INFO: task kworker/u4:3:49 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:3    state:D stack:21688 pid:49    ppid:2      flags:0x00004000
Workqueue: events_unbound fsnotify_connector_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 __synchronize_srcu+0x339/0x3d0 kernel/rcu/srcutree.c:1386
 fsnotify_connector_destroy_workfn+0x44/0xa0 fs/notify/mark.c:234
 process_one_work kernel/workqueue.c:2653 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task jbd2/sda1-8:5102 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jbd2/sda1-8     state:D stack:24392 pid:5102  ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 io_schedule+0x80/0xd0 kernel/sched/core.c:9024
 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:209
 __wait_on_bit+0x9f/0x2c0 kernel/sched/wait_bit.c:49
 out_of_line_wait_on_bit+0x13c/0x190 kernel/sched/wait_bit.c:64
 wait_on_buffer include/linux/buffer_head.h:373 [inline]
 journal_wait_on_commit_record fs/jbd2/commit.c:171 [inline]
 jbd2_journal_commit_transaction+0x35bf/0x5ad0 fs/jbd2/commit.c:888
 kjournald2+0x40f/0x810 fs/jbd2/journal.c:201
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task kworker/u4:11:5851 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:11   state:D stack:23496 pid:5851  ppid:2      flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 __synchronize_srcu+0x339/0x3d0 kernel/rcu/srcutree.c:1386
 fsnotify_mark_destroy_workfn+0x10a/0x2e0 fs/notify/mark.c:928
 process_one_work kernel/workqueue.c:2653 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/u4:0/11:
 #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
 #1: ffffc90000107d00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #1: ffffc90000107d00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
 #2: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x21d0/0x3da0 kernel/fork.c:2606
1 lock held by khungtaskd/29:
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by kworker/u4:3/49:
 #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
 #1: ffffc90000b9fd00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #1: ffffc90000b9fd00 (connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
3 locks held by kworker/u4:7/1095:
 #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
 #1: ffffc900046efd00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #1: ffffc900046efd00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
 #2: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x21d0/0x3da0 kernel/fork.c:2606
1 lock held by udevd/5140:
 #0: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x21d0/0x3da0 kernel/fork.c:2606
1 lock held by dhcpcd/5435:
 #0: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x21d0/0x3da0 kernel/fork.c:2606
2 locks held by getty/5529:
 #0: ffff8880318720a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
1 lock held by syz-executor/5770:
 #0: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837
2 locks held by syz-executor/5775:
2 locks held by kworker/u4:11/5851:
 #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
 #1: ffffc900049afd00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
 #1: ffffc900049afd00 ((reaper_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730
1 lock held by syz.1.447/7171:
1 lock held by syz.3.446/7173:
5 locks held by syz-executor/7180:
 #0: ffff8880253e8418 (sb_writers#10){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #1: ffff88802e41cc88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 fs/kernfs/file.c:343
 #2: ffffffff8d15b9e8 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:369 [inline]
 #2: ffffffff8d15b9e8 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xe9/0x230 kernel/cgroup/cgroup.c:1677
 #3: ffffffff8cfcd110 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_attach_lock kernel/cgroup/cgroup.c:2414 [inline]
 #3: ffffffff8cfcd110 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x18a/0x610 kernel/cgroup/cgroup.c:2919
 #4: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_attach_lock kernel/cgroup/cgroup.c:2416 [inline]
 #4: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_procs_write_start+0x1a0/0x610 kernel/cgroup/cgroup.c:2919
1 lock held by udevd/7182:
 #0: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837
1 lock held by udevd/7183:
 #0: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837
1 lock held by udevd/7184:
 #0: ffffffff8d15bbd0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x601/0x2530 kernel/exit.c:837

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 7173 Comm: syz.3.446 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:check_region_inline mm/kasan/generic.c:-1 [inline]
RIP: 0010:kasan_check_range+0x12/0x290 mm/kasan/generic.c:187
Code: 0f 0b b8 ea ff ff ff c3 0f 0b b8 ea ff ff ff c3 cc cc cc cc cc cc cc cc 66 0f 1f 00 b0 01 48 85 f6 0f 84 b4 01 00 00 55 41 57 <41> 56 41 55 41 54 53 4c 8d 04 37 49 39 f8 0f 82 13 02 00 00 49 89
RSP: 0018:ffffc90000007608 EFLAGS: 00000002
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff81689802
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff911eb500
RBP: ffffc90000007868 R08: dffffc0000000000 R09: 1ffffffff223d6a0
R10: dffffc0000000000 R11: fffffbfff223d6a1 R12: 0000000000000002
R13: ffff8880286d8000 R14: ffffffff90b54f5a R15: ffff8880286d8b28
FS:  00007f0d9b10f6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2df1cff8 CR3: 000000005f13e000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 instrument_atomic_read include/linux/instrumented.h:68 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
 __lock_acquire+0xd92/0x7d80 kernel/locking/lockdep.c:5107
 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5754
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xb4/0x100 kernel/locking/spinlock.c:162
 __debug_check_no_obj_freed lib/debugobjects.c:1034 [inline]
 debug_check_no_obj_freed+0x9e/0x520 lib/debugobjects.c:1075
 slab_free_hook mm/slub.c:1786 [inline]
 slab_free_freelist_hook+0xd2/0x1a0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 kmem_cache_free+0xf8/0x290 mm/slub.c:3852
 mac80211_hwsim_beacon_tx+0x3df/0x770 drivers/net/wireless/virtual/mac80211_hwsim.c:2269
 __iterate_interfaces+0x225/0x4c0 net/mac80211/util.c:766
 ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:802
 mac80211_hwsim_beacon+0xbb/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2295
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 00 f3 0f 1e fa 53 48 89 fb 48 83 c7 18 48 8b 74 24 08 e8 da 8c d2 f6 48 89 df e8 82 60 d3 f6 e8 ad 61 f7 f6 fb bf 01 00 00 00 <e8> b2 6e c6 f6 65 8b 05 13 3d 6d 75 85 c0 74 02 5b c3 e8 c0 21 6a
RSP: 0018:ffffc9000bd07c78 EFLAGS: 00000286
RAX: 58cb544e059d3b00 RBX: ffff8880557cc0c0 RCX: 58cb544e059d3b00
RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001
RBP: 0000000000000000 R08: ffffffff8e8c7caf R09: 1ffffffff1d18f95
R10: dffffc0000000000 R11: fffffbfff1d18f96 R12: 0000000000000021
R13: ffff8880557cc558 R14: dffffc0000000000 R15: 000000001c000004
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 get_signal+0x1197/0x1390 kernel/signal.c:2914
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0d9a19e017
Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89
RSP: 002b:00007f0d9b10f028 EFLAGS: 00000246
RAX: 0000000000000048 RBX: 00007f0d9a425fa0 RCX: 00007f0d9a19e019
RDX: 0000200000000280 RSI: 0000000000000026 RDI: 0000000000000003
RBP: 00007f0d9a23500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f0d9a426038 R14: 00007f0d9a425fa0 R15: 00007fff37979868
 </TASK>