INFO: task udevd:6666 blocked for more than 155 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D stack:23248 pid:6666 tgid:6666 ppid:5235 task_flags:0x400140 flags:0x00080001
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1798/0x4cc0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0x165/0x360 kernel/sched/core.c:7026
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083
rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185
__down_write_common kernel/locking/rwsem.c:1317 [inline]
__down_write kernel/locking/rwsem.c:1326 [inline]
down_write+0x1ab/0x1f0 kernel/locking/rwsem.c:1591
inode_lock include/linux/fs.h:980 [inline]
open_last_lookups fs/namei.c:3892 [inline]
path_openat+0x8da/0x3830 fs/namei.c:4131
do_filp_open+0x1fa/0x410 fs/namei.c:4161
do_sys_openat2+0x121/0x1c0 fs/open.c:1437
do_sys_open fs/open.c:1452 [inline]
__do_sys_openat fs/open.c:1468 [inline]
__se_sys_openat fs/open.c:1463 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1463
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb48f4a7407
RSP: 002b:00007fffb4352700 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fb48fc9a880 RCX: 00007fb48f4a7407
RDX: 0000000000080241 RSI: 00007fffb4352c60 RDI: ffffffffffffff9c
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000000001b6 R11: 0000000000000202 R12: 0000563ada000dfc
R13: 0000563ada000dfc R14: 0000000000000001 R15: 0000563ada01b140
Showing all locks held in the system:
1 lock held by kthreadd/2:
4 locks held by kworker/R-kvfre/6:
4 locks held by kworker/0:0/9:
2 locks held by kworker/0:1/10:
3 locks held by kworker/u8:0/12:
3 locks held by kworker/u8:1/13:
2 locks held by kworker/1:0/24:
1 lock held by khungtaskd/31:
#0: ffffffff8e33d320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e33d320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e33d320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:2/36:
1 lock held by khugepaged/38:
#0: ffffffff8e4043a8 (lock#5){+.+.}-{4:4}, at: __lru_add_drain_all+0x6b/0x5e0 mm/swap.c:840
3 locks held by kworker/1:1/43:
#0: ffff88813fe5a148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff88813fe5a148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90000b37ba0 ((work_completion)(&(&sbi->sync_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90000b37ba0 ((work_completion)(&(&sbi->sync_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffff88802a442998 (&sbi->vh_mutex){+.+.}-{4:4}, at: hfsplus_sync_fs+0x266/0x770 fs/hfsplus/super.c:211
4 locks held by kworker/u8:3/50:
3 locks held by kworker/u8:4/60:
3 locks held by kworker/0:1H/97:
#0: ffff888140ea2d48 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline]
#0: ffff888140ea2d48 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3346
#1: ffffc90002607ba0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline]
#1: ffffc90002607ba0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3346
#2: ffffffff8e342db8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
#2: ffffffff8e342db8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 kernel/rcu/tree_exp.h:957
3 locks held by kworker/u8:5/198:
3 locks held by kworker/u8:6/1147:
3 locks held by kworker/u8:7/1151:
3 locks held by kworker/u8:8/1169:
4 locks held by kworker/0:2/1213:
3 locks held by kworker/u8:9/1343:
4 locks held by kworker/R-bat_e/3428:
2 locks held by klogd/5224:
2 locks held by udevd/5235:
1 lock held by dhcpcd/5529:
2 locks held by dhcpcd/5530:
2 locks held by crond/5604:
2 locks held by getty/5619:
#0: ffff88814d2bc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
4 locks held by sshd-session/5847:
1 lock held by syz-executor/5848:
3 locks held by syz-executor/5863:
#0: ffff888024b000e0 (&type->s_umount_key#72){++++}-{4:4}, at: __super_lock fs/super.c:57 [inline]
#0: ffff888024b000e0 (&type->s_umount_key#72){++++}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
#0: ffff888024b000e0 (&type->s_umount_key#72){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:505
#1: ffff88802a442998 (&sbi->vh_mutex){+.+.}-{4:4}, at: hfsplus_sync_fs+0x266/0x770 fs/hfsplus/super.c:211
#2: ffff88802a4428f8 (&sbi->alloc_mutex){+.+.}-{4:4}, at: hfsplus_sync_fs+0x279/0x770 fs/hfsplus/super.c:212
3 locks held by syz-executor/5872:
5 locks held by syz-executor/5878:
1 lock held by kworker/R-wg-cr/5904:
#0: ffffffff8e1e3c48 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2678
3 locks held by kworker/0:3/5905:
1 lock held by kworker/R-wg-cr/5906:
1 lock held by kworker/R-wg-cr/5907:
#0: ffffffff8e1e3c48 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline]
#0: ffffffff8e1e3c48 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x88b/0xdd0 kernel/workqueue.c:3556
1 lock held by kworker/R-wg-cr/5908:
