711
#1: ffffc90003a8fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90003a8fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711
1 lock held by syz-executor/8372:
#0: ffffffff8d137978 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#0: ffffffff8d137978 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
1 lock held by dhcpcd/8914:
#0: ffff888076ac2c20 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline]
#0: ffff888076ac2c20 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:658 [inline]
#0: ffff888076ac2c20 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x9b/0x230 net/socket.c:1420
1 lock held by syz.7.888/9422:
#0: ffff888141f0e4c8 (&disk->open_mutex){+.+.}-{3:3}, at: sync_bdevs+0x1af/0x330 block/bdev.c:1076
7 locks held by syz.6.1623/12643:
5 locks held by syz.3.1625/12650:
#0: ffffffff8dcd22d0 (minor_rwsem#2){++++}-{3:3}, at: usb_open+0x30/0x300 drivers/usb/core/file.c:38
#1: ffffffff8dd58388 (usblp_mutex){+.+.}-{3:3}, at: usblp_open+0x54/0x420 drivers/usb/class/usblp.c:417
#2: ffff88802508f508 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_lock_port drivers/usb/core/hub.c:3215 [inline]
#2: ffff88802508f508 (&port_dev->status_lock){+.+.}-{3:3}, at: usb_port_resume+0x26b/0x1c40 drivers/usb/core/hub.c:3773
#3: ffff888024a23768 (hcd->address0_mutex){+.+.}-{3:3}, at: usb_reset_and_verify_device+0x388/0x1a80 drivers/usb/core/hub.c:6166
#4: ffffffff8dcc7630 (ehci_cf_port_reset_rwsem){.+.+}-{3:3}, at: hub_port_reset+0x164/0x1730 drivers/usb/core/hub.c:3030
1 lock held by dhcpcd-run-hook/12689:
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf3d/0xf80 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 6709 Comm: udevd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:stack_trace_consume_entry+0x23/0x270 kernel/stacktrace.c:86
Code: 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 ba 00 00 00 00 00 fc ff df 4c 8d 47 10 4c 89 c5 <48> c1 ed 03 0f b6 44 15 00 84 c0 0f 85 04 01 00 00 44 8b 4f 10 4c
RSP: 0018:ffffc9000b8af3d8 EFLAGS: 00000296
RAX: ffffffff8132a3ba RBX: ffffc9000b8af4e0 RCX: ffff88802797da00
RDX: dffffc0000000000 RSI: ffffffff81ce5037 RDI: ffffc9000b8af4e0
RBP: ffffc9000b8af4f0 R08: ffffc9000b8af4f0 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: ffffffff81ce5037
R13: 1ffff11004f2fbee R14: ffffffff8175b740 R15: ffffc9000b8af428
FS: 00007f0b49e3f880(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0b49e3b000 CR3: 00000000217b8000 CR4: 00000000003506e0
Call Trace:
arch_stack_walk+0x138/0x190 arch/x86/kernel/stacktrace.c:27
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
save_stack+0x125/0x230 mm/page_owner.c:128
__reset_page_owner+0x4e/0x190 mm/page_owner.c:149
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1181 [inline]
free_unref_page_prepare+0x7b2/0x8c0 mm/page_alloc.c:2365
free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2504
release_pages+0x1f7a/0x2200 mm/swap.c:1022
tlb_batch_pages_flush mm/mmu_gather.c:98 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu+0x377/0x510 mm/mmu_gather.c:300
tlb_finish_mmu+0xc3/0x1d0 mm/mmu_gather.c:392
unmap_region+0x312/0x370 mm/mmap.c:2349
do_vmi_align_munmap+0x10dc/0x16d0 mm/mmap.c:2592
do_vmi_munmap+0x252/0x2d0 mm/mmap.c:2660
__vm_munmap+0x1a2/0x3c0 mm/mmap.c:2961
__do_sys_munmap mm/mmap.c:2978 [inline]
__se_sys_munmap mm/mmap.c:2975 [inline]
__x64_sys_munmap+0x60/0x70 mm/mmap.c:2975
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0b4971e097
Code: 73 01 c3 48 8b 0d 61 2d 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 0b 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 31 2d 0d 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd56f37488 EFLAGS: 00000246 ORIG_RAX: 000000000000000b
RAX: ffffffffffffffda RBX: 000055e22feafed0 RCX: 00007f0b4971e097
RDX: 000055e22feae538 RSI: 0000000000000200 RDI: 00007f0b49e37000
RBP: 0000000000000006 R08: 0000000000000030 R09: 000055e22febad50
R10: 0000000000000040 R11: 0000000000000246 R12: 000055e22fea70b0
R13: 00007f0b49f6639c R14: 0000000000000c00 R15: 0000000000000009