INFO: task syz-executor:6349 blocked for more than 143 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:23976 pid:6349  tgid:6349  ppid:1      task_flags:0x40054c flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5357 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6961
 __schedule_loop kernel/sched/core.c:7043 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:7058
 schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common+0x2ff/0x4e0 kernel/sched/completion.c:121
 __flush_work+0x7d7/0xcc0 kernel/workqueue.c:4244
 __cancel_work_sync+0x10c/0x130 kernel/workqueue.c:4364
 hci_cmd_sync_clear+0x33/0x100 net/bluetooth/hci_sync.c:655
 hci_unregister_dev+0x1cc/0x640 net/bluetooth/hci_core.c:2711
 vhci_release+0x17d/0x230 drivers/bluetooth/hci_vhci.c:690
 __fput+0x402/0xb70 fs/file_table.c:468
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x86f/0x2bf0 kernel/exit.c:961
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
 get_signal+0x2673/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop+0x84/0x110 kernel/entry/common.c:40
 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
 do_syscall_64+0x41c/0x4e0 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f229a97d3aa
RSP: 002b:00007ffe8a357cc0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007f229a97d3aa
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ffe8a357d0c R08: 0000000000000000 R09: 00007ffe8a357a27
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000032
R13: 000000000001f127 R14: 000000000001f127 R15: 00007ffe8a357d60
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
 #0: ffffffff8e5c15a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8e5c15a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #0: ffffffff8e5c15a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
2 locks held by syslogd/5205:
2 locks held by getty/5610:
 #0: ffff88814d6ab0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
3 locks held by kworker/u9:2/5937:
 #0: ffff8880253f8148 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3211
 #1: ffffc9000435fd10 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3212
 #2: ffff88802b8b4dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331
4 locks held by syz-executor/20149:
 #0: ffff8880b843a318 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:636
 #1: ffff8880b8424088 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:220 [inline]
 #1: ffff8880b8424088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 kernel/sched/core.c:6955
 #2: ffff888033dc1d98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline]
 #2: ffff888033dc1d98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: handle_pte_fault mm/memory.c:6060 [inline]
 #2: ffff888033dc1d98 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __handle_mm_fault+0x12e5/0x2a50 mm/memory.c:6195
 #3: ffffffff8e5c15a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #3: ffffffff8e5c15a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #3: ffffffff8e5c15a0 (rcu_read_lock){....}-{1:3}, at: page_table_check_set+0x17f/0x750 mm/page_table_check.c:112

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline]
 watchdog+0xf0e/0x1260 kernel/hung_task.c:491
 kthread+0x3c2/0x780 kernel/kthread.c:463
 ret_from_fork+0x56a/0x730 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 21016 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:rcu_read_lock include/linux/rcupdate.h:842 [inline]
RIP: 0010:___pte_offset_map+0x2c4/0x4f0 mm/pgtable-generic.c:286
Code: 23 02 00 00 48 03 2d 4b e5 e7 0b 48 01 eb e8 93 ff ad ff 48 89 d8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 11 11 8a 09 e8 7c ff ad ff <e8> 17 24 93 ff 31 ff 89 c3 89 c6 e8 4c fa ad ff 84 db 0f 85 81 fd
RSP: 0000:ffffc9000dae7a70 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffffffff820d9ce4
RDX: ffff8880297c8000 RSI: ffffffff820d9f54 RDI: 0000000000000005
RBP: 00007f3244265000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffc9000dae7ad8
R13: ffff88807880a108 R14: ffffc9000dae7dc8 R15: ffffea0000000000
FS:  000055557627b500(0000) GS:ffff8881246b4000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3244265690 CR3: 000000007821f000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __pte_offset_map include/linux/mm.h:3014 [inline]
 __pte_offset_map_lock+0x8d/0x310 mm/pgtable-generic.c:397
 pte_offset_map_lock include/linux/mm.h:3029 [inline]
 wp_page_copy mm/memory.c:3588 [inline]
 do_wp_page+0x144a/0x4f00 mm/memory.c:4013
 handle_pte_fault mm/memory.c:6068 [inline]
 __handle_mm_fault+0x1b2d/0x2a50 mm/memory.c:6195
 handle_mm_fault+0x589/0xd10 mm/memory.c:6364
 do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f3243450a6d
Code: 8d 15 22 1d 1a 00 be 40 00 00 00 31 c0 41 56 41 55 41 54 55 53 48 81 ec f8 01 00 00 4c 8b 05 5a 4c e1 00 48 8b 0d 1b 4c e1 00 <c6> 05 1c 4c e1 00 01 48 8d 9c 24 60 01 00 00 48 89 df e8 3c 59 0d
RSP: 002b:00007ffd77a27580 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 00007f32435f276b RSI: 0000000000000040 RDI: 000055557627b808
RBP: 00007ffd77a277dc R08: 0000000000001b70 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000032
R13: 0000000000042be1 R14: 0000000000042be1 R15: 00007ffd77a27830
 </TASK>