INFO: task syz.2.1559:10533 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.1559      state:D stack:27912 pid:10533 ppid:5782   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 nfsd_svc+0x65/0xab0 fs/nfsd/nfssvc.c:788
 write_threads+0x393/0x510 fs/nfsd/nfsctl.c:417
 nfsctl_transaction_write+0x10c/0x150 fs/nfsd/nfsctl.c:113
 vfs_write+0x299/0x9a0 fs/read_write.c:582
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f450fd9e159
RSP: 002b:00007f4510b9b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4510026090 RCX: 00007f450fd9e159
RDX: 0000000000000002 RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007f450fe3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4510026128 R14: 00007f4510026090 R15: 00007ffda0721548
 </TASK>
INFO: task syz.0.1581:10589 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.1581      state:D stack:28552 pid:10589 ppid:5777   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 nfsd_shutdown_threads+0x53/0x1a0 fs/nfsd/nfssvc.c:638
 nfsd_umount+0x42/0xc0 fs/nfsd/nfsctl.c:1464
 deactivate_locked_super+0x97/0x100 fs/super.c:481
 cleanup_mnt+0x3d7/0x460 fs/namespace.c:1259
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fbee559e159
RSP: 002b:00007fbee63d5028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: fffffffffffffffe RBX: 00007fbee5825fa0 RCX: 00007fbee559e159
RDX: 0000200000000100 RSI: 00002000000000c0 RDI: 0000000000000000
RBP: 00007fbee563506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbee5826038 R14: 00007fbee5825fa0 R15: 00007ffd2873aa78
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/29:
 #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6635
2 locks held by getty/5530:
 #0: ffff8880314220a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
3 locks held by syz.2.1559/10532:
 #0: ffff888044dd4d48 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040
 #1: ffff88814c9ae418 (sb_writers#32){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #2: ffffffff8d3e1c88 (nfsd_mutex){+.+.}-{3:3}, at: write_ports+0xb7/0xfa0 fs/nfsd/nfsctl.c:843
3 locks held by syz.2.1559/10533:
 #0: ffff888044dd40c8 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2a3/0x330 fs/file.c:1040
 #1: ffff88814c9ae418 (sb_writers#32){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #2: ffffffff8d3e1c88 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_svc+0x65/0xab0 fs/nfsd/nfssvc.c:788
2 locks held by syz.0.1581/10589:
 #0: ffff88807a18a0e0 (&type->s_umount_key#96){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline]
 #0: ffff88807a18a0e0 (&type->s_umount_key#96){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline]
 #0: ffff88807a18a0e0 (&type->s_umount_key#96){++++}-{3:3}, at: deactivate_super+0xa4/0xe0 fs/super.c:513
 #1: ffffffff8d3e1c88 (nfsd_mutex){+.+.}-{3:3}, at: nfsd_shutdown_threads+0x53/0x1a0 fs/nfsd/nfssvc.c:638
1 lock held by syz.5.1802/11423:
 #0: ffff88807a18a0e0 (&type->s_umount_key#96){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline]
 #0: ffff88807a18a0e0 (&type->s_umount_key#96){++++}-{3:3}, at: super_lock+0x189/0x390 fs/super.c:117
1 lock held by syz.5.1802/11433:
 #0: ffff88807a18a0e0 (&type->s_umount_key#96){++++}-{3:3}, at: __super_lock fs/super.c:58 [inline]
 #0: ffff88807a18a0e0 (&type->s_umount_key#96){++++}-{3:3}, at: super_lock+0x189/0x390 fs/super.c:117
1 lock held by syz.3.2119/12904:

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 12904 Comm: syz.3.2119 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:unwind_next_frame+0xea4/0x2990 arch/x86/include/asm/stacktrace.h:-1
Code: 44 24 70 42 80 3c 38 00 74 05 e8 17 55 a4 00 49 8b 5d 08 49 8d 7d 10 49 89 fc 49 c1 ec 03 43 80 3c 3c 00 74 05 e8 fc 54 a4 00 <48> 89 6c 24 08 4c 8d 75 f8 4d 8b 7d 10 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000e486e58 EFLAGS: 00000246
RAX: 1ffff92001c90de6 RBX: ffffc9000e480000 RCX: 0000000000000003
RDX: ffffffff813bc212 RSI: ffffffff8cfa0950 RDI: ffffc9000e486f38
RBP: ffffc9000e487660 R08: ffff8880235f0000 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: 1ffff92001c90de7
R13: ffffc9000e486f28 R14: 0000000000000002 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005598fad75660 CR3: 000000000cf32000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 save_stack+0x125/0x230 mm/page_owner.c:128
 __reset_page_owner+0x4e/0x190 mm/page_owner.c:149
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1182 [inline]
 free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
 free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2505
 release_pages+0x208a/0x2300 mm/swap.c:1022
 __folio_batch_release+0x71/0xe0 mm/swap.c:1042
 folio_batch_release include/linux/pagevec.h:83 [inline]
 shmem_undo_range+0x5ff/0x1a80 mm/shmem.c:1026
 shmem_truncate_range mm/shmem.c:1135 [inline]
 shmem_evict_inode+0x285/0xa70 mm/shmem.c:1264
 evict+0x4b7/0x8a0 fs/inode.c:705
 __dentry_kill+0x412/0x630 fs/dcache.c:611
 dentry_kill+0xb8/0x290 fs/dcache.c:-1
 dput+0xfe/0x1e0 fs/dcache.c:918
 __fput+0x5b2/0x940 fs/file_table.c:426
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x986/0x2530 kernel/exit.c:890
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 get_signal+0x12a6/0x1390 kernel/signal.c:2915
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:318
 exc_page_fault+0x8c/0x100 arch/x86/mm/fault.c:1519
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7facd9853bd7
Code: Unable to access opcode bytes at 0x7facd9853bad.
RSP: 002b:00007facda927120 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007facd999e159
RDX: 00007facda927140 RSI: 00007facda927270 RDI: 000000000000000b
RBP: 00007facd9a3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007facd9c26038 R14: 00007facd9c25fa0 R15: 00007ffc364756c8
 </TASK>