[v6.1] INFO: task hung in device_write

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: fb28aa725e05 Linux 6.1.180
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16214bb9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=872c04466179833f
dashboard link: https://syzkaller.appspot.com/bug?extid=8fdbec204fa9e28678f4
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d420eb944682/disk-fb28aa72.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/affae450ab23/vmlinux-fb28aa72.xz
kernel image: https://storage.googleapis.com/syzbot-assets/b9e6919ed519/Image-fb28aa72.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+8fdbec...@syzkaller.appspotmail.com

INFO: task syz.7.300:5491 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.300 state:D stack:0 pid:5491 ppid:5071 flags:0x00000009
Call trace:
__switch_to+0x2f4/0x550 arch/arm64/kernel/process.c:555
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0xdb4/0x1a6c kernel/sched/core.c:6563
schedule+0xc4/0x170 kernel/sched/core.c:6639
schedule_timeout+0xc8/0x2f4 kernel/time/timer.c:2144
do_wait_for_common+0x28c/0x3ec kernel/sched/completion.c:85
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x44/0x5c kernel/sched/completion.c:138
new_lockspace fs/dlm/lockspace.c:664 [inline]
__dlm_new_lockspace+0x16d8/0x1bd8 fs/dlm/lockspace.c:719
dlm_new_user_lockspace+0x64/0x80 fs/dlm/lockspace.c:750
device_create_lockspace+0xc4/0x2fc fs/dlm/user.c:426
device_write+0x674/0xc1c fs/dlm/user.c:618
vfs_write+0x2a8/0x7c8 fs/read_write.c:582
ksys_write+0x12c/0x228 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
#0: ffff800015557db0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xc48 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffff8000155585d0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x40/0xc48 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/28:
#0: ffff800015557440 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349
1 lock held by klogd/3927:
#0: ffff00019f3c8398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:538 [inline]
#0: ffff00019f3c8398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1362 [inline]
#0: ffff00019f3c8398 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1652 [inline]
#0: ffff00019f3c8398 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x2bc/0x1a6c kernel/sched/core.c:6479
#0: ffff0000d6e34098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340
#1: ffff80001fa462f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x2e8/0xfa8 drivers/tty/n_tty.c:2198
7 locks held by kworker/1:9/4962:
#0: ffff0000c0021138 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x69c/0x13bc kernel/workqueue.c:-1
#2: ffff800016fa8ea8 (serio_mutex){+.+.}-{3:3}, at: serio_handle_event+0x34/0x7c0 drivers/input/serio/serio.c:200
#3: ffff0000cf9e12e8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline]
#3: ffff0000cf9e12e8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x88/0x3d8 drivers/base/dd.c:1009
#4: ffff0000cf9e11d8 (&serio->drv_mutex){+.+.}-{3:3}, at: serio_connect_driver drivers/input/serio/serio.c:43 [inline]
#4: ffff0000cf9e11d8 (&serio->drv_mutex){+.+.}-{3:3}, at: serio_driver_probe+0x5c/0xac drivers/input/serio/serio.c:775
#5: ffff800016fb8028 (psmouse_mutex){+.+.}-{3:3}, at: psmouse_connect+0x90/0x10dc drivers/input/mouse/psmouse-base.c:1584
#6: ffff0000f5632080 (&ps2dev->cmd_mutex){+.+.}-{3:3}, at: ps2_begin_command drivers/input/serio/libps2.c:106 [inline]
#6: ffff0000f5632080 (&ps2dev->cmd_mutex){+.+.}-{3:3}, at: ps2_command+0x78/0xe4 drivers/input/serio/libps2.c:334
1 lock held by syz.7.300/5491:
#0: ffff80001c6d3428 (&ls_lock){+.+.}-{3:3}, at: __dlm_new_lockspace+0xb0/0x1bd8 fs/dlm/lockspace.c:713
1 lock held by dlm_recoverd/5496:
1 lock held by syz.6.353/7190:
#0: ffff80001c6d3428 (&ls_lock){+.+.}-{3:3}, at: __dlm_new_lockspace+0xb0/0x1bd8 fs/dlm/lockspace.c:713
1 lock held by syz.1.379/8455:
#0: ffff800016fa8ea8 (serio_mutex){+.+.}-{3:3}, at: serio_unregister_port+0x38/0x140 drivers/input/serio/serio.c:704
4 locks held by udevd/8460:
#0: ffff0000f61502f0 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xb4/0xc24 fs/seq_file.c:182
#2: ffff0000d4116ae8 (kn->active#4){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff0000d4116ae8 (kn->active#4){.+.+}-{0:0}, at: kernfs_seq_start+0xa4/0x3b8 fs/kernfs/file.c:173
#3: ffff0000cf9e12e8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline]
#3: ffff0000cf9e12e8 (&dev->mutex){....}-{3:3}, at: uevent_show+0x168/0x328 drivers/base/core.c:2669
3 locks held by syz.7.386/8736:
#0: ffff0000cd373268 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x118/0x17c fs/file.c:1038
#1: ffff00010d6c2460 (sb_writers#13){.+.+}-{0:0}, at: vfs_write+0x254/0x7c8 fs/read_write.c:580
#2: ffff8000157e3f68 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_svc+0x74/0x948 fs/nfsd/nfssvc.c:783
1 lock held by dhcpcd/8768:
1 lock held by dhcpcd/8769:
#0: ffff0000c4092130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline]
#0: ffff0000c4092130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x48/0xaf4 net/packet/af_packet.c:3255

