INFO: task syz.1.148:6394 blocked in I/O wait for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.148 state:D stack:25168 pid:6394 tgid:6393 ppid:5627 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5526 [inline]
__schedule+0x17db/0x58f0 kernel/sched/core.c:7277
__schedule_loop kernel/sched/core.c:7354 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7369
io_schedule+0x7f/0xd0 kernel/sched/core.c:8213
folio_wait_bit_common+0x836/0xbc0 mm/filemap.c:1329
folio_wait_writeback+0xb0/0x100 mm/page-writeback.c:3062
__filemap_fdatawait_range+0x184/0x2a0 mm/filemap.c:532
filemap_write_and_wait_range+0x276/0x3f0 mm/filemap.c:692
filemap_write_and_wait include/linux/pagemap.h:65 [inline]
sync_blockdev block/bdev.c:275 [inline]
bdev_release+0x1a0/0x690 block/bdev.c:1171
blkdev_release+0x15/0x20 block/fops.c:682
__fput+0x418/0xa50 fs/file_table.c:512
task_work_run+0x1d9/0x270 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f264db9e159
RSP: 002b:00007f264eace028 EFLAGS: 00000246 ORIG_RAX: 0000000000000012
RAX: 0000000000000010 RBX: 00007f264de25fa0 RCX: 00007f264db9e159
RDX: 0000000000000010 RSI: 0000200000005000 RDI: 0000000000000006
RBP: 00007f264dc3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000001000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f264de26038 R14: 00007f264de25fa0 R15: 00007ffdd5373cc8
Showing all locks held in the system:
locks held by kworker/1:0/25: 3, last CPU#1:
#0: ffff888022aa1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff888022aa1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff888022aa1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff888022aa1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc900001f7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffff888029e231d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff888029e231d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912
locks held by kworker/1:0H/26: 4, last CPU#1:
#0: ffff88801b06ad40 ((wq_completion)events_highpri){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88801b06ad40 ((wq_completion)events_highpri){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88801b06ad40 ((wq_completion)events_highpri){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88801b06ad40 ((wq_completion)events_highpri){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc90000a0fc40 ((work_completion)(&vmidi->output_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90000a0fc40 ((work_completion)(&vmidi->output_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90000a0fc40 ((work_completion)(&vmidi->output_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc90000a0fc40 ((work_completion)(&vmidi->output_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffff8880b873bb20 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:677
#3: ffff8880b8724408 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:933
locks held by kworker/1:1/30: 6, last CPU#1:
#0: ffff888022aa1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff888022aa1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff888022aa1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff888022aa1140 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc90000a57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90000a57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90000a57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc90000a57c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffff888029cef1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#2: ffff888029cef1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5912
#3: ffff888031f201d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff888031f201d8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1073
#4: ffff88801c2cc980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x41/0x6f0 fs/kernfs/dir.c:825
#5: ffffffff8ec110a0 (sched_map-wait-type-override){+.+.}-{3:3}, at: sched_submit_work kernel/sched/core.c:7312 [inline]
#5: ffffffff8ec110a0 (sched_map-wait-type-override){+.+.}-{3:3}, at: schedule+0x90/0x2b0 kernel/sched/core.c:7368
locks held by khungtaskd/32: 1, last CPU#0:
#0: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871
locks held by udevd/4984: 3, on CPU#0:
#0: ffff888054a737b0 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x246/0x320 fs/file.c:1259
#1: ffff888069ca5900 (&type->i_mutex_dir_key#4){++++}-{4:4}, at: iterate_dir+0x209/0x4d0 fs/readdir.c:103
#2: ffff88801c2cc980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_fop_readdir+0x26d/0x960 fs/kernfs/dir.c:1982
locks held by getty/5371: 2, on CPU#0:
#0: ffff88803641d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
locks held by syz-executor/6632: 2, last CPU#0:
#0: ffff88802618e0e8 (&type->s_umount_key#57){+.+.}-{4:4}, at: __super_lock fs/super.c:60 [inline]
