INFO: task syz.4.551:7930 blocked for more than 143 seconds.
      Not tainted 6.14.0-rc4-syzkaller-00199-g76544811c850 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.551       state:D stack:24472 pid:7930  tgid:7929  ppid:5822   task_flags:0x400140 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0x18bc/0x4c40 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6857
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x817/0x1010 kernel/locking/mutex.c:730
 sync_bdevs+0x1ae/0x340 block/bdev.c:1246
 ksys_sync+0xe2/0x1c0 fs/sync.c:105
 __do_sys_sync+0xe/0x20 fs/sync.c:113
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe37638d169
RSP: 002b:00007fe3772bc038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fe3765a5fa0 RCX: 00007fe37638d169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fe3765a5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe3765a5fa0 R15: 00007ffff8919758
 </TASK>
INFO: task syz.4.551:7932 blocked for more than 143 seconds.
      Not tainted 6.14.0-rc4-syzkaller-00199-g76544811c850 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.551       state:D stack:26808 pid:7932  tgid:7929  ppid:5822   task_flags:0x400040 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0x18bc/0x4c40 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6857
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x817/0x1010 kernel/locking/mutex.c:730
 sync_bdevs+0x1ae/0x340 block/bdev.c:1246
 ksys_sync+0xe2/0x1c0 fs/sync.c:105
 __do_sys_sync+0xe/0x20 fs/sync.c:113
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe37638d169
RSP: 002b:00007fe37729b038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a2
RAX: ffffffffffffffda RBX: 00007fe3765a6080 RCX: 00007fe37638d169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007fe3765a6080 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fe3765a6080 R15: 00007ffff8919758
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/30:
 #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6746
2 locks held by getty/5589:
 #0: ffff88803251e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211
1 lock held by udevd/5843:
 #0: ffff8880262e34c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903
1 lock held by udevd/5844:
 #0: ffff88802622b4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903
1 lock held by udevd/5845:
 #0: ffff88802622f4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903
1 lock held by udevd/6064:
 #0: ffff8880258164c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903
1 lock held by udevd/6088:
 #0: ffff88802620a4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903
1 lock held by udevd/7258:
 #0: ffff88802620e4c8 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xf0/0xc50 block/bdev.c:903
1 lock held by syz.4.551/7930:
 #0: ffff88802622f4c8 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x1ae/0x340 block/bdev.c:1246
1 lock held by syz.4.551/7932:
 #0: ffff88802622f4c8 (&disk->open_mutex){+.+.}-{4:4}, at: sync_bdevs+0x1ae/0x340 block/bdev.c:1246
1 lock held by syz.1.941/9462:
 #0: ffffffff8eb3e340 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3741

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.14.0-rc4-syzkaller-00199-g76544811c850 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline]
 watchdog+0x1058/0x10a0 kernel/hung_task.c:399
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6186 Comm: kworker/u8:18 Not tainted 6.14.0-rc4-syzkaller-00199-g76544811c850 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: events_unbound flush_memcg_stats_dwork
RIP: 0010:mem_cgroup_css_rstat_flush+0x5bd/0x920 mm/memcontrol.c:3835
Code: 38 00 74 08 48 89 ef e8 c1 6b f7 ff 48 8b 6d 00 48 83 c5 10 48 89 e8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 ef e8 a3 6b f7 ff <48> 8b 5d 00 eb 02 31 db 49 83 c6 08 4c 89 f0 48 c1 e8 03 42 80 3c
RSP: 0018:ffffc9000569f838 EFLAGS: 00000046
RAX: 1ffff1102815a002 RBX: ffff88805f8de668 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffe8ffffc7a778
RBP: ffff888140ad0010 R08: ffffffff81ba79f3 R09: 1ffffffff28a2708
R10: dffffc0000000000 R11: ffffffff822f0060 R12: ffffffff8e53bb50
R13: ffff8881436c2800 R14: ffff88814dd00000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fc13ff8 CR3: 000000002952c000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 cgroup_rstat_flush_locked+0x1970/0x2100 kernel/cgroup/rstat.c:322
 cgroup_rstat_flush+0x38/0x50 kernel/cgroup/rstat.c:354
 flush_memcg_stats_dwork+0x15/0x60 mm/memcontrol.c:650
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
 worker_thread+0x870/0xd30 kernel/workqueue.c:3400
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>