INFO: task kworker/u8:1:13 blocked for more than 122 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:1    state:D stack:0     pid:13    tgid:13    ppid:2      flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 schedule_timeout+0xc7/0x3b0 kernel/time/timer.c:2596
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common+0x369/0x650 kernel/sched/completion.c:127
 wait_for_completion+0x1c/0x40 kernel/sched/completion.c:148
 __synchronize_srcu kernel/rcu/srcutree.c:1401 [inline]
 synchronize_srcu_expedited+0x20b/0x290 kernel/rcu/srcutree.c:1426
 synchronize_srcu+0x2c3/0x4c0 kernel/rcu/srcutree.c:1480
 fsnotify_mark_destroy_workfn+0x10a/0x310 fs/notify/mark.c:988
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task kworker/u8:3:293 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:3    state:D stack:0     pid:293   tgid:293   ppid:2      flags:0x00004000
Workqueue: events_unbound fsnotify_connector_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 schedule_timeout+0xc7/0x3b0 kernel/time/timer.c:2596
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common+0x369/0x650 kernel/sched/completion.c:127
 wait_for_completion+0x1c/0x40 kernel/sched/completion.c:148
 __synchronize_srcu kernel/rcu/srcutree.c:1401 [inline]
 synchronize_srcu_expedited+0x20b/0x290 kernel/rcu/srcutree.c:1426
 synchronize_srcu+0x2c3/0x4c0 kernel/rcu/srcutree.c:1480
 fsnotify_connector_destroy_workfn+0x48/0xb0 fs/notify/mark.c:318
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d4/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc70/0x10b0 kernel/workqueue.c:3400
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz.1.265:1218 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.265       state:D stack:0     pid:1218  tgid:1218  ppid:289    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 synchronize_rcu_expedited+0x6eb/0x970 kernel/rcu/tree_exp.h:994
 synchronize_rcu+0x77/0x2f0 kernel/rcu/tree.c:4119
 evdev_detach_client drivers/input/evdev.c:377 [inline]
 evdev_release+0x26c/0x830 drivers/input/evdev.c:440
 __fput+0x1fb/0xa00 fs/file_table.c:429
 ____fput+0x20/0x30 fs/file_table.c:457
 task_work_run+0x1e5/0x260 kernel/task_work.c:246
 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f11f9b9c629
RSP: 002b:00007ffce95ea558 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffce95ea640 RCX: 00007f11f9b9c629
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000012b79 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2de20000 R11: 0000000000000246 R12: 00007ffce95ea680
R13: 00007f11f9e15fac R14: 000000000001307a R15: 00007f11f9e15fa0
 </TASK>
INFO: task syz.2.268:1226 blocked for more than 123 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.268       state:D stack:0     pid:1226  tgid:1226  ppid:292    flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:7996
 __mutex_lock_common kernel/locking/mutex.c:707 [inline]
 __mutex_lock+0x960/0x1bb0 kernel/locking/mutex.c:803
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1134
 mutex_lock+0x113/0x1d0 kernel/locking/mutex.c:285
 exp_funnel_lock kernel/rcu/tree_exp.h:331 [inline]
 synchronize_rcu_expedited+0x296/0x970 kernel/rcu/tree_exp.h:978
 synchronize_rcu+0x77/0x2f0 kernel/rcu/tree.c:4119
 synchronize_net+0x38/0x40 net/core/dev.c:11389
 packet_release+0xa01/0xd60 net/packet/af_packet.c:3216
 __sock_release net/socket.c:659 [inline]
 sock_close+0xdd/0x280 net/socket.c:1426
 __fput+0x1fb/0xa00 fs/file_table.c:429
 ____fput+0x20/0x30 fs/file_table.c:457
 task_work_run+0x1e5/0x260 kernel/task_work.c:246
 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f90ee59c629
RSP: 002b:00007fffcbebca88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fffcbebcb70 RCX: 00007f90ee59c629
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000012dd7 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2df20000 R11: 0000000000000246 R12: 00007fffcbebcbb0
R13: 00007f90ee815fac R14: 000000000001339d R15: 00007f90ee815fa0
 </TASK>
INFO: task syz.3.270:1231 blocked for more than 124 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.270       state:D stack:0     pid:1231  tgid:1231  ppid:291    flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5996 [inline]
 __schedule+0x134f/0x1ea0 kernel/sched/core.c:7843
 __schedule_loop kernel/sched/core.c:7924 [inline]
 schedule+0xc5/0x240 kernel/sched/core.c:7939
 schedule_timeout+0xc7/0x3b0 kernel/time/timer.c:2596
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common+0x369/0x650 kernel/sched/completion.c:127