#0: ffff88802618e0e8 (&type->s_umount_key#57){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:75 [inline]
#0: ffff88802618e0e8 (&type->s_umount_key#57){+.+.}-{4:4}, at: deactivate_super+0xac/0xe0 fs/super.c:617
#1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
#1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
locks held by kworker/u8:23/7975: 4, last CPU#0:
#0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88801b0a4140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc9000d98fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc9000d98fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc9000d98fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc9000d98fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffff8880509d07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6906 [inline]
#2: ffff8880509d07a0 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:526
#3: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: ieee80211_update_sta_info net/mac80211/ibss.c:949 [inline]
#3: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: ieee80211_rx_bss_info net/mac80211/ibss.c:1063 [inline]
#3: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1546 [inline]
#3: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: ieee80211_ibss_rx_queued_mgmt+0xf15/0x2c40 net/mac80211/ibss.c:1573
locks held by syz.3.678/8199: 2, on CPU#0:
#0: ffffffff901b14a0 (register_mutex#4){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#0: ffffffff901b14a0 (register_mutex#4){+.+.}-{4:4}, at: odev_release+0x4b/0x70 sound/core/seq/oss/seq_oss.c:140
#1: ffffffff8ed62ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
#1: ffffffff8ed62ca8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:966
locks held by syz.5.680/8209: 1, on CPU#0:
#0: ffff888078ba83b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
#0: ffff888078ba83b8 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1dd/0x4e0 mm/util.c:579
locks held by syz.5.680/8210: 2, last CPU#1:
#0: ffff888078ba83b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline]
#0: ffff888078ba83b8 (&mm->mmap_lock){++++}-{4:4}, at: __mm_populate+0x182/0x390 mm/gup.c:1942
#1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: filemap_get_entry+0xcd/0x3f0 mm/filemap.c:1904
locks held by syz.0.682/8219: 2, last CPU#0:
#0: ffffffff90253240 (rtnl_mutex){+.+.}-{4:4}, at: bpf_xdp_link_attach+0x120/0x990 net/core/dev.c:10740
#1: ffffffff90256b80 (bpf_dispatcher_xdp.mutex){+.+.}-{4:4}, at: bpf_dispatcher_change_prog+0xc2/0xf20 kernel/bpf/dispatcher.c:146
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 8200 Comm: syz.3.678 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:__lock_is_held kernel/locking/lockdep.c:5651 [inline]
RIP: 0010:lock_is_held_type+0x61/0x150 kernel/locking/lockdep.c:6016
Code: 41 83 bd a4 0b 00 00 00 0f 85 bf 00 00 00 89 f5 49 89 fe 9c 41 5c fa 48 c7 c7 4c e3 42 8e e8 e6 1b 00 00 65 ff 05 67 dd af 07 <41> 83 bd a0 0b 00 00 00 7e 48 4c 89 eb 48 81 c3 b0 0b 00 00 45 31
RSP: 0018:ffffc9000dd2f5c8 EFLAGS: 00000002
RAX: 0000000000000001 RBX: 00000000ffffffff RCX: 8000000000000002
RDX: 0000000000000000 RSI: ffffffff8e42e34c RDI: ffffffff8c6da080
RBP: 00000000ffffffff R08: ffffffff907a3e7f R09: 1ffffffff20f47cf
R10: dffffc0000000000 R11: fffffbfff20f47d0 R12: 0000000000000046
R13: ffff88807c2dbe80 R14: ffffffff8ed5c9a0 R15: 1ffffffff1cdccfb
FS: 00007f0bdb91f6c0(0000) GS:ffff888124dd1000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000020000000a000 CR3: 0000000053a24000 CR4: 0000000000350ef0
Call Trace:
lock_is_held include/linux/lockdep.h:249 [inline]
rcu_read_lock_sched_held+0x33/0x70 kernel/rcu/update.c:126
task_css include/linux/cgroup.h:548 [inline]
task_ca kernel/sched/cpuacct.c:41 [inline]
cpuacct_charge+0x11b/0x320 kernel/sched/cpuacct.c:343
cgroup_account_cputime include/linux/cgroup.h:873 [inline]
update_se+0x2ea/0xff0 kernel/sched/fair.c:1429
update_curr_rt kernel/sched/rt.c:982 [inline]
dequeue_task_rt+0x79/0xa50 kernel/sched/rt.c:1459
block_task kernel/sched/core.c:2278 [inline]
try_to_block_task kernel/sched/core.c:6768 [inline]
__schedule+0x6ef/0x58f0 kernel/sched/core.c:7185
__schedule_loop kernel/sched/core.c:7354 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7369
schedule_timeout+0x152/0x2c0 kernel/time/sleep_timeout.c:99
snd_rawmidi_write+0x3b4/0xbc0 sound/core/rawmidi.c:1619
do_loop_readv_writev fs/read_write.c:851 [inline]
vfs_writev+0x4bb/0x990 fs/read_write.c:1060
do_writev+0x154/0x2e0 fs/read_write.c:1104
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0bda99e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0bdb91f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007f0bdac25fa0 RCX: 00007f0bda99e159
RDX: 0000000000000002 RSI: 0000200000000840 RDI: 000000000000000a
RBP: 00007f0bdaa3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0bdac26038 R14: 00007f0bdac25fa0 R15: 00007ffda3d40c18