INFO: task getty:3950 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:getty           state:D stack:22256 pid: 3950 ppid:     1 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
 __flush_work+0x15a/0x210 kernel/workqueue.c:3094
 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3181
 hci_unregister_dev+0x163/0x590 net/bluetooth/hci_core.c:4061
 hci_uart_tty_close+0x268/0x330 drivers/bluetooth/hci_ldisc.c:575
 tty_ldisc_reinit+0xe4/0x460 drivers/tty/tty_ldisc.c:679
 tty_ldisc_hangup+0x360/0x4a0 drivers/tty/tty_ldisc.c:745
 __tty_hangup+0x44e/0x670 drivers/tty/tty_io.c:639
 disassociate_ctty+0x38d/0x860 drivers/tty/tty_jobctrl.c:275
 do_exit+0x5f9/0x2110 kernel/exit.c:888
 do_group_exit+0x12c/0x2f0 kernel/exit.c:1004
 __do_sys_exit_group kernel/exit.c:1015 [inline]
 __se_sys_exit_group kernel/exit.c:1013 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1013
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f3e9b0726c5
RSP: 002b:00007ffe466ab7c8 EFLAGS: 00000202
 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f3e9b173fe8 RCX: 00007f3e9b0726c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001
RBP: 0000000000000001 R08: 00007ffe466ab758 R09: 0000000000000000
R10: 00007ffe466ab5f0 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f3e9b172680 R15: 00007f3e9b174000
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
3 locks held by kworker/u4:1/144:
 #0: ffff8880179cd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: 
ffffc9000168fd00
 (
net_cleanup_work
){+.+.}-{0:0}
, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: 
ffffffff8d123930
 (
rcu_state.barrier_mutex
){+.+.}-{3:3}
, at: rcu_barrier+0xa1/0x4c0 kernel/rcu/tree.c:4043
1 lock held by dhcpcd/3851:
2 locks held by getty/3950:
 #0: 
ffff88802d29c1c0
 (
&tty->legacy_mutex
){+.+.}-{3:3}
, at: __tty_hangup+0xc0/0x670 drivers/tty/tty_io.c:599
 #1: 
ffff88802d29c098
 (
&tty->ldisc_sem
){++++}-{0:0}
, at: __tty_ldisc_lock drivers/tty/tty_ldisc.c:300 [inline]
, at: tty_ldisc_lock+0x68/0xb0 drivers/tty/tty_ldisc.c:324
3 locks held by kworker/u5:3/4194:
 #0: 
ffff88807c0eb938
 (
(wq_completion)hci4
){+.+.}-{0:0}
, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: 
ffffc90002effd00
 (
(work_completion)(&hdev->power_on)
){+.+.}-{0:0}
, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: 
ffff8880658213f0
 (
&hdev->req_lock
){+.+.}-{3:3}
, at: hci_dev_do_open+0xa4/0x12a0 net/bluetooth/hci_core.c:1464
2 locks held by kworker/1:15/4774:
3 locks held by kworker/0:20/6055:
 #0: ffff888017870938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: 
ffffc9000332fd00
 (
free_ipc_work
){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #2: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
3 locks held by syz-executor/17015:
 #0: ffff88807910d3f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 net/bluetooth/hci_core.c:1755
 #1: ffff88807910c478 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x408/0x1020 net/bluetooth/hci_core.c:1800
 #2: ffffffff8e3946c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline]
 #2: ffffffff8e3946c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622
1 lock held by syz-executor/18000:
 #0: ffff8880249740e0 (&type->s_umount_key#64){+.+.}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:365
3 locks held by syz-executor/18005:
 #0: ffff88802c6ad3f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 net/bluetooth/hci_core.c:1755
 #1: ffff88802c6ac478 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x408/0x1020 net/bluetooth/hci_core.c:1800
 #2: ffffffff8e3946c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline]
 #2: ffffffff8e3946c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622
2 locks held by kworker/0:4/18255:
 #0: ffff888017872138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc90002eefd00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
3 locks held by syz-executor/18271:
 #0: ffff8880788413f0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0x5f/0x1020 net/bluetooth/hci_core.c:1755
 #1: ffff888078840478 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x408/0x1020 net/bluetooth/hci_core.c:1800
 #2: ffffffff8e3946c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1519 [inline]
 #2: ffffffff8e3946c8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622
1 lock held by syz.5.3491/18555:
 #0: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #0: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xe1b/0xe60 kernel/hung_task.c:369
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 3851 Comm: dhcpcd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:kasan_check_range+0x1af/0x290 mm/kasan/generic.c:-1
Code: 29 f3 4d 01 f3 49 89 df 49 8d 5f 07 4d 85 ff 49 0f 49 df 48 83 e3 f8 49 29 df 74 0e 41 80 3b 00 75 69 49 ff c3 49 ff cf 75 f2 <5b> 41 5c 41 5e 41 5f 5d c3 45 84 ff 0f 85 91 00 00 00 41 f7 c7 00
RSP: 0018:ffffc900035bf990 EFLAGS: 00000056
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff815d067f
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff910150f0
RBP: ffffc900035bfc08 R08: ffffffff910150f7 R09: 1ffffffff2202a1e
R10: dffffc0000000000 R11: fffffbfff2202a1f R12: dffffc0000000001
R13: ffff888027f7bb80 R14: 1ffffffff2202a1e R15: 0000000000000001
FS:  00007fa7aeca1740(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9460454e80 CR3: 000000001f923000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
 hlock_class kernel/locking/lockdep.c:197 [inline]
 __lock_acquire+0x12df/0x7d40 kernel/locking/lockdep.c:5117
 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737
 __might_fault+0xb3/0x110 mm/memory.c:5357
 clear_rseq_cs kernel/rseq.c:242 [inline]
 rseq_ip_fixup kernel/rseq.c:276 [inline]
 __rseq_handle_notify_resume+0x546/0xf40 kernel/rseq.c:314
 rseq_handle_notify_resume include/linux/sched.h:2218 [inline]
 tracehook_notify_resume include/linux/tracehook.h:201 [inline]
 exit_to_user_mode_loop+0xe5/0x130 kernel/entry/common.c:184
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217
 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fa7aed2b407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd5c035cc0 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: 000000000000003c RBX: 00007fa7aeca1740 RCX: 00007fa7aed2b407
RDX: 000000000000003c RSI: 00007ffd5c035d20 RDI: 0000000000000005
RBP: 000055b45ddfe168 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffd5c036150
R13: 000055b47eb9d890 R14: 000055b47ecdc7d0 R15: 000055b47e9f76c0
 </TASK>
wireguard: wg0: Sending keepalive packet to peer 110 ([::1]:20003/0%0)
virtqueue callback for ffff88801f91c600 (ffffffff84450960)
virtqueue interrupt with no work for ffff88801f91c500
virtqueue interrupt with no work for ffff88801f91c400
virtqueue callback for ffff888023cc9200 (ffffffff854980c0)
Sent skb ffff88807dfee140
No more buffers in queue
wireguard: wg0: Sending keepalive packet to peer 170 ([::1]:20002/0%0)
wireguard: wg0: Sending keepalive packet to peer 176 ([::1]:20002/0%0)
wireguard: wg0: Sending keepalive packet to peer 158 ([::1]:20002/0%0)
virtqueue callback for ffff888023cc9200 (ffffffff854980c0)
Sent skb ffff8880767e2a00
No more buffers in queue