INFO: task syz.6.2730:16354 blocked for more than 143 seconds.
      Not tainted 6.15.0-rc6-syzkaller-00188-gfee3e843b309 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.2730      state:D stack:28280 pid:16354 tgid:16344 ppid:6965   task_flags:0x400140 flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x168f/0x4c70 kernel/sched/core.c:6767
 __schedule_loop kernel/sched/core.c:6845 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6860
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
 __mutex_lock_common kernel/locking/mutex.c:678 [inline]
 __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746
 blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:745
 blkdev_common_ioctl+0xdce/0x2450 block/ioctl.c:629
 blkdev_ioctl+0x4ef/0x6d0 block/ioctl.c:698
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6a6af8e969
RSP: 002b:00007f6a6bdce038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6a6b1b6240 RCX: 00007f6a6af8e969
RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000004
RBP: 00007f6a6b010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f6a6b1b6240 R15: 00007ffd7c1815a8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
 #0: ffffffff8df3dce0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8df3dce0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #0: ffffffff8df3dce0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6764
1 lock held by dhcpcd/5484:
 #0: ffffffff8f2e4fc8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f2e4fc8 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x323/0x1b50 net/ipv4/devinet.c:1121
2 locks held by getty/5581:
 #0: ffff88803064f0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900036cb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
5 locks held by kworker/1:14/9793:
 #0: ffff8880206f9148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff8880206f9148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
 #1: ffffc90003c0fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc90003c0fc60 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
 #2: ffff888028a3c198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #2: ffff888028a3c198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 drivers/usb/core/hub.c:5859
 #3: ffff888028a3f510 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3220 [inline]
 #3: ffff888028a3f510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5428 [inline]
 #3: ffff888028a3f510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5671 [inline]
 #3: ffff888028a3f510 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5831 [inline]
 #3: ffff888028a3f510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 drivers/usb/core/hub.c:5913
 #4: ffff888028752668 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5429 [inline]
 #4: ffff888028752668 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5671 [inline]
 #4: ffff888028752668 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5831 [inline]
 #4: ffff888028752668 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 drivers/usb/core/hub.c:5913
3 locks held by kworker/u8:16/12994:
 #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88801a089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
 #1: ffffc9000c0a7c60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc9000c0a7c60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
 #2: ffffffff8f2e4fc8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303
3 locks held by kworker/u8:17/12995:
 #0: ffff88801d779948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88801d779948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
 #1: ffffc9000e837c60 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc9000e837c60 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
 #2: ffffffff8df437b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:336 [inline]
 #2: ffffffff8df437b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b7/0x730 kernel/rcu/tree_exp.h:998
2 locks held by syz.6.2730/16345:
1 lock held by syz.6.2730/16354:
 #0: ffff888144374398 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove kernel/trace/blktrace.c:406 [inline]
 #0: ffff888144374398 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_ioctl+0x1b9/0x430 kernel/trace/blktrace.c:745
5 locks held by kworker/1:1/17429:
 #0: 
ffff8880206f9148
 (
(wq_completion)usb_hub_wq
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3213 [inline]
, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319
 #1: 
ffffc9000483fc60
 (
(work_completion)(&hub->events)
){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319
 #2: ffff888028aa2198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline]
 #2: ffff888028aa2198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a00 drivers/usb/core/hub.c:5859
 #3: ffff888028aa3510 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3220 [inline]
 #3: ffff888028aa3510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5428 [inline]
 #3: ffff888028aa3510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5671 [inline]
