INFO: task udevd:11442 blocked for more than 143 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:23544 pid:11442 tgid:11442 ppid:5188 task_flags:0x400140 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 io_schedule+0x7f/0xd0 kernel/sched/core.c:7791 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:250 __wait_on_bit_lock+0xec/0x4e0 kernel/sched/wait_bit.c:93 out_of_line_wait_on_bit_lock+0x13b/0x190 kernel/sched/wait_bit.c:120 wait_on_bit_lock_io include/linux/wait_bit.h:221 [inline] __lock_buffer fs/buffer.c:71 [inline] lock_buffer include/linux/buffer_head.h:432 [inline] block_read_full_folio+0x38f/0x830 fs/buffer.c:2439 filemap_read_folio+0x137/0x3b0 mm/filemap.c:2496 filemap_update_page mm/filemap.c:2583 [inline] filemap_get_pages+0x1750/0x1ec0 mm/filemap.c:2713 filemap_read+0x447/0x1230 mm/filemap.c:2800 blkdev_read_iter+0x30a/0x440 block/fops.c:856 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x582/0xa70 fs/read_write.c:572 ksys_read+0x150/0x270 fs/read_write.c:715 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7faa1b0a7407 RSP: 002b:00007ffc2df588b0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007faa1b74e880 RCX: 00007faa1b0a7407 RDX: 0000000000000200 RSI: 00007faa1afb8000 RDI: 0000000000000009 RBP: 00005631e43933f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000018 R13: 0000000000001000 R14: 00005631e437f6f8 R15: 00007faa1b81339c INFO: task syz.5.2046:16843 blocked for more than 144 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.2046 state:D stack:24168 pid:16843 tgid:16839 ppid:11919 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 io_schedule+0x7f/0xd0 kernel/sched/core.c:7791 folio_wait_bit_common+0x6d8/0xbc0 mm/filemap.c:1323 folio_put_wait_locked mm/filemap.c:1487 [inline] do_read_cache_folio+0x1ad/0x590 mm/filemap.c:4078 read_mapping_folio include/linux/pagemap.h:1028 [inline] read_part_sector+0xb6/0x2b0 block/partitions/core.c:722 amiga_partition+0xe0/0x1dd0 block/partitions/amiga.c:53 check_partition block/partitions/core.c:141 [inline] blk_add_partitions block/partitions/core.c:589 [inline] bdev_disk_changed+0x765/0x14c0 block/partitions/core.c:693 loop_reread_partitions drivers/block/loop.c:448 [inline] loop_set_status+0x9ab/0xe40 drivers/block/loop.c:1277 loop_set_status64 drivers/block/loop.c:1373 [inline] lo_ioctl+0xc21/0x1fb0 drivers/block/loop.c:1559 blkdev_ioctl+0x5e3/0x740 block/ioctl.c:792 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5877b9aeb9 RSP: 002b:00007f5875dee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f5877e15fa0 RCX: 00007f5877b9aeb9 RDX: 00002000000003c0 RSI: 0000000000004c04 RDI: 0000000000000005 RBP: 00007f5877c08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5877e16038 R14: 00007f5877e15fa0 R15: 00007fff2ff1a008 INFO: task syz.5.2046:16854 blocked for more than 146 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.2046 state:D stack:22744 pid:16854 tgid:16839 ppid:11919 task_flags:0x440140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 io_schedule+0x7f/0xd0 kernel/sched/core.c:7791 folio_wait_bit_common+0x6d8/0xbc0 mm/filemap.c:1323 folio_lock include/linux/pagemap.h:1170 [inline] __find_get_block_slow fs/buffer.c:205 [inline] find_get_block_common+0x23c/0xe60 fs/buffer.c:1408 bdev_getblk+0x53/0x6e0 include/linux/gfp.h:-1 __getblk include/linux/buffer_head.h:380 [inline] sb_getblk include/linux/buffer_head.h:386 [inline] __ext4_get_inode_loc+0x7d8/0xfa0 fs/ext4/inode.c:4860 ext4_get_inode_loc fs/ext4/inode.c:4963 [inline] ext4_reserve_inode_write+0x18b/0x360 fs/ext4/inode.c:6287 __ext4_mark_inode_dirty+0x14b/0x6e0 fs/ext4/inode.c:6465 ext4_ext_insert_extent+0x2062/0x4b50 fs/ext4/extents.c:2192 ext4_ext_map_blocks+0x19d1/0x6b80 fs/ext4/extents.c:4404 ext4_map_create_blocks fs/ext4/inode.c:613 [inline] ext4_map_blocks+0x8da/0x1830 fs/ext4/inode.c:816 ext4_getblk+0x1ca/0x780 fs/ext4/inode.c:984 ext4_bread+0x2a/0x180 fs/ext4/inode.c:1047 ext4_quota_write+0x239/0x580 fs/ext4/super.c:7350 write_blk