INFO: task syz.1.364:7947 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.364       state:D stack:27048 pid:7947  ppid:5784   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
 rwsem_down_write_slowpath+0xc3f/0x1020 kernel/locking/rwsem.c:1178
 __down_write_common kernel/locking/rwsem.c:1306 [inline]
 __down_write kernel/locking/rwsem.c:1315 [inline]
 down_write+0x1b9/0x200 kernel/locking/rwsem.c:1574
 inode_lock include/linux/fs.h:804 [inline]
 fuse_flush+0x2ca/0x8b0 fs/fuse/file.c:527
 filp_flush fs/open.c:1533 [inline]
 filp_close+0xb1/0x150 fs/open.c:1546
 __range_close fs/file.c:698 [inline]
 __close_range+0x379/0x690 fs/file.c:755
 __do_sys_close_range fs/open.c:1599 [inline]
 __se_sys_close_range fs/open.c:1596 [inline]
 __x64_sys_close_range+0x7a/0x90 fs/open.c:1596
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f3cb359ce59
RSP: 002b:00007ffc0869f5e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 00007f3cb3817da0 RCX: 00007f3cb359ce59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f3cb3817da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007f3cb3817cb0 R11: 0000000000000246 R12: 0000000000046d1f
R13: 00007f3cb381609c R14: 0000000000046ad8 R15: 00007f3cb3816090
 </TASK>
INFO: task syz.1.364:7949 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.364       state:D stack:26120 pid:7949  ppid:5784   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 fuse_direct_IO+0xa7c/0x12f0 fs/fuse/file.c:3007
 generic_file_direct_write+0x1c9/0x3e0 mm/filemap.c:3961
 fuse_cache_write_iter fs/fuse/file.c:1369 [inline]
 fuse_file_write_iter+0xb3d/0xf40 fs/fuse/file.c:1688
 do_iter_readv_writev fs/read_write.c:-1 [inline]
 do_iter_write+0x747/0xc50 fs/read_write.c:860
 vfs_writev fs/read_write.c:933 [inline]
 do_writev+0x27f/0x480 fs/read_write.c:976
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f3cb359ce59
RSP: 002b:00007f3cb44e6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007f3cb3815fa0 RCX: 00007f3cb359ce59
RDX: 0000000000000020 RSI: 0000200000000400 RDI: 0000000000000005
RBP: 00007f3cb3632e6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3cb3816038 R14: 00007f3cb3815fa0 R15: 00007ffc0869f488
 </TASK>

Showing all locks held in the system:
1 lock held by pool_workqueue_/3:
 #0: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
 #0: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
2 locks held by kworker/1:0/23:
1 lock held by khungtaskd/29:
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by kworker/0:2/172:
 #0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
 #1: ffffc90002d67d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #1: ffffc90002d67d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
2 locks held by getty/5541:
 #0: ffff88814c8010a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
3 locks held by syz-executor/5788:
2 locks held by kworker/1:4/5824:
1 lock held by syz.1.364/7947:
 #0: ffff88805c2015a0 (&sb->s_type->i_mutex_key#33){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline]
 #0: ffff88805c2015a0 (&sb->s_type->i_mutex_key#33){+.+.}-{3:3}, at: fuse_flush+0x2ca/0x8b0 fs/fuse/file.c:527
2 locks held by syz.1.364/7949:
 #0: ffff88801bb22418 (sb_writers#19){.+.+}-{0:0}, at: vfs_writev fs/read_write.c:932 [inline]
 #0: ffff88801bb22418 (sb_writers#19){.+.+}-{0:0}, at: do_writev+0x261/0x480 fs/read_write.c:976
 #1: ffff88805c2015a0 (&sb->s_type->i_mutex_key#33){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:804 [inline]
 #1: ffff88805c2015a0 (&sb->s_type->i_mutex_key#33){+.+.}-{3:3}, at: fuse_cache_write_iter fs/fuse/file.c:1354 [inline]
 #1: ffff88805c2015a0 (&sb->s_type->i_mutex_key#33){+.+.}-{3:3}, at: fuse_file_write_iter+0x2e1/0xf40 fs/fuse/file.c:1688
3 locks held by syz.6.684/9311:

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 9311 Comm: syz.6.684 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:__sanitizer_cov_trace_switch+0x58/0xe0 kernel/kcov.c:349
