INFO: task udevd:2857 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd           state:D
 stack:23544 pid:2857  tgid:2857  ppid:1      task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x1325/0x47d0 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7326
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
 rwsem_down_read_slowpath+0x5af/0xb40 kernel/locking/rwsem.c:1114
 __down_read_common kernel/locking/rwsem.c:1291 [inline]
 __down_read kernel/locking/rwsem.c:1304 [inline]
 down_read+0xed/0x4c0 kernel/locking/rwsem.c:1576
 kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1217
 d_revalidate fs/namei.c:1035 [inline]
 d_revalidate fs/namei.c:1031 [inline]
 lookup_fast+0x3c7/0x600 fs/namei.c:1881
 walk_component fs/namei.c:2278 [inline]
 link_path_walk+0x7d4/0x1cc0 fs/namei.c:2656
 path_lookupat+0x74/0xc40 fs/namei.c:2812
 filename_lookup+0x202/0x590 fs/namei.c:2842
 vfs_statx+0xff/0x3f0 fs/stat.c:353
 vfs_fstatat+0x77/0xe0 fs/stat.c:373
 __do_sys_newfstatat+0x9d/0x120 fs/stat.c:538
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9210448b0a
RSP: 002b:00007ffd037a0438 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 00007ffd037a08d0 RCX: 00007f9210448b0a
RDX: 00007ffd037a0440 RSI: 00007ffd037a08d0 RDI: 00000000ffffff9c
RBP: 000055b5664ad2c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd037a04d0
R13: 000055b53607d100 R14: 000055b566700bc0 R15: 00007ffd037a1dd0
 </TASK>

Showing all locks held in the system:
4 locks held by kworker/1:0/23:
 #0: 
ffff88810006b140
 (
(wq_completion)events
){+.+.}-{0:0}
, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: 
ffffc9000018fd18
 (
kernfs_notify_work
){+.+.}-{0:0}
, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
 #2: 
ffff888100affaa0
 (
&root->kernfs_supers_rwsem
){++++}-{4:4}, at: kernfs_notify_workfn+0xf7/0x5f0 fs/kernfs/file.c:925
 #3: 
ffff888100aff980
 (
&root->kernfs_rwsem
){++++}-{4:4}
, at: kernfs_notify_workfn+0xff/0x5f0 fs/kernfs/file.c:926
4 locks held by kworker/1:1/28:
1 lock held by khungtaskd/30:
 #0: 
ffffffff896e2b40
 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
2 locks held by kworker/u8:1/32:
 #0: 
ffff8881000ac140
 (
(wq_completion)events_unbound
){+.+.}-{0:0}
, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: 
ffffc90000227d18
 (
(reaper_work).work
){+.+.}-{0:0}
, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
2 locks held by kworker/u8:2/37:
 #0: 
ffff8881000ac140
 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: 
ffffc90000277d18
 (
(work_completion)(&sub_info->work)
){+.+.}-{0:0}
, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
2 locks held by kworker/u8:3/45:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: 
ffffc90000507d18
 (
connector_reaper_work
){+.+.}-{0:0}
, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
3 locks held by kworker/1:2/2741:
 #0: 
ffff88810006b140
 (
(wq_completion)events
){+.+.}-{0:0}
, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: ffffc90005b0fd18 ((work_completion)(&gadget->work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
 #2: 
ffff888100aff980
 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_find_and_get_ns+0x2f/0x70 fs/kernfs/dir.c:968
1 lock held by udevd/2857:
 #0: 
ffff888100aff980
 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1217
2 locks held by getty/2919:
 #0: 
ffff888114c720a0
 (
&tty->ldisc_sem
){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900000452e8 (
&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
4 locks held by udevd/5222:
 #0: 
ffff888116b2c098 (&p->lock
){+.+.}-{4:4}
, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:183
 #1: 
ffff8881196f4880 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:165
 #2: 
ffff8881138c75a8 (kn->active#27){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
ffff8881138c75a8 (kn->active#27){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:166
 #3: 
ffff8881166501d8
 (
&dev->mutex
){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1107 [inline]
){....}-{4:4}, at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142
7 locks held by kworker/0:3/5227:
3 locks held by kworker/1:3/5230:
 #0: ffff888105eab540 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: ffffc9000210fd18 (
(work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
 #2: 
ffff8881f5728d28
 (
lock#5
){..-.}-{3:3}
, at: local_lock_acquire include/linux/local_lock_internal.h:46 [inline]
, at: kcov_remote_stop+0x77/0x540 kernel/kcov.c:1040
5 locks held by kworker/0:5/5243:
2 locks held by kworker/1:6/5334:
 #0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: 
ffffc900020dfd18
 (
free_ipc_work
){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
2 locks held by syz.0.447/6218:
 #0: ffff888100affaa0 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x49/0x120 fs/kernfs/dir.c:1791
 #1: 
ffff888100aff980 (
&root->kernfs_rwsem
){++++}-{4:4}
, at: kernfs_remove_by_name_ns+0x51/0x120 fs/kernfs/dir.c:1792
1 lock held by syz.3.448/6221:
 #0: 
ffff888100aff980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_add_one+0x38/0xaa0 fs/kernfs/dir.c:825
1 lock held by syz-executor/6229:
 #0: ffff888100aff980 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1217
1 lock held by syz-executor/6230:
 #0: 
ffff888100aff980
 (
&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1217
1 lock held by syz-executor/6231:
 #0: 
ffff888100aff980