=============================================



---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: aa0e49877a2e Linux 6.6.148
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11f7acc6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0bc3d90c30838b5
dashboard link: https://syzkaller.appspot.com/bug?extid=73dc7e2e73d72df67cf6

compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:

disk image: https://storage.googleapis.com/syzbot-assets/f83b390cfc1f/disk-aa0e4987.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/1d4bdb338edd/vmlinux-aa0e4987.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3f57c1d51ee3/bzImage-aa0e4987.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+73dc7e...@syzkaller.appspotmail.com

INFO: task syz.2.163:6472 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.2.163 state:D stack:24808 pid:6472 ppid:5784 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
new_lockspace fs/dlm/lockspace.c:638 [inline]
__dlm_new_lockspace+0x1dec/0x2360 fs/dlm/lockspace.c:693
device_create_lockspace+0xc8/0x350 fs/dlm/user.c:430
device_write+0x875/0xed0 fs/dlm/user.c:622
vfs_write+0x299/0x9a0 fs/read_write.c:582
ksys_write+0x151/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0ee9d9e019
RSP: 002b:00007f0ee7ff6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f0eea025fa0 RCX: 00007f0ee9d9e019
RDX: 0000000000000078 RSI: 0000200000000400 RDI: 0000000000000007
RBP: 00007f0ee9e3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0eea026038 R14: 00007f0eea025fa0 R15: 00007ffc55c93ad8
</TASK>

Showing all locks held in the system:

