INFO: task kworker/u8:3:43 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:3    state:D stack:21208 pid:43    tgid:43    ppid:2      task_flags:0x4208160 flags:0x00080000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x17b4/0x5680 kernel/sched/core.c:7183
 __schedule_loop kernel/sched/core.c:7262 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7277
 schedule_timeout+0xc3/0x2c0 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:100 [inline]
 __wait_for_common kernel/sched/completion.c:121 [inline]
 wait_for_common kernel/sched/completion.c:132 [inline]
 wait_for_completion+0x2cc/0x5e0 kernel/sched/completion.c:153
 __flush_workqueue+0x6f6/0x14f0 kernel/workqueue.c:4096
 peer_remove_after_dead+0x98/0x210 drivers/net/wireguard/peer.c:116
 wg_peer_remove_all+0x452/0x4f0 drivers/net/wireguard/peer.c:183
 wg_destruct+0x17a/0x310 drivers/net/wireguard/device.c:254
 netdev_run_todo+0xc1f/0xde0 net/core/dev.c:11770
 default_device_exit_batch+0x986/0xa00 net/core/dev.c:13120
 ops_exit_list net/core/net_namespace.c:205 [inline]
 ops_undo_list+0x52b/0x940 net/core/net_namespace.c:252
 cleanup_net+0x56b/0x800 net/core/net_namespace.c:702
 process_one_work kernel/workqueue.c:3288 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3371
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3452
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
1 lock held by kworker/R-mm_pe/14:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2761 [inline]
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3623
1 lock held by khungtaskd/30:
 #0: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #0: ffffffff8e95d020 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
4 locks held by kworker/u8:3/43:
 #0: ffff88801be9e940 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3263 [inline]
 #0: ffff88801be9e940 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3371
 #1: ffffc90000b37c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3264 [inline]
 #1: ffffc90000b37c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3371
 #2: ffffffff8fdc01c8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 net/core/net_namespace.c:673
 #3: ffff888093865550 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_destruct+0x116/0x310 drivers/net/wireguard/device.c:249
2 locks held by kworker/0:2/797:
 #0: ffff88813fe53140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3263 [inline]
 #0: ffff88813fe53140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3371
 #1: ffffc90004697c40 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3264 [inline]
 #1: ffffc90004697c40 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3371
2 locks held by getty/5579:
 #0: ffff88803679d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 drivers/tty/n_tty.c:2211
2 locks held by kworker/1:14/7353:
2 locks held by kworker/1:2/14055:
2 locks held by kworker/1:3/14056:
2 locks held by kworker/1:4/14057:
3 locks held by kworker/1:7/14060:
2 locks held by kworker/1:8/14061:
3 locks held by syz-executor/23911:
 #0: ffff88807b340ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
 #0: ffff88807b340ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
 #1: ffff88807b3400b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5356
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2650
3 locks held by syz-executor/23914:
 #0: ffff888065e60ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
 #0: ffff888065e60ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
 #1: ffff888065e600b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5356
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2650
2 locks held by kworker/1:0/23937:
1 lock held by kworker/R-wg-cr/23945:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2761 [inline]
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3623
1 lock held by kworker/R-wg-cr/23946:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2703
1 lock held by kworker/R-wg-cr/23947:
2 locks held by kworker/1:1/23987:
5 locks held by syz-executor/24837:
 #0: ffff88804ef84ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
 #0: ffff88804ef84ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
 #1: ffff88804ef840b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5356
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2650
 #3: ffff88802179d2f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x92/0x570 net/bluetooth/l2cap_core.c:1777
 #4: ffffffff8e963328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
 #4: ffffffff8e963328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:961
3 locks held by syz-executor/24839:
 #0: ffff88804f5a0ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
 #0: ffff88804f5a0ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
 #1: ffff88804f5a00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5356
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2650