 (
&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_dop_revalidate+0xa5/0x7e0 fs/kernfs/dir.c:1217
5 locks held by syz-executor/6232:
4 locks held by kworker/u8:0/6234:
 #0: 
ffff888100e98940
 (
(wq_completion)netns
){+.+.}-{0:0}
, at: process_one_work+0x12b1/0x1940 kernel/workqueue.c:3297
 #1: ffffc900005dfd18 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 kernel/workqueue.c:3298
 #2: ffffffff8ab0c1c8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:673
 #3: ffffffff896ee5e8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:122
 nmi_trigger_cpumask_backtrace+0x21c/0x2a0 lib/nmi_backtrace.c:65
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x69a/0xc80 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
yealink 3-1:36.0: unexpected response 0
yealink 3-1:36.0: urb_ctl_callback - urb status -71
yealink 3-1:36.0: urb_irq_callback - urb status -71
yealink 3-1:36.0: unexpected response 0
yealink 3-1:36.0: urb_ctl_callback - urb status -71
yealink 3-1:36.0: urb_irq_callback - urb status -71
yealink 3-1:36.0: unexpected response 0
yealink 3-1:36.0: urb_ctl_callback - urb status -71
yealink 3-1:36.0: urb_irq_callback - urb status -71
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6232 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(lazy) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:io_serial_in+0x87/0xb0 drivers/tty/serial/8250/8250_port.c:402
Code: 82 88 fe 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1a 66 03 5d 40 89 da ec <5b> 0f b6 c0 5d 41 5c e9 cd 85 53 04 e8 38 e8 f0 fe eb a2 e8 c1 e8
RSP: 0018:ffffc90000007450 EFLAGS: 00000002
RAX: dffffc0000000000 RBX: 00000000000003fd RCX: 0000000000000000
RDX: 00000000000003fd RSI: ffffffff832b8160 RDI: ffffffff94249da0
RBP: ffffffff94249d60 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000020 R14: fffffbfff2849406 R15: dffffc0000000000
FS:  0000555561185500(0000) GS:ffff888268636000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2ec05ff8 CR3: 0000000126106000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 serial_in drivers/tty/serial/8250/8250.h:128 [inline]
 serial_lsr_in drivers/tty/serial/8250/8250.h:150 [inline]
 wait_for_lsr+0x13a/0x210 drivers/tty/serial/8250/8250_port.c:1982
 serial8250_fifo_wait_for_lsr_thre drivers/tty/serial/8250/8250_port.c:3235 [inline]
 serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3300 [inline]
 serial8250_console_write+0xdfd/0x1a50 drivers/tty/serial/8250/8250_port.c:3385
 console_emit_next_record kernel/printk/printk.c:3183 [inline]
 console_flush_one_record+0x790/0xe50 kernel/printk/printk.c:3269
 console_flush_all kernel/printk/printk.c:3343 [inline]
 __console_flush_and_unlock kernel/printk/printk.c:3373 [inline]
 console_unlock+0x103/0x260 kernel/printk/printk.c:3413
 vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2479
 dev_vprintk_emit+0x391/0x3e0 drivers/base/core.c:4996
 dev_printk_emit+0xd2/0x10d drivers/base/core.c:5007
 __dev_printk+0xcb/0x100 drivers/base/core.c:5019
 _dev_err+0xef/0x127 drivers/base/core.c:5062
 urb_irq_callback.cold+0x41/0xfd drivers/input/misc/yealink.c:409
 __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
 usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
 dummy_timer+0xdb2/0x36f0 drivers/usb/gadget/udc/dummy_hcd.c:2019
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x462/0x9c0 kernel/time/hrtimer.c:2096
 hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2113
 handle_softirqs+0x1dd/0x990 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x160/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0x8f/0xb0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:clear_pages arch/x86/include/asm/page_64.h:103 [inline]
RIP: 0010:clear_highpages_kasan_tagged+0x63/0x90 mm/page_alloc.c:1221
Code: 00 00 00 fc ff df 48 c1 fb 06 48 c1 e8 03 48 c1 e3 0c 80 3c 10 00 75 2e 48 8b 3d 88 1b 16 07 89 e9 31 c0 48 c1 e1 0c 48 01 df <f3> aa 0f 1f 44 00 00 5b 5d e9 af 22 0b 00 48 c7 c7 50 32 27 89 e8
RSP: 0018:ffffc9000193f778 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 000000012c000000 RCX: 0000000000030000
RDX: dffffc0000000000 RSI: 0000000000000400 RDI: ffff88812c3d0000
RBP: 0000000000000400 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed1025800000 R11: 0000000000000000 R12: 0000000000000400
R13: ffffea0004b00000 R14: 00000000000029c2 R15: 0000000000000001
 post_alloc_hook+0xba/0x120 mm/page_alloc.c:1857
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0xf25/0x3400 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x28f/0x2b90 mm/page_alloc.c:5304
 alloc_pages_mpol+0xe8/0x410 mm/mempolicy.c:2490
 alloc_pages_noprof+0x1a/0x160 mm/mempolicy.c:2581
 vm_area_alloc_pages mm/vmalloc.c:3667 [inline]
 __vmalloc_area_node mm/vmalloc.c:3892 [inline]
 __vmalloc_node_range_noprof+0xf9a/0x1630 mm/vmalloc.c:4082
 vmalloc_user_noprof+0x9e/0xe0 mm/vmalloc.c:4237
 kcov_ioctl+0x4d/0x750 kernel/kcov.c:736
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x7f0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd8c715db2b
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007fff36ddd2c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000080000 RCX: 00007fd8c715db2b
RDX: 0000000000080000 RSI: ffffffff80086301 RDI: 00000000000000d9
RBP: 00007fd8c73e6128 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000003 R14: 00007fff36ddd578 R15: 0000000000000000
 </TASK>