fs/quota/quota_tree.c:70 [inline] get_free_dqblk+0x368/0x720 fs/quota/quota_tree.c:136 do_insert_tree+0x256/0x11d0 fs/quota/quota_tree.c:347 do_insert_tree+0x9d7/0x11d0 fs/quota/quota_tree.c:402 do_insert_tree+0x9b2/0x11d0 fs/quota/quota_tree.c:402 dq_insert_tree fs/quota/quota_tree.c:432 [inline] qtree_write_dquot+0x4b1/0x5e0 fs/quota/quota_tree.c:451 v2_write_dquot+0x183/0x260 fs/quota/quota_v2.c:372 dquot_acquire+0x328/0x620 fs/quota/dquot.c:473 ext4_acquire_dquot+0x2e9/0x4c0 fs/ext4/super.c:6982 dqget+0x7b1/0xf10 fs/quota/dquot.c:980 __dquot_initialize+0x3ba/0xd30 fs/quota/dquot.c:1508 ext4_xattr_set+0xdb/0x340 fs/ext4/xattr.c:2543 __vfs_setxattr+0x43c/0x480 fs/xattr.c:200 __vfs_setxattr_noperm+0x12d/0x660 fs/xattr.c:234 vfs_setxattr+0x16a/0x2e0 fs/xattr.c:321 do_setxattr fs/xattr.c:636 [inline] filename_setxattr+0x281/0x630 fs/xattr.c:665 path_setxattrat+0x3f3/0x430 fs/xattr.c:713 __do_sys_lsetxattr fs/xattr.c:754 [inline] __se_sys_lsetxattr fs/xattr.c:750 [inline] __x64_sys_lsetxattr+0xbf/0xe0 fs/xattr.c:750 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5877b9aeb9 RSP: 002b:00007f5875dcd028 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd RAX: ffffffffffffffda RBX: 00007f5877e16090 RCX: 00007f5877b9aeb9 RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000200000000180 RBP: 00007f5877c08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5877e16128 R14: 00007f5877e16090 R15: 00007fff2ff1a008 Showing all locks held in the system: 1 lock held by pool_workqueue_/3: 1 lock held by khungtaskd/32: #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 6 locks held by kworker/u8:3/50: #0: ffff88801b2df148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88801b2df148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90000bb7bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90000bb7bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f99d850 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xfe/0x7b0 net/core/net_namespace.c:670 #3: ffff88804067a0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #3: ffff88804067a0e8 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:108 [inline] #3: ffff88804067a0e8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x117/0x3f0 net/devlink/core.c:506 #4: ffff888040679250 (&devlink->lock_key#50){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:276 [inline] #4: ffff888040679250 (&devlink->lock_key#50){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:109 [inline] #4: ffff888040679250 (&devlink->lock_key#50){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x3f0 net/devlink/core.c:506 #5: ffffffff8e560b40 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3816 2 locks held by kworker/u8:5/990: #0: ffff8880b863a918 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xa9/0x140 kernel/sched/core.c:647 #1: ffff8880b8724588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933 1 lock held by dhcpcd/5483: #0: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 2 locks held by getty/5576: #0: ffff88802fe8a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900036c32f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211 3 locks held by kworker/u9:0/8459: #0: ffff88802037b148 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88802037b148 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000e547bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000e547bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88805526cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 2 locks held by udevd/11442: #0: ffff888148c45828 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1042 [inline] #0: ffff888148c45828 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 block/fops.c:855 #1: ffff888148c459c8 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1092 [inline] #1: ffff888148c459c8 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_update_page mm/filemap.c:2549 [inline] #1: ffff888148c459c8 (mapping.invalidate_lock){++++}-{4:4}, at: filemap_get_pages+0x994/0x1ec0 mm/filemap.c:2713 1 lock held by syz.5.2046/16843: #0: ffff888141b22358 (&disk->open_mutex){+.