INFO: task kworker/0:4:456 blocked for more than 122 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:4     state:D stack:0     pid:456   tgid:456   ppid:2      flags:0x00004000
Workqueue: events xfrm_state_gc_task
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 synchronize_rcu_expedited+0x517/0x970 kernel/rcu/tree_exp.h:978
 synchronize_rcu+0x77/0x2f0 kernel/rcu/tree.c:4119
 xfrm_state_gc_task+0xd0/0x180 net/xfrm/xfrm_state.c:569
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz.5.1306:4410 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.1306      state:D stack:0     pid:4410  tgid:4409  ppid:2430   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 schedule_timeout+0xc7/0x3b0 kernel/time/timer.c:2596
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common+0x369/0x650 kernel/sched/completion.c:127
 wait_for_completion+0x1c/0x40 kernel/sched/completion.c:148
 rcu_barrier+0x415/0x540 kernel/rcu/tree.c:4657
 kvm_mmu_uninit_tdp_mmu+0x1df/0x210 arch/x86/kvm/mmu/tdp_mmu.c:51
 kvm_mmu_uninit_vm+0x27/0x60 arch/x86/kvm/mmu/mmu.c:6572
 kvm_arch_destroy_vm+0x398/0x420 arch/x86/kvm/x86.c:12970
 kvm_destroy_vm virt/kvm/kvm_main.c:1355 [inline]
 kvm_put_kvm+0xb04/0x12c0 virt/kvm/kvm_main.c:1392
 kvm_vm_release+0x47/0x70 virt/kvm/kvm_main.c:1415
 __fput+0x1fb/0xa00 fs/file_table.c:429
 ____fput+0x20/0x30 fs/file_table.c:457
 task_work_run+0x1e5/0x260 kernel/task_work.c:246
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x9e3/0x2650 kernel/exit.c:953
 do_group_exit+0x229/0x2f0 kernel/exit.c:1095
 get_signal+0x1398/0x14e0 kernel/signal.c:2933
 arch_do_signal_or_restart+0xbc/0x760 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x57/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fcac019c2bb
RSP: 002b:00007fcac108af00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: fffffffffffffffc RBX: 0000000000000006 RCX: 00007fcac019c2bb
RDX: 00007fcac108bfd0 RSI: 0000000080085502 RDI: 0000000000000006
RBP: 00007fcac108bfd0 R08: 0000000000000040 R09: 00007fcac108afc8
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000080085502
R13: 0000000800000000 R14: 0000000000000012 R15: 00007fcac0250adc
 </TASK>
INFO: task syz.4.1310:4422 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.1310      state:D stack:0     pid:4422  tgid:4422  ppid:1905   flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 synchronize_rcu_expedited+0x6eb/0x970 kernel/rcu/tree_exp.h:994
 synchronize_rcu+0x77/0x2f0 kernel/rcu/tree.c:4119
 pfkey_release+0x2a3/0x370 net/key/af_key.c:185
 __sock_release net/socket.c:659 [inline]
 sock_close+0xdd/0x280 net/socket.c:1426
 __fput+0x1fb/0xa00 fs/file_table.c:429
 ____fput+0x20/0x30 fs/file_table.c:457
 task_work_run+0x1e5/0x260 kernel/task_work.c:246
 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f141959c629
RSP: 002b:00007ffe9c361e78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffe9c361f60 RCX: 00007f141959c629
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000031bf7 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b33020000 R11: 0000000000000246 R12: 00007ffe9c361fa0
R13: 00007f1419815fac R14: 0000000000031c2d R15: 00007f1419815fa0
 </TASK>
INFO: task syz.3.1311:4424 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1311      state:D stack:0     pid:4424  tgid:4424  ppid:294    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:7996
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x960/0x1bb0 kernel/locking/mutex.c:803
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1134
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 exp_funnel_lock kernel/rcu/tree_exp.h:331 [inline]
 synchronize_rcu_expedited+0x296/0x970 kernel/rcu/tree_exp.h:978
 synchronize_rcu+0x77/0x2f0 kernel/rcu/tree.c:4119
 synchronize_net+0x38/0x40 net/core/dev.c:11389
 packet_release+0xa01/0xd60 net/packet/af_packet.c:3216
 __sock_release net/socket.c:659 [inline]
 sock_close+0xdd/0x280 net/socket.c:1426
 __fput+0x1fb/0xa00 fs/file_table.c:429
 ____fput+0x20/0x30 fs/file_table.c:457
 task_work_run+0x1e5/0x260 kernel/task_work.c:246
 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fc12df9c629
RSP: 002b:00007ffeae3ef4c8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fc12e217da0 RCX: 00007fc12df9c629
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fc12e217da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007fc12e217cb0 R11: 0000000000000246 R12: 00000000000321aa
R13: 00007fc12e21609c R14: 0000000000031efe R15: 00007fc12e216090
 </TASK>
