INFO: task kworker/1:4:5838 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:4 state:D stack:25064 pid:5838 tgid:5838 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events reg_todo Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1190/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x818/0x1060 kernel/locking/mutex.c:760 class_wiphy_constructor include/net/cfg80211.h:6358 [inline] reg_process_self_managed_hints+0x9e/0x210 net/wireless/reg.c:3179 reg_todo+0x66f/0x900 net/wireless/reg.c:3192 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c2/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/1:6:5918 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:6 state:D stack:27688 pid:5918 tgid:5918 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_power_efficient crda_timeout_work Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1190/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x818/0x1060 kernel/locking/mutex.c:760 crda_timeout_work+0x15/0x50 net/wireless/reg.c:541 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c2/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 1 lock held by kthreadd/2: 1 lock held by kworker/0:0/9: 2 locks held by kworker/0:1/10: 3 locks held by kworker/u8:0/12: 3 locks held by kworker/u8:1/13: 1 lock held by kworker/R-mm_pe/14: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 3 locks held by kworker/1:0/24: 3 locks held by kdevtmpfs/26: 1 lock held by khungtaskd/31: #0: ffffffff8e3c4320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e3c4320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e3c4320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775 3 locks held by kworker/u8:2/36: 1 lock held by kworker/1:1/43: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2678 3 locks held by kworker/u8:3/50: 7 locks held by kworker/u8:4/60: 3 locks held by kworker/u8:5/143: 3 locks held by kworker/u8:6/1095: 3 locks held by kworker/u8:7/1112: 3 locks held by kworker/u8:8/1150: 3 locks held by kworker/u8:9/1170: 2 locks held by kworker/0:2/1213: 3 locks held by kworker/1:2/2155: #0: ffff88813ff1a948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238 #1: ffffc90004ff7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239 #2: ffffffff900fdf48 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x91/0x11f0 net/wireless/reg.c:2453 3 locks held by kworker/R-ipv6_/3186: #0: ffff88814c74a148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238 #1: ffffc9000bc37c98 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239 #2: ffffffff900fdf48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff900fdf48 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734 1 lock held by kworker/R-krxrp/3393: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 2 locks held by kworker/R-bat_e/3411: 5 locks held by kworker/u9:1/5150: #0: ffff88802846f948 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238 #1: ffffc9000ebafd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239 #2: ffff88807bb58dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331 #3: ffff88807bb580b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x13f/0xb20 net/bluetooth/hci_sync.c:5679 #4: ffffffff90370748 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2103 [inline] #4: ffffffff90370748 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x14f/0x330 net/bluetooth/hci_conn.c:1312 2 locks held by klogd/5188: 5 locks held by udevd/5199: 1 lock held by dhcpcd/5493: 2 locks held by dhcpcd/5494: 1 lock held by crond/5571: 2 locks held by getty/5587: #0: ffff8880310bc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222 2 locks held by syz-executor/5816: 7 locks held by kworker/u9:2/5831: #0: ffff888028b4d148 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238 #1: ffffc90003fffd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239 #2: ffff88807c5e0dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331 #3: ffff88807c5e00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x13f/0xb20 net/bluetooth/hci_sync.c:5679 #4: ffffffff90370748 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2103 [inline] #4: ffffffff90370748 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x14f/0x330 net/bluetooth/hci_conn.c:1312 #5: ffff88814375eb38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x730 net/bluetooth/l2cap_core.c:1762 #6: ffffffff8e3cf8b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 kernel/rcu/tree_exp.h:343 1 lock held by syz-executor/5