#0: ffffffff8e1e3c48 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline]
#0: ffffffff8e1e3c48 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x88b/0xdd0 kernel/workqueue.c:3556
2 locks held by kworker/1:3/5915:
3 locks held by kworker/0:4/5946:
2 locks held by kworker/1:6/5949:
2 locks held by kworker/0:5/5974:
2 locks held by kworker/0:6/5976:
3 locks held by kworker/0:7/5977:
2 locks held by udevd/6666:
#0: ffff88806a16e420 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: inode_lock include/linux/fs.h:980 [inline]
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: open_last_lookups fs/namei.c:3892 [inline]
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5){++++}-{4:4}, at: path_openat+0x8da/0x3830 fs/namei.c:4131
2 locks held by udevd/6684:
#0: ffff88806a16e420 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
2 locks held by udevd/6695:
#0: ffff88806a16e420 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:508
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline]
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: lock_rename fs/namei.c:3360 [inline]
#1: ffff88802ee9b688 (&type->i_mutex_dir_key#5/1){+.+.}-{4:4}, at: do_renameat2+0x3b9/0xa50 fs/namei.c:5311
3 locks held by udevd/6697:
3 locks held by kworker/u8:10/7063:
1 lock held by syz.0.367/7613:
4 locks held by kworker/u8:11/7635:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf60/0xfa0 kernel/hung_task.c:495
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 3428 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: bat_events batadv_tt_purge
RIP: 0010:mark_held_locks kernel/locking/lockdep.c:4315 [inline]
RIP: 0010:__trace_hardirqs_on_caller kernel/locking/lockdep.c:4343 [inline]
RIP: 0010:lockdep_hardirqs_on_prepare+0xfc/0x2a0 kernel/locking/lockdep.c:4410
Code: 8e d1 00 00 00 49 89 de 49 81 c6 30 0b 00 00 45 31 ff 4d 89 f4 eb 13 49 ff c7 48 63 83 28 0b 00 00 49 83 c4 28 49 39 c7 7d 44 <49> 83 ff 31 73 2d 41 8b 44 24 20 a9 00 00 04 00 74 db 25 00 00 03
RSP: 0018:ffffc90000a07940 EFLAGS: 00000097
RAX: 0000000000000006 RBX: ffff888030b7dac0 RCX: ffffffff93718fc0
RDX: 0000000000000002 RSI: ffff888030b7e618 RDI: ffff888030b7dac0
RBP: ffffc90000a07a10 R08: ffffffff8fc35777 R09: 1ffffffff1f86aee
R10: dffffc0000000000 R11: fffffbfff1f86aef R12: ffff888030b7e6b8
R13: ffffffff8a3cb4e2 R14: ffff888030b7e5f0 R15: 0000000000000005
FS: 0000000000000000(0000) GS:ffff888125afc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffec8d745dc CR3: 00000000312d0000 CR4: 00000000003526f0
Call Trace:
trace_hardirqs_on+0x28/0x40 kernel/trace/trace_preemptirq.c:78
__local_bh_enable_ip+0x12d/0x1c0 kernel/softirq.c:455
local_bh_enable include/linux/bottom_half.h:33 [inline]
ip6_pol_route+0x7ef/0x1180 net/ipv6/route.c:2307
pol_lookup_func include/net/ip6_fib.h:617 [inline]
fib6_rule_lookup+0x52f/0x6f0 net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2338 [inline]
ip6_route_input+0x6de/0xad0 net/ipv6/route.c:2641
ip6_rcv_finish+0x141/0x2e0 net/ipv6/ip6_input.c:77
ip_sabotage_in+0x1e1/0x270 net/bridge/br_netfilter_hooks.c:990
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK+0x206/0x3a0 include/linux/netfilter.h:316
__netif_receive_skb_one_core net/core/dev.c:6078 [inline]
__netif_receive_skb+0xd3/0x380 net/core/dev.c:6191
netif_receive_skb_internal net/core/dev.c:6277 [inline]
netif_receive_skb+0x1cb/0x790 net/core/dev.c:6336
NF_HOOK+0xa0/0x390 include/linux/netfilter.h:319
br_handle_frame_finish+0x15c6/0x1c50 net/bridge/br_input.c:235
br_nf_hook_thresh+0x3c6/0x4a0 net/bridge/br_netfilter_hooks.c:-1
br_nf_pre_routing_finish_ipv6+0x999/0xd60 net/bridge/br_netfilter_ipv6.c:-1
NF_HOOK include/linux/netfilter.h:318 [inline]
br_nf_pre_routing_ipv6+0x37e/0x6b0 net/bridge/br_netfilter_ipv6.c:184
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
br_handle_frame+0x982/0x14c0 net/bridge/br_input.c:442
__netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5965
__netif_receive_skb_one_core net/core/dev.c:6076 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6191
process_backlog+0x60e/0x14f0 net/core/dev.c:6543
__napi_poll+0xc7/0x360 net/core/dev.c:7593
napi_poll net/core/dev.c:7656 [inline]
net_rx_action+0x707/0xe30 net/core/dev.c:7783
handle_softirqs+0x286/0x870 kernel/softirq.c:622
do_softirq+0xec/0x180 kernel/softirq.c:523
__local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:396 [inline]
batadv_tt_local_purge+0x2a7/0x340 net/batman-adv/translation-table.c:1315
batadv_tt_purge+0x35/0x9e0 net/batman-adv/translation-table.c:3509
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
rescuer_thread+0x53c/0xdd0 kernel/workqueue.c:3523
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245