+.}-{4:4}, at: loop_reread_partitions drivers/block/loop.c:447 [inline] #0: ffff888141b22358 (&disk->open_mutex){+.+.}-{4:4}, at: loop_set_status+0x986/0xe40 drivers/block/loop.c:1277 5 locks held by syz.5.2046/16854: #0: ffff88803c7c2420 (sb_writers#4){++++}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:499 #1: ffff888011bf2a60 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: inode_lock include/linux/fs.h:1027 [inline] #1: ffff888011bf2a60 (&type->i_mutex_dir_key#3){++++}-{4:4}, at: vfs_setxattr+0x143/0x2e0 fs/xattr.c:320 #2: ffff888057598ea8 (&dquot->dq_lock){+.+.}-{4:4}, at: dquot_acquire+0x67/0x620 fs/quota/dquot.c:461 #3: ffff88803c7c2208 (&s->s_dquot.dqio_sem){++++}-{4:4}, at: v2_write_dquot+0xab/0x260 fs/quota/quota_v2.c:367 #4: ffff888011bf45d0 (&ei->i_data_sem/2){++++}-{4:4}, at: ext4_map_blocks+0x7d7/0x1830 fs/ext4/inode.c:815 3 locks held by syz-executor/18254: #0: ffff88807d4e4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:499 [inline] #0: ffff88807d4e4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2715 #1: ffff88807d4e40c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5315 #2: ffffffff8fb38928 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2143 [inline] #2: ffffffff8fb38928 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2637 1 lock held by syz-executor/18797: #0: ffff888141b22358 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 block/bdev.c:962 4 locks held by syz.2.2671/19585: #0: ffff888066bf4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:499 [inline] #0: ffff888066bf4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2715 #1: ffff888066bf40c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5315 #2: ffffffff8fb38928 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2143 [inline] #2: ffffffff8fb38928 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2637 #3: ffff888063a8d338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5b0 net/bluetooth/l2cap_core.c:1763 2 locks held by syz-executor/19579: #0: ffffffff8f99d850 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577 #1: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146 2 locks held by syz.3.2675/19599: #0: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436 #1: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline] #1: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:956 2 locks held by syz.1.2676/19606: #0: ffff88807d748ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:499 [inline] #0: ffff88807d748ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2715 #1: ffff88807d7480c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5315 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xf90/0xfe0 kernel/hung_task.c:515 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82 Code: a8 60 02 e9 fe 35 79 f5 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 53 59 12 00 fb f4 d7 35 79 f5 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffffff8e207dc0 EFLAGS: 00000246 RAX: 00000000014eb4f9 RBX: ffffffff8199570d RCX: 0000000080000001 RDX: 0000000000000001 RSI: ffffffff8dcc97b7 RDI: ffffffff8c073a00 RBP: ffffffff8e207eb0 R08: ffff8880b86336db R09: 1ffff110170c66db R10: dffffc0000000000 R11: ffffed10170c66dc R12: ffffffff8fef1b70 R13: 1ffffffff1c52a78 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881256f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe6ad53268 CR3: 000000000e346000 CR4: 0000000000350ef0 Call Trace: arch_safe_halt arch/x86/kernel/process.c:766 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:767 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x1bd/0x500 kernel/sched/idle.c:332 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:430 rest_init+0x2de/0x300 init/main.c:757 start_kernel+0x380/0x3d0 init/main.c:1206 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x143/0x1c0 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x147