INFO: task syz.0.2314:14526 blocked for more than 144 seconds.
Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.2314 state:D stack:28408 pid:14526 tgid:14525 ppid:5821 task_flags:0x400140 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5392 [inline]
__schedule+0x116a/0x5de0 kernel/sched/core.c:6781
__schedule_loop kernel/sched/core.c:6859 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6874
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6931
__mutex_lock_common kernel/locking/mutex.c:678 [inline]
__mutex_lock+0x6c7/0xb90 kernel/locking/mutex.c:746
bdev_release+0x15a/0x6d0 block/bdev.c:1128
blkdev_release+0x15/0x20 block/fops.c:684
__fput+0x3ff/0xb70 fs/file_table.c:465
task_work_run+0x150/0x240 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:114
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9fd478e969
RSP: 002b:00007f9fd55f0038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: 0000000000000000 RBX: 00007f9fd49b5fa0 RCX: 00007f9fd478e969
RDX: 0000000000000000 RSI: 000000000000ab03 RDI: 0000000000000003
RBP: 00007f9fd4810ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9fd49b5fa0 R15: 00007ffcdad53768
Showing all locks held in the system:
1 lock held by khungtaskd/31:
#0: ffffffff8e3c27c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e3c27c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8e3c27c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6770
6 locks held by kworker/0:2/974:
#0: ffff8880216bdd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
#1: ffffc90003bd7d10 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
#2: ffff888029966198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:884 [inline]
#2: ffff888029966198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 drivers/usb/core/hub.c:5859
#3: ffff888033f7f198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:884 [inline]
#3: ffff888033f7f198 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0x10a/0x920 drivers/usb/core/hub.c:2307
#4: ffff88805a082160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:884 [inline]
#4: ffff88805a082160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1094 [inline]
#4: ffff88805a082160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa4/0x620 drivers/base/dd.c:1292
#5: ffff88805a0832c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:201 [inline]
#5: ffff88805a0832c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_disconnect_device drivers/input/input.c:702 [inline]
#5: ffff88805a0832c0 (&dev->mutex#2){+.+.}-{4:4}, at: __input_unregister_device+0x24/0x470 drivers/input/input.c:2219
6 locks held by kworker/1:2/2150:
#0: ffff8880216bdd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3213
#1: ffffc90005797d10 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3214
#2: ffff888029ab6198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:884 [inline]
#2: ffff888029ab6198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 drivers/usb/core/hub.c:5859
#3: ffff888022b8e198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:884 [inline]
#3: ffff888022b8e198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 drivers/base/dd.c:1004
#4: ffff888141304160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:884 [inline]
#4: ffff888141304160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 drivers/base/dd.c:1004
#5: ffffffff9007cfa8 (register_mutex#7){+.+.}-{4:4}, at: usb_audio_probe+0x4e2/0x3c80 sound/usb/card.c:813
1 lock held by acpid/5170:
#0: ffffffff8e3cdd78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x280/0x3c0 kernel/rcu/tree_exp.h:304
2 locks held by getty/5574:
#0: ffff888031bae0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fee2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
1 lock held by udevd/5820:
#0: ffff888143386358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0x41a/0xe40 block/bdev.c:945
4 locks held by udevd/5831:
#0: ffff888035cc7668 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x12c0 fs/seq_file.c:182
#1: ffff88802b2dfc88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4d/0x240 fs/kernfs/file.c:154
#2: ffff8880338f0788 (kn->active#18){++++}-{0:0}, at: kernfs_seq_start+0x71/0x240 fs/kernfs/file.c:155
#3: ffff888022b8e198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:889 [inline]
#3: ffff888022b8e198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
3 locks held by udevd/6439:
#0: ffff88805a087118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_close_device drivers/input/evdev.c:402 [inline]
#0: ffff88805a087118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_release+0x29e/0x420 drivers/input/evdev.c:447
#1: ffff88805a0832c0 (&dev->mutex#2){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:201 [inline]
#1: ffff88805a0832c0 (&dev->mutex#2){+.+.}-{4:4}, at: input_close_device+0x46/0x290 drivers/input/input.c:645
#2: ffffffff8e3cdd78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:336
2 locks held by kworker/u8:14/7725:
1 lock held by syz.0.2314/14526:
#0: ffff888143386358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x15a/0x6d0 block/bdev.c:1128
1 lock held by syz.2.2722/16070:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
watchdog+0xf70/0x12c0 kernel/hung_task.c:437
kthread+0x3c2/0x780 kernel/kthread.c:464
ret_from_fork+0x5d4/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 16070 Comm: syz.2.2722 Not tainted 6.15.0-syzkaller-07774-g90b83efa6701 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:151 [inline]
RIP: 0010:lock_is_held_type+0xf2/0x150 kernel/locking/lockdep.c:5945
Code: c0 45 31 ed 44 39 f0 41 0f 94 c5 48 c7 c7 fc eb bd 8d e8 f1 13 00 00 b8 ff ff ff ff 65 0f c1 05 ac a8 2f 08 83 f8 01 75 2d 9c <58> f6 c4 02 75 43 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 44
RSP: 0018:ffffc900034a71b0 EFLAGS: 00000046
RAX: 0000000000000001 RBX: ffff888065345370 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8dbdebfc RDI: ffffffff8bf52e00
RBP: ffff8880672370b0 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff888065344880
R13: 0000000000000001 R14: 00000000ffffffff R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888124a74000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f15b277d2d8 CR3: 000000007c743000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
lock_is_held include/linux/lockdep.h:249 [inline]
__update_lru_size include/linux/mm_inline.h:44 [inline]
lru_gen_update_size include/linux/mm_inline.h:206 [inline]
lru_gen_del_folio.constprop.0+0x7de/0xab0 include/linux/mm_inline.h:299
lruvec_del_folio include/linux/mm_inline.h:372 [inline]
__page_cache_release.part.0+0x719/0xb80 mm/swap.c:78
__page_cache_release mm/swap.c:993 [inline]
folios_put_refs+0x638/0x740 mm/swap.c:977
folio_batch_release include/linux/pagevec.h:101 [inline]
shmem_undo_range+0x58f/0x1150 mm/shmem.c:1125
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
evict+0x3e3/0x920 fs/inode.c:810
iput_final fs/inode.c:1898 [inline]
iput fs/inode.c:1924 [inline]
iput+0x521/0x880 fs/inode.c:1910
dentry_unlink_inode+0x29c/0x480 fs/dcache.c:466
__dentry_kill+0x1d0/0x600 fs/dcache.c:669
dput.part.0+0x4b1/0x9b0 fs/dcache.c:911
dput+0x1f/0x30 fs/dcache.c:901
__fput+0x51c/0xb70 fs/file_table.c:473
task_work_run+0x150/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xae2/0x2c70 kernel/exit.c:959
do_group_exit+0xd3/0x2a0 kernel/exit.c:1108
get_signal+0x2673/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x84/0x110 kernel/entry/common.c:111
exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline]
do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f578278e969
Code: Unable to access opcode bytes at 0x7f578278e93f.
RSP: 002b:00007f57835c3038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f57829b6080 RCX: 00007f578278e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000007
RBP: 00007f5782810ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f57829b6080 R15: 00007fff86222008