Code: 48 8b 06 48 85 c0 0f 84 a4 00 00 00 41 57 41 56 41 54 53 48 8d 4c 09 01 48 8b 54 24 20 65 4c 8b 05 dd cd 7c 7e 45 31 c9 eb 08 <49> ff c1 4c 39 c8 74 77 4e 8b 54 ce 10 65 44 8b 1d cb cd 7c 7e 41
RSP: 0018:ffffc900001efcf0 EFLAGS: 00000246
RAX: 0000000000000008 RBX: 0000000000000000 RCX: 0000000000000003
RDX: ffffffff813b2b18 RSI: ffffffff8cfa05c0 RDI: 0000000000000004
RBP: ffffc900001efe38 R08: ffff8880224c1e00 R09: 0000000000000003
R10: 0000000000000005 R11: 0000000000000100 R12: ffffffff8f91533c
R13: ffffc900001efde8 R14: 0000000000000004 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffb18c64ff8 CR3: 000000000cf32000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 unwind_next_frame+0x748/0x2990 arch/x86/kernel/unwind_orc.c:515
 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:164 [inline]
 slab_free_hook mm/slub.c:1811 [inline]
 slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
 skb_kfree_head net/core/skbuff.c:946 [inline]
 skb_free_head net/core/skbuff.c:958 [inline]
 skb_release_data+0x609/0x7f0 net/core/skbuff.c:988
 skb_release_all net/core/skbuff.c:1054 [inline]
 __kfree_skb net/core/skbuff.c:1068 [inline]
 consume_skb+0xb2/0x110 net/core/skbuff.c:1284
 nft_synproxy_eval_v4+0x384/0x520 net/netfilter/nft_synproxy.c:60
 nft_synproxy_do_eval+0x332/0x550 net/netfilter/nft_synproxy.c:141
 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline]
 nft_do_chain+0x44b/0x1620 net/netfilter/nf_tables_core.c:288
 nft_do_chain_inet+0x29b/0x380 net/netfilter/nft_chain_filter.c:161
 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
 nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:259 [inline]
 NF_HOOK+0x21d/0x3b0 include/linux/netfilter.h:302
 NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:304
 __netif_receive_skb_one_core net/core/dev.c:5646 [inline]
 __netif_receive_skb+0xcc/0x290 net/core/dev.c:5760
 process_backlog+0x380/0x710 net/core/dev.c:6088
 __napi_poll+0xbb/0x460 net/core/dev.c:6650
 napi_poll net/core/dev.c:6717 [inline]
 net_rx_action+0x65f/0xcc0 net/core/dev.c:6853
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 00 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 fa ff da f6 48 89 df e8 a2 d3 db f6 e8 6d ce ff f6 fb bf 01 00 00 00 <e8> c2 e3 ce f6 65 8b 05 93 32 76 75 85 c0 74 02 5b c3 e8 60 17 73
RSP: 0018:ffffc9000b957378 EFLAGS: 00000286
RAX: 73ae2b6a9fc5d900 RBX: ffff888053aafcc8 RCX: 73ae2b6a9fc5d900
RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: 0000000000000001
RBP: ffffc9000b957630 R08: ffffffff911bc50f R09: 1ffffffff22378a1
R10: dffffc0000000000 R11: fffffbfff22378a2 R12: dffffc0000000000
R13: 1ffff1100a755f98 R14: ffff888053aafcc0 R15: ffff888053aafcc8
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 filemap_remove_folio+0xf9/0x2c0 mm/filemap.c:258
 truncate_inode_folio+0x5d/0x70 mm/truncate.c:195
 shmem_undo_range+0x3f0/0x1a80 mm/shmem.c:1022
 shmem_truncate_range mm/shmem.c:1135 [inline]
 shmem_evict_inode+0x285/0xa70 mm/shmem.c:1264
 evict+0x4b7/0x8a0 fs/inode.c:705
 __dentry_kill+0x412/0x630 fs/dcache.c:611
 dentry_kill+0xb8/0x290 fs/dcache.c:-1
 dput+0xfe/0x1e0 fs/dcache.c:918
 __fput+0x5b2/0x930 fs/file_table.c:392
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x986/0x2530 kernel/exit.c:884
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1026
 get_signal+0x12a6/0x1390 kernel/signal.c:2903
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ffb17d9ce59
Code: Unable to access opcode bytes at 0x7ffb17d9ce2f.
RSP: 002b:00007ffb18ca70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007ffb18016098 RCX: 00007ffb17d9ce59
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ffb18016098
RBP: 00007ffb18016090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffb18016128 R14: 00007fff52ad4670 R15: 00007fff52ad4758
 </TASK>