2 locks held by kworker/1:1/27:
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:189 [inline]
#1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: __schedule+0x21d3/0x4660 kernel/sched/core.c:6696
1 lock held by khungtaskd/29:
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
3 locks held by kworker/u4:3/48:
#0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88801a25d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc90000b8fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc90000b8fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3ca0d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 net/core/net_namespace.c:606
3 locks held by kworker/1:2/2134:
3 locks held by kworker/u4:9/3425:
#0: ffff88802c735538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88802c735538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000cae7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000cae7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xce/0x1550 net/ipv6/addrconf.c:4188
1 lock held by dhcpcd/5436:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2fc/0x1d70 net/ipv4/devinet.c:1101
2 locks held by getty/5532:
#0: ffff888031b520a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
3 locks held by kworker/1:3/5764:
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:189 [inline]
#1: ffff8880b8f28a00 (psi_seq){-.-.}-{0:0}, at: __schedule+0x21d3/0x4660 kernel/sched/core.c:6696
#2: ffff88805cb3b0c8 (&ACCESS_PRIVATE(ssp->srcu_sup, lock)){....}-{2:2}, at: spin_lock_irq include/linux/spinlock.h:376 [inline]
#2: ffff88805cb3b0c8 (&ACCESS_PRIVATE(ssp->srcu_sup, lock)){....}-{2:2}, at: srcu_reschedule+0x44/0x170 kernel/rcu/srcutree.c:1766
2 locks held by kworker/1:7/5838:
#0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000494fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000494fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
1 lock held by syz.2.163/6472:
#0: ffffffff973c9a68 (&ls_lock){+.+.}-{3:3}, at: __dlm_new_lockspace+0xb1/0x2360 fs/dlm/lockspace.c:687
1 lock held by dlm_recoverd/6478:
#0: ffff88805faacaa8 (&ls->ls_in_recovery){+.+.}-{3:3}, at: dlm_recoverd+0xa5/0x1e50 fs/dlm/recoverd.c:310
4 locks held by syz-executor/7532:
#0: ffff88818b698e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:521 [inline]
#0: ffff88818b698e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 net/bluetooth/hci_core.c:2709
#1: ffff88818b6980b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 net/bluetooth/hci_sync.c:5326
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2016 [inline]
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 net/bluetooth/hci_conn.c:2571
#3: ffff88807efa4b38 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_conn_del+0x7b/0x630 net/bluetooth/l2cap_core.c:1793
3 locks held by syz-executor/7535:
#0: ffff888189b78e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:521 [inline]
#0: ffff888189b78e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 net/bluetooth/hci_core.c:2709
#1: ffff888189b780b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 net/bluetooth/hci_sync.c:5326
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2016 [inline]
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 net/bluetooth/hci_conn.c:2571
8 locks held by syz-executor/7537:
#0: ffff88807f986418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
#1: ffff8881a350fc88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 fs/kernfs/file.c:343
#2: ffff888142337ab0 (kn->active#53){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff888142337ab0 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x236/0x520 fs/kernfs/file.c:344
#3: ffffffff8dcb7788 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd7/0x370 drivers/net/netdevsim/bus.c:209
#4: ffff88805e49c130 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1094 [inline]
#4: ffff88805e49c130 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1174 [inline]
#4: ffff88805e49c130 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xa7/0x6f0 drivers/base/dd.c:1371
#5: ffff88805e49d250 (&devlink->lock_key){+.+.}-{3:3}, at: nsim_drv_remove+0x50/0x170 drivers/net/netdevsim/dev.c:1676
#6: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3f/0x180 drivers/net/netdevsim/netdev.c:417
#7: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#7: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
4 locks held by syz-executor/7539:
#0: ffff88807f986418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
#1: ffff8881a3531c88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 fs/kernfs/file.c:343
#2: ffff888142337ab0 (kn->active#53){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff888142337ab0 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x236/0x520 fs/kernfs/file.c:344
#3: ffffffff8dcb7788 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd7/0x370 drivers/net/netdevsim/bus.c:209

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf59/0xfa0 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 991 Comm: kworker/u4:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: 0x0 (events_unbound)
RIP: 0010:find_worker_executing_work kernel/workqueue.c:1016 [inline]
RIP: 0010:assign_work+0x100/0x5d0 kernel/workqueue.c:1111
Code: 84 1f 03 00 00 4c 89 6c 24 08 48 b8 eb 83 b5 80 46 86 c8 61 4d 89 e5 49 0f af c4 48 c1 e8 3a 4d 8d b4 c7 70 01 00 00 4c 89 f0 <48> c1 e8 03 49 bf 00 00 00 00 00 fc ff df 42 80 3c 38 00 74 08 4c
RSP: 0018:ffffc9000416fd58 EFLAGS: 00000802
RAX: ffff888018650330 RBX: ffffffff8657a590 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffff888022c3d027 R09: 0000000000000000
R10: ffff888022c3d010 R11: ffffed1004587a05 R12: ffff8881a32b1400
R13: ffff8881a32b1400 R14: ffff888018650330 R15: ffff888018650000
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000559039f53138 CR3: 000000000cf32000 CR4: 00000000003506f0
Call Trace:
<TASK>
worker_thread+0xa4d/0xfe0 kernel/workqueue.c:2814
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>