INFO: task syz.3.1311:4425 blocked for more than 124 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1311      state:D stack:0     pid:4425  tgid:4424  ppid:294    flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 schedule_timeout+0xc7/0x3b0 kernel/time/timer.c:2596
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common+0x369/0x650 kernel/sched/completion.c:127
 wait_for_completion+0x1c/0x40 kernel/sched/completion.c:148
 __flush_work+0x712/0xb10 kernel/workqueue.c:4233
 flush_work+0x1b/0x40 kernel/workqueue.c:4255
 __lru_add_drain_all+0x51c/0x580 mm/swap.c:922
 lru_add_drain_all+0x14/0x30 mm/swap.c:930
 invalidate_bdev+0x79/0x130 block/bdev.c:102
 bdev_disk_changed+0x1a6/0x1610 block/partitions/core.c:651
 blkdev_get_whole+0x2f2/0x4b0 block/bdev.c:729
 bdev_open+0x324/0xd60 block/bdev.c:938
 bdev_file_open_by_dev+0x1bd/0x240 block/bdev.c:1040
 disk_scan_partitions+0x1c5/0x2d0 block/genhd.c:367
 blkdev_common_ioctl+0x1795/0x2730 block/ioctl.c:623
 blkdev_ioctl+0x486/0x690 block/ioctl.c:693
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x135/0x1b0 fs/ioctl.c:893
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:893
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fc12df9c629
RSP: 002b:00007fc12edd4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fc12e215fa0 RCX: 00007fc12df9c629
RDX: 0000000000000000 RSI: 000000000000125f RDI: 0000000000000006
RBP: 00007fc12e032b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc12e216038 R14: 00007fc12e215fa0 R15: 00007ffeae3ef368
 </TASK>
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 955f6180463debd82b9f2b9d8786ee899826498b
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 nmi_cpu_backtrace+0x2ba/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:267 [inline]
 watchdog+0xdad/0xf00 kernel/hung_task.c:423
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 4419 Comm: syz.2.1309 Not tainted syzkaller #0 955f6180463debd82b9f2b9d8786ee899826498b
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:106
Code: cc cc cc cc cc cc cc b8 92 ef 84 02 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 9b 48 00 55 48 89 e5 fb f4 <5d> e9 07 60 02 00 cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc9000a0d41b0 EFLAGS: 000002d3
RAX: ffffffff814428e1 RBX: 0000000000000003 RCX: ffff88811e1f9300
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003
RBP: ffffc9000a0d41b0 R08: ffff888130699088 R09: 1ffff110260d3211
R10: dffffc0000000000 R11: ffffed10260d3212 R12: dffffc0000000000
R13: 0000000000000200 R14: 0000000000000003 R15: 1ffff9200141a838
FS:  00007f577d41a6c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000012de70000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
 kvm_wait+0x1c6/0x230 arch/x86/kernel/kvm.c:1081
 pv_wait arch/x86/include/asm/paravirt.h:596 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:466 [inline]
 __pv_queued_spin_lock_slowpath+0x8e0/0xe90 kernel/locking/qspinlock.c:508
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
 _raw_spin_lock+0x115/0x120 kernel/locking/spinlock.c:154
 <kernel::sync::lock::Lock<rust_binder_main::process::ProcessInner, kernel::sync::lock::spinlock::SpinLockBackend>>::lock rust/kernel/sync/lock.rs:142 [inline]
 <rust_binder_main::process::Process>::push_work drivers/android/binder/process.rs:730 [inline]
 <rust_binder_main::thread::Thread>::push_work_if_looper+0x202/0x620 drivers/android/binder/thread.rs:667
 <rust_binder_main::node::NodeDeath>::set_notification_done drivers/android/binder/node.rs:1044 [inline]
 <rust_binder_main::process::Process>::dead_binder_done drivers/android/binder/process.rs:1312 [inline]
 <rust_binder_main::thread::Thread>::write+0x3aa3/0xa690 drivers/android/binder/thread.rs:1505
 <rust_binder_main::thread::Thread>::write_read drivers/android/binder/thread.rs:1608 [inline]
 <rust_binder_main::process::Process>::ioctl_write_read drivers/android/binder/process.rs:1609 [inline]
 <rust_binder_main::process::Process>::ioctl drivers/android/binder/process.rs:1674 [inline]
 rust_binder_main::rust_binder_ioctl+0x1077/0x5da0 drivers/android/binder/rust_binder_main.rs:449
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x135/0x1b0 fs/ioctl.c:893
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:893
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f577c59c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f577d41a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f577c816090 RCX: 00007f577c59c629
RDX: 0000200000000040 RSI: 00000000c0306201 RDI: 0000000000000005
RBP: 00007f577c632b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f577c816128 R14: 00007f577c816090 R15: 00007ffe48749ee8
 </TASK>