1 lock held by kworker/R-wg-cr/24924:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2703
1 lock held by kworker/R-wg-cr/24944:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2761 [inline]
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3623
1 lock held by kworker/R-wg-cr/24950:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2703
1 lock held by kworker/R-wg-cr/25809:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2703
1 lock held by kworker/R-wg-cr/25810:
1 lock held by kworker/R-wg-cr/25811:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2703
1 lock held by kworker/1:5/26430:
3 locks held by syz-executor/26492:
 #0: ffff88803db74ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
 #0: ffff88803db74ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
 #1: ffff88803db740b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5356
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
 #2: ffffffff8ff5c2a0 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2650
1 lock held by kworker/R-wg-cr/26558:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2761 [inline]
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3623
1 lock held by kworker/R-wg-cr/26560:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2761 [inline]
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3623
1 lock held by kworker/R-wg-cr/26563:
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2761 [inline]
 #0: ffffffff8e7fb4e0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3623
2 locks held by dhcpcd/26765:
 #0: ffff88805fff4260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff88805fff4260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe10 net/packet/af_packet.c:3199
 #1: ffffffff8e963328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
 #1: ffffffff8e963328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:961

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xfaa/0x1000 kernel/hung_task.c:515
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 25811 Comm: kworker/R-wg-cr Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: wg-crypt-wg2 wg_packet_decrypt_worker
RIP: 0010:unwind_next_frame+0x18/0x2550 arch/x86/kernel/unwind_orc.c:485
Code: 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 55 41 57 41 56 41 55 41 54 53 48 81 ec 98 00 00 00 49 89 fe <48> bd 00 00 00 00 00 fc ff df 48 8d 5f 48 48 89 d8 48 c1 e8 03 48
RSP: 0018:ffffc90000a084d8 EFLAGS: 00000296
RAX: 0000000000000001 RBX: ffffc90000a08660 RCX: 0000000080000100
RDX: dffffc0000000000 RSI: ffffffff8a9c9339 RDI: ffffc90000a085a8
RBP: ffffc90000a08630 R08: ffffc90000a08670 R09: 0000000000000008
R10: ffffc90000a085f8 R11: ffffffff81b0a9b0 R12: ffff888025560000
R13: 00000000000002c0 R14: ffffc90000a085a8 R15: ffffc90000a085a8
FS:  0000000000000000(0000) GS:ffff888125345000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000338 CR3: 000000004b486000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4538 [inline]
 slab_alloc_node mm/slub.c:4866 [inline]
 kmem_cache_alloc_node_noprof+0x384/0x690 mm/slub.c:4918
 kmalloc_reserve net/core/skbuff.c:613 [inline]
 __alloc_skb+0x27d/0x7d0 net/core/skbuff.c:713
 skb_copy+0x188/0x800 net/core/skbuff.c:2182
 can_can_gw_rcv+0x46d/0xf70 net/can/gw.c:507
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0x126/0x7a0 net/can/af_can.c:602
 can_receive+0x2c6/0x440 net/can/af_can.c:674
 can_rcv+0x1f9/0x330 net/can/af_can.c:699
 __netif_receive_skb_one_core net/core/dev.c:6209 [inline]
 __netif_receive_skb net/core/dev.c:6322 [inline]
 process_backlog+0xc66/0x1950 net/core/dev.c:6673
 __napi_poll+0xae/0x340 net/core/dev.c:7737
 napi_poll net/core/dev.c:7800 [inline]
 net_rx_action+0x627/0xf70 net/core/dev.c:7957
 handle_softirqs+0x22a/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:sg_nents+0x0/0xd0 lib/scatterlist.c:26
Code: 38 c1 7c d7 48 89 df e8 5e 73 84 fd eb cd cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <f3> 0f 1e fa 41 57 41 56 41 54 53 49 89 fe e8 2d a6 18 fd 4d 85 f6
RSP: 0018:ffffc90003ae71b8 EFLAGS: 00000293
RAX: ffffffff84b2a649 RBX: ffffc90003ae7680 RCX: ffff888025560000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003ae7680
RBP: ffffc90003ae7550 R08: ffffc90003ae701f R09: 0000000000000000
R10: ffffc90003ae6fe0 R11: fffff5200075ce04 R12: ffffc90003ae7240
R13: 0000000000000000 R14: 0000000000000030 R15: ffffc90003ae7430
 chacha20poly1305_crypt_sg_inplace+0x54f/0xe60 lib/crypto/chacha20poly1305.c:258
 chacha20poly1305_decrypt_sg_inplace+0x5a/0x80 lib/crypto/chacha20poly1305.c:353
 decrypt_packet drivers/net/wireguard/receive.c:278 [inline]
 wg_packet_decrypt_worker+0x5d3/0xd80 drivers/net/wireguard/receive.c:501
 process_one_work kernel/workqueue.c:3288 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3371
 rescuer_thread+0x827/0x1130 kernel/workqueue.c:3595
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>