 #3: ffff888028aa3510 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5831 [inline]
 #3: ffff888028aa3510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21a3/0x4a00 drivers/usb/core/hub.c:5913
 #4: 
ffff888028752668
 (
hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5429 [inline]
hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5671 [inline]
hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5831 [inline]
hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21cb/0x4a00 drivers/usb/core/hub.c:5913
3 locks held by syz-executor/17492:
 #0: ffffffff8ea7ea20 (&ops->srcu#2){.+.+}-{0:0}
, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
 #1: ffffffff8f2e4fc8
 (rtnl_mutex){+.+.}-{4:4}
, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
, at: rtnl_newlink+0x8db/0x1c70 net/core/rtnetlink.c:4064
 #2: 
ffffffff8df437b8
 (
rcu_state.exp_mutex
){+.+.}-{4:4}
, at: exp_funnel_lock kernel/rcu/tree_exp.h:336 [inline]
, at: synchronize_rcu_expedited+0x3b7/0x730 kernel/rcu/tree_exp.h:998
1 lock held by syz.2.3028/17708:
 #0: ffffffff8f2e4fc8 (rtnl_mutex){+.+.}-{4:4}
, at: tun_detach drivers/net/tun.c:633 [inline]
, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3390

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc6-syzkaller-00188-gfee3e843b309 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
 watchdog+0xfee/0x1030 kernel/hung_task.c:437
 kthread+0x70e/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 16345 Comm: syz.6.2730 Not tainted 6.15.0-rc6-syzkaller-00188-gfee3e843b309 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:lookup_object lib/debugobjects.c:423 [inline]
RIP: 0010:debug_object_deactivate+0xd5/0x250 lib/debugobjects.c:875
Code: 4c 89 ff e8 8d 0e 68 fd 4d 8b 3f 45 31 f6 eb 06 4d 8b 3f 41 ff c6 4d 85 ff 74 36 4d 8d 6f 18 4c 89 e8 48 c1 e8 03 80 3c 28 00 <74> 08 4c 89 ef e8 61 0e 68 fd 4d 39 65 00 74 29 4c 89 f8 48 c1 e8
RSP: 0018:ffffc90000a08c08 EFLAGS: 00000046
RAX: 1ffff1100c92b4ea RBX: ffffffff99a6c0b0 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000a08ae0
RBP: dffffc0000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200014115c R12: ffff888178487048
R13: ffff88806495a750 R14: 0000000000000008 R15: ffff88806495a738
FS:  00007f6a6be316c0(0000) GS:ffff8881261f9000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe737001c0 CR3: 000000002f748000 CR4: 00000000003526f0
DR0: 0000000000000007 DR1: 0000000000000002 DR2: 0000000000000008
DR3: 1000000100000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 debug_hrtimer_deactivate kernel/time/hrtimer.c:450 [inline]
 debug_deactivate+0x1d/0x200 kernel/time/hrtimer.c:490
 __run_hrtimer kernel/time/hrtimer.c:1729 [inline]
 __hrtimer_run_queues+0x2b0/0xc60 kernel/time/hrtimer.c:1825
 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1842
 handle_softirqs+0x286/0x870 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2061 [inline]
RIP: 0010:vprintk_emit+0x58f/0x7a0 kernel/printk/printk.c:2449
Code: 85 32 01 00 00 e8 d1 f2 1e 00 41 89 df 4d 85 f6 48 8b 1c 24 75 07 e8 c0 f2 1e 00 eb 06 e8 b9 f2 1e 00 fb 48 c7 c7 00 1f f3 8d <31> f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00 45 31 c9 53 e8 f9 3f
RSP: 0018:ffffc90015197220 EFLAGS: 00000246
RAX: ffffffff81a0fe47 RBX: ffffffff81a0fd04 RCX: 0000000000080000
RDX: ffffc9000c68a000 RSI: 000000000007ffff RDI: ffffffff8df31f00
RBP: ffffc90015197330 R08: ffffffff8f7dd377 R09: 1ffffffff1efba6e
R10: dffffc0000000000 R11: fffffbfff1efba6f R12: dffffc0000000000
R13: 1ffff92002a32e48 R14: 0000000000000200 R15: 0000000000000011
 _printk+0xcf/0x120 kernel/printk/printk.c:2475
 show_free_areas mm/show_mem.c:348 [inline]
 __show_mem+0x1631/0x2210 mm/show_mem.c:407
 warn_alloc_show_mem mm/page_alloc.c:3738 [inline]
 warn_alloc+0x2dd/0x310 mm/page_alloc.c:3763
 __vmalloc_area_node mm/vmalloc.c:3652 [inline]
 __vmalloc_node_range_noprof+0x5f2/0x12c0 mm/vmalloc.c:3845
 __kvmalloc_node_noprof+0x3a0/0x5e0 mm/slub.c:5034
 kvmalloc_array_node_noprof include/linux/slab.h:1065 [inline]
 relay_alloc_page_array kernel/relay.c:63 [inline]
 relay_alloc_buf kernel/relay.c:116 [inline]
 relay_create_buf kernel/relay.c:162 [inline]
 relay_open_buf+0x217/0xd40 kernel/relay.c:383
 relay_open+0x427/0x920 kernel/relay.c:516
 do_blk_trace_setup+0x591/0x9d0 kernel/trace/blktrace.c:590
 blk_trace_setup+0x116/0x1f0 kernel/trace/blktrace.c:632
 blk_trace_ioctl+0x181/0x430 kernel/trace/blktrace.c:730
 blkdev_ioctl+0x416/0x6d0 block/ioctl.c:693
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:906 [inline]
 __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:892
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xf6/0x210 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6a6af8e969
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6a6be31038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f6a6b1b5fa0 RCX: 00007f6a6af8e969
RDX: 0000200000000140 RSI: 00000000c0481273 RDI: 0000000000000004
RBP: 00007f6a6b010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f6a6b1b5fa0 R15: 00007ffd7c1815a8
 </TASK>