 wait_for_completion+0x1c/0x40 kernel/sched/completion.c:148
 __synchronize_srcu kernel/rcu/srcutree.c:1401 [inline]
 synchronize_srcu_expedited+0x20b/0x290 kernel/rcu/srcutree.c:1426
 synchronize_srcu+0x2c3/0x4c0 kernel/rcu/srcutree.c:1480
 mmu_notifier_unregister+0x27d/0x360 mm/mmu_notifier.c:834
 kvm_destroy_vm virt/kvm/kvm_main.c:1334 [inline]
 kvm_put_kvm+0xa23/0x12c0 virt/kvm/kvm_main.c:1392
 kvm_vm_release+0x47/0x70 virt/kvm/kvm_main.c:1415
 __fput+0x1fb/0xa00 fs/file_table.c:429
 ____fput+0x20/0x30 fs/file_table.c:457
 task_work_run+0x1e5/0x260 kernel/task_work.c:246
 resume_user_mode_work+0x35/0x50 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x63/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x63/0xf0 arch/x86/entry/common.c:84
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f7b11b9c629
RSP: 002b:00007ffcd23a88f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffcd23a89e0 RCX: 00007f7b11b9c629
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000012e7a R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2e020000 R11: 0000000000000246 R12: 00007ffcd23a8a20
R13: 00007f7b11e15fac R14: 0000000000012eb0 R15: 00007f7b11e15fa0
 </TASK>
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 955f6180463debd82b9f2b9d8786ee899826498b
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 nmi_cpu_backtrace+0x2ba/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:267 [inline]
 watchdog+0xdad/0xf00 kernel/hung_task.c:423
 kthread+0x2c9/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 1229 Comm: syz.0.269 Not tainted syzkaller #0 955f6180463debd82b9f2b9d8786ee899826498b
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:106
Code: cc cc cc cc cc cc cc b8 54 b6 22 7b 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 9b 48 00 55 48 89 e5 fb f4 <5d> e9 07 60 02 00 cc cc cc cc cc cc cc b8 00 00 00 00 90 90 90 90
RSP: 0018:ffffc9001022c1b0 EFLAGS: 000002d3
RAX: ffffffff814428e1 RBX: 0000000000000003 RCX: ffff888129ef3900
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000003
RBP: ffffc9001022c1b0 R08: ffff88811fe26088 R09: 1ffff11023fc4c11
R10: dffffc0000000000 R11: ffffed1023fc4c12 R12: dffffc0000000000
R13: 0000000000000200 R14: 0000000000000003 R15: 1ffff92002045838
FS:  00007fddff8df6c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001000 CR3: 00000001195e0000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:112 [inline]
 kvm_wait+0x1c6/0x230 arch/x86/kernel/kvm.c:1081
 pv_wait arch/x86/include/asm/paravirt.h:596 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:466 [inline]
 __pv_queued_spin_lock_slowpath+0x8e0/0xe90 kernel/locking/qspinlock.c:508
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:134 [inline]
 _raw_spin_lock+0x115/0x120 kernel/locking/spinlock.c:154
 <kernel::sync::lock::Lock<rust_binder_main::process::ProcessInner, kernel::sync::lock::spinlock::SpinLockBackend>>::lock rust/kernel/sync/lock.rs:142 [inline]
 <rust_binder_main::process::Process>::push_work drivers/android/binder/process.rs:730 [inline]
 <rust_binder_main::thread::Thread>::push_work_if_looper+0x202/0x620 drivers/android/binder/thread.rs:667
 <rust_binder_main::node::NodeDeath>::set_notification_done drivers/android/binder/node.rs:1044 [inline]
 <rust_binder_main::process::Process>::dead_binder_done drivers/android/binder/process.rs:1312 [inline]
 <rust_binder_main::thread::Thread>::write+0x3aa3/0xa690 drivers/android/binder/thread.rs:1505
 <rust_binder_main::thread::Thread>::write_read drivers/android/binder/thread.rs:1608 [inline]
 <rust_binder_main::process::Process>::ioctl_write_read drivers/android/binder/process.rs:1609 [inline]
 <rust_binder_main::process::Process>::ioctl drivers/android/binder/process.rs:1674 [inline]
 rust_binder_main::rust_binder_ioctl+0x1077/0x5da0 drivers/android/binder/rust_binder_main.rs:449
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0x135/0x1b0 fs/ioctl.c:893
 __x64_sys_ioctl+0x7f/0xa0 fs/ioctl.c:893
 x64_sys_call+0x1878/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:17
 do_syscall_x64 arch/x86/entry/common.c:47 [inline]
 do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fddfe99c629
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fddff8df028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fddfec15fa0 RCX: 00007fddfe99c629
RDX: 0000200000000040 RSI: 00000000c0306201 RDI: 0000000000000004
RBP: 00007fddfea32b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fddfec16038 R14: 00007fddfec15fa0 R15: 00007ffe2b88c218
 </TASK>