INFO: task syz.6.231:5508 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.231       state:D stack:24560 pid: 5508 ppid:  5124 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 rwsem_down_read_slowpath+0x548/0x9d0 kernel/locking/rwsem.c:1055
 __down_read_common kernel/locking/rwsem.c:1239 [inline]
 __down_read kernel/locking/rwsem.c:1252 [inline]
 down_read+0x96/0x2e0 kernel/locking/rwsem.c:1500
 iterate_supers+0xa4/0x1d0 fs/super.c:716
 drop_caches_sysctl_handler+0x8e/0x160 fs/drop_caches.c:62
 proc_sys_call_handler+0x45e/0x6d0 fs/proc/proc_sysctl.c:588
 do_iter_readv_writev+0x47e/0x5f0 fs/read_write.c:-1
 do_iter_write+0x205/0x7b0 fs/read_write.c:855
 iter_file_splice_write+0x699/0xcc0 fs/splice.c:689
 do_splice_from fs/splice.c:767 [inline]
 direct_splice_actor+0xe1/0x130 fs/splice.c:956
 splice_direct_to_actor+0x4ea/0xc10 fs/splice.c:902
 do_splice_direct+0x1d4/0x2f0 fs/splice.c:1008
 do_sendfile+0x5fc/0xeb0 fs/read_write.c:1249
 __do_sys_sendfile64 fs/read_write.c:1311 [inline]
 __se_sys_sendfile64+0xdc/0x1a0 fs/read_write.c:1303
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9ceb129eb9
RSP: 002b:00007f9ce9385028 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 00007f9ceb3a4fa0 RCX: 00007f9ceb129eb9
RDX: 0000200000002080 RSI: 0000000000000003 RDI: 0000000000000004
RBP: 00007f9ceb197c1f R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000023b R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9ceb3a5038 R14: 00007f9ceb3a4fa0 R15: 00007ffc007da288
 </TASK>
INFO: task syz.6.231:5511 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.231       state:D stack:26384 pid: 5511 ppid:  5124 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 rwsem_down_read_slowpath+0x548/0x9d0 kernel/locking/rwsem.c:1055
 __down_read_common kernel/locking/rwsem.c:1239 [inline]
 __down_read kernel/locking/rwsem.c:1252 [inline]
 down_read+0x96/0x2e0 kernel/locking/rwsem.c:1500
 iterate_supers+0xa4/0x1d0 fs/super.c:716
 drop_caches_sysctl_handler+0x8e/0x160 fs/drop_caches.c:62
 proc_sys_call_handler+0x45e/0x6d0 fs/proc/proc_sysctl.c:588
 call_write_iter include/linux/fs.h:2173 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x745/0xd60 fs/read_write.c:594
 ksys_write+0x152/0x260 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9ceb129eb9
RSP: 002b:00007f9ce9364028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f9ceb3a5090 RCX: 00007f9ceb129eb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f9ceb197c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9ceb3a5128 R14: 00007f9ceb3a5090 R15: 00007ffc007da288
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8c31eaa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
2 locks held by getty/3951:
 #0: ffff88802c5de098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc900025e62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x5df/0x1a70 drivers/tty/n_tty.c:2158
3 locks held by kworker/0:3/4174:
 #0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
 #1: ffffc900011dfd00 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
 #2: ffff88807413f400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x56/0xb40 drivers/net/netdevsim/dev.c:757
1 lock held by syz-executor/4185:
 #0: ffff8880265b00e0 (&type->s_umount_key#60){++++}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:365
3 locks held by kworker/1:9/4481:
 #0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
 #1: ffffc90003d97d00 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
 #2: ffffffff8c323528 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #2: ffffffff8c323528 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
2 locks held by kworker/0:17/4635:
 #0: ffff888016c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
 #1: ffffc9000342fd00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
1 lock held by dhcpcd/5037:
 #0: ffff888073ceca10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
 #0: ffff888073ceca10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:650 [inline]
 #0: ffff888073ceca10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1345
2 locks held by syz.6.231/5508:
 #0: ffff88802b616460 (sb_writers#4){.+.+}-{0:0}, at: do_sendfile+0x5d9/0xeb0 fs/read_write.c:1248
 #1: ffff8880265b00e0 (&type->s_umount_key#60){++++}-{3:3}, at: iterate_supers+0xa4/0x1d0 fs/super.c:716
3 locks held by syz.6.231/5511:
 #0: ffff8880523e0d70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff88802b616460 (sb_writers#4){.+.+}-{0:0}, at: vfs_write+0x295/0xd60 fs/read_write.c:590
