INFO: task syz.4.2272:12794 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.2272      state:D stack:29072 pid:12794 ppid:  4187 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 device_lock include/linux/device.h:809 [inline]
 usbdev_do_ioctl drivers/usb/core/devio.c:2597 [inline]
 usbdev_ioctl+0x146/0x1f20 drivers/usb/core/devio.c:2805
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f044a8210d9
RSP: 002b:00007f0448a58028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f044aaa9090 RCX: 00007f044a8210d9
RDX: 0000000000000000 RSI: 000000008004550f RDI: 0000000000000009
RBP: 00007f044a8b8024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f044aaa9128 R14: 00007f044aaa9090 R15: 00007ffe1bf9b028
 </TASK>
INFO: task syz.3.2276:12803 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.2276      state:D stack:25296 pid:12803 ppid:  4199 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 device_lock include/linux/device.h:809 [inline]
 usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
 chrdev_open+0x585/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7f7/0xf90 fs/open.c:826
 do_open fs/namei.c:3659 [inline]
 path_openat+0x2718/0x2fb0 fs/namei.c:3793
 do_filp_open+0x1df/0x400 fs/namei.c:3820
 do_sys_openat2+0x14b/0x500 fs/open.c:1255
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f479628090e
RSP: 002b:00007f4794517b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f47945186c0 RCX: 00007f479628090e
RDX: 0000000000000002 RSI: 00007f4794517c00 RDI: ffffffffffffff9c
RBP: 00007f4794517c00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd
R13: 00007f4796548038 R14: 00007f4796547fa0 R15: 00007ffd8790b248
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
2 locks held by getty/3955:
 #0: ffff88814c742098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc90002cf62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158
3 locks held by kworker/1:18/4506:
 #0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc90003cafd00 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffff88807a8a4400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x56/0xab0 drivers/net/netdevsim/dev.c:757
3 locks held by kworker/u4:15/5238:
11 locks held by syz.4.2272/12793:
 #0: ffff888079878d70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff8880943ee460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #2: ffff88802bbd9c88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1063 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x85/0x710 drivers/base/dd.c:1279
 #4: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #4: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1064 [inline]
 #4: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa1/0x710 drivers/base/dd.c:1279
 #5: ffff88802490b1a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #5: ffff88802490b1a8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1064 [inline]
 #5: ffff88802490b1a8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa1/0x710 drivers/base/dd.c:1279
 #6: ffff888078a92220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #6: ffff888078a92220 (&dev->mutex){....}-{3:3}, at: usb_disconnect+0xf8/0x8a0 drivers/usb/core/hub.c:2278
 #7: ffff8881400a61a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #7: ffff8881400a61a8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1064 [inline]
 #7: ffff8881400a61a8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa1/0x710 drivers/base/dd.c:1279
 #8: ffffffff8d3f5608 (register_mutex#7){+.+.}-{3:3}, at: usb_audio_disconnect+0xd0/0x6f0 sound/usb/card.c:960
 #9: ffff8880622ad200 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #9: ffff8880622ad200 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1064 [inline]
 #9: ffff8880622ad200 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa1/0x710 drivers/base/dd.c:1279
 #10: ffffffff8d3bc7a8 (register_mutex#6){+.+.}-{3:3}, at: snd_seq_midisynth_remove+0x68/0x4e0 sound/core/seq/seq_midi.c:432
1 lock held by syz.4.2272/12794:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_do_ioctl drivers/usb/core/devio.c:2597 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_ioctl+0x146/0x1f20 drivers/usb/core/devio.c:2805
1 lock held by syz.3.2276/12803:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
1 lock held by syz.0.2303/12881:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
4 locks held by syz.0.2303/12885:
 #0: ffff8880782f54f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff888020254460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #2: ffff88805f89b888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1063 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x85/0x710 drivers/base/dd.c:1279
1 lock held by syz.1.2306/12890:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
4 locks held by syz.1.2306/12891:
 #0: ffff88807dcb8870 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff8880239c8460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #2: ffff8880620af488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1063 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x85/0x710 drivers/base/dd.c:1279
1 lock held by syz.6.2336/13020:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
4 locks held by syz.6.2336/13024:
 #0: ffff8880760b40f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff888057a5a460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #2: ffff88802c46fc88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1063 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x85/0x710 drivers/base/dd.c:1279
2 locks held by syz-executor/13040:
 #0: ffff8880204ac0e0 (&type->s_umount_key#55){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:365
 #1: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #1: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
1 lock held by syz.5.2370/13158:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
1 lock held by syz.2.2420/13343:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
1 lock held by syz.4.2494/13602:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
4 locks held by syz.4.2494/13603:
 #0: ffff88802ca765f0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff88805ae9c460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #2: ffff888060839888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1063 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x85/0x710 drivers/base/dd.c:1279
2 locks held by kworker/1:9/13665:
 #0: ffff888016c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc9000341fd00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
8 locks held by syz-executor/13686:
 #0: ffff88807e654460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #1: ffff888060994088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #2: ffff888147bc9490 (kn->active#284){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1fd/0x500 fs/kernfs/file.c:288
 #3: ffffffff8cd89f08 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd3/0x3a0 drivers/net/netdevsim/bus.c:344
 #4: ffff88807a8a3178 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #4: ffff88807a8a3178 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1064 [inline]
 #4: ffff88807a8a3178 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa1/0x710 drivers/base/dd.c:1279
 #5: ffff88807a8a4400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1359 [inline]
 #5: ffff88807a8a4400 (&nsim_dev->port_list_lock){+.+.}-{3:3}, at: nsim_dev_reload_destroy+0x109/0x230 drivers/net/netdevsim/dev.c:1561
 #6: ffffffff8d44cc08 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3b/0x150 drivers/net/netdevsim/netdev.c:381
 #7: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #7: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845
1 lock held by syz.7.2528/13716:
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #0: ffff88802490a220 (&dev->mutex){....}-{3:3}, at: usbdev_open+0x14e/0x7a0 drivers/usb/core/devio.c:1040
4 locks held by syz.7.2528/13726:
 #0: ffff888094204870 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2bf/0x370 fs/file.c:1056
 #1: ffff88807b724460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x296/0xd70 fs/read_write.c:590
 #2: ffff8880243aa488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x500 fs/kernfs/file.c:287
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:809 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1063 [inline]
 #3: ffff888024790188 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x85/0x710 drivers/base/dd.c:1279
1 lock held by dhcpcd/13765:
 #0: ffff888204cba120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
 #0: ffff888204cba120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3222

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xe1b/0xe60 kernel/hung_task.c:369
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5238 Comm: kworker/u4:15 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: bat_events batadv_nc_worker
RIP: 0010:lock_release+0x6/0x8a0 kernel/locking/lockdep.c:5631
Code: f7 e8 5e cd 60 00 e9 76 f8 ff ff 41 be 2f 00 00 00 e9 8c f8 ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 55 48 89 e5 41 57 <41> 56 41 55 41 54 53 48 83 e4 e0 48 81 ec e0 00 00 00 48 89 74 24
RSP: 0018:ffffc90004c67bc8 EFLAGS: 00000293
RAX: ffffffff89954c1a RBX: dffffc0000000000 RCX: ffff888023ce3b80
RDX: 0000000000000000 RSI: ffffffff89954c15 RDI: ffffffff8c31ef60
RBP: ffffc90004c67bd0 R08: dffffc0000000000 R09: 1ffffffff203de18
R10: dffffc0000000000 R11: fffffbfff203de19 R12: 00000000000002e5
R13: 0000000000000000 R14: ffff88807a05cc80 R15: ffff888025f09a90
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1e0c2166c8 CR3: 000000007da33000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 rcu_read_unlock include/linux/rcupdate.h:773 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:416 [inline]
 batadv_nc_worker+0x255/0x5c0 net/batman-adv/network-coding.c:723
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>