 #2: ffff8880265b00e0 (&type->s_umount_key#60){++++}-{3:3}, at: iterate_supers+0xa4/0x1d0 fs/super.c:716
3 locks held by kworker/u4:18/6293:
 #0: ffff8880b903a358 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xa5/0x140 kernel/sched/core.c:483
 #1: ffff8880210f0a28 (&p->pi_lock){-.-.}-{2:2}, at: try_to_wake_up+0x5c/0x1050 kernel/sched/core.c:4049
 #2: ffff8880b91280d8 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x123/0x270 kernel/time/timer.c:946
1 lock held by syz.3.708/7962:
 #0: ffff8880265b00e0 (&type->s_umount_key#60){++++}-{3:3}, at: iterate_supers+0xa4/0x1d0 fs/super.c:716
8 locks held by syz-executor/8254:
 #0: ffff88807f2d2460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x295/0xd60 fs/read_write.c:590
 #1: ffff888061ee8488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e5/0x4c0 fs/kernfs/file.c:287
 #2: ffff888147c2a008 (kn->active#284){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x208/0x4c0 fs/kernfs/file.c:288
 #3: ffffffff8cd79c08 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd3/0x3a0 drivers/net/netdevsim/bus.c:344
 #4: ffff888074139178 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:764 [inline]
 #4: ffff888074139178 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1044 [inline]
 #4: ffff888074139178 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xb0/0x750 drivers/base/dd.c:1259
 #5: ffff88807413f400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1359 [inline]
 #5: ffff88807413f400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_reload_destroy+0x115/0x240 drivers/net/netdevsim/dev.c:1561
 #6: ffffffff8d43c748 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3b/0x150 drivers/net/netdevsim/netdev.c:381
 #7: ffffffff8c323528 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #7: ffffffff8c323528 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845
1 lock held by dhcpcd/8409:
 #0: ffff8880601ef410 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
 #0: ffff8880601ef410 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:650 [inline]
 #0: ffff8880601ef410 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1345

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xe0f/0xe50 kernel/hung_task.c:369
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 8410 Comm: dhcpcd-run-hook Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
RIP: 0010:preempt_latency_start kernel/sched/core.c:5492 [inline]
RIP: 0010:preempt_count_add+0xb5/0x190 kernel/sched/core.c:5515
Code: 0b 00 85 c0 74 09 31 db 31 ff e8 86 d1 0b 00 65 4c 8b 35 8e 0e b0 7e 49 81 c6 e8 14 00 00 4c 89 f0 48 c1 e8 03 42 80 3c 38 00 <74> 08 4c 89 f7 e8 c1 cb 6b 00 49 89 1e 5b 41 5e 41 5f c3 89 fb e8
RSP: 0018:ffffc9000318f708 EFLAGS: 00000246
RAX: 1ffff1100bc5c655 RBX: ffffffff81350d2c RCX: ffffffff962d8f00
RDX: dffffc0000000000 RSI: ffffffff81be078b RDI: ffffffff81350d2c
RBP: ffffc9000318f830 R08: ffffc9000318f8b0 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000631f09 R12: ffffffff81be078b
R13: ffffc9000318f930 R14: ffff88805e2e32a8 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2609786008 CR3: 00000000616bc000 CR4: 00000000003506f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083
DR3: ffffffffefffff15 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 unwind_next_frame+0xac/0x1d90 arch/x86/kernel/unwind_orc.c:433
 arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1710 [inline]
 slab_free_freelist_hook+0xea/0x170 mm/slub.c:1736
 slab_free mm/slub.c:3504 [inline]
 kmem_cache_free+0x8f/0x210 mm/slub.c:3520
 putname fs/namei.c:271 [inline]
 user_path_at_empty+0x13e/0x190 fs/namei.c:2893
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0x107/0x500 fs/stat.c:221
 vfs_fstatat fs/stat.c:243 [inline]
 __do_sys_newfstatat fs/stat.c:411 [inline]
 __se_sys_newfstatat fs/stat.c:405 [inline]
 __x64_sys_newfstatat+0x15f/0x200 fs/stat.c:405
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f26097a9eaa
Code: b8 05 00 00 00 0f 05 48 3d 00 f0 ff ff 77 01 c3 f7 d8 89 05 08 44 01 00 b8 ff ff ff ff c3 66 90 41 89 ca b8 06 01 00 00 0f 05 <3d> 00 f0 ff ff 77 07 31 c0 c3 0f 1f 40 00 f7 d8 89 05 e0 43 01 00
RSP: 002b:00007ffe32aa15a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007ffe32aa15b7 RCX: 00007f26097a9eaa
RDX: 00007ffe32aa1660 RSI: 00007ffe32aa15b0 RDI: 00000000ffffff9c
RBP: 00007ffe32aa1720 R08: 00007ffe32aa17a7 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000001e
R13: 00007f2609786000 R14: 0000000000000001 R15: 0000000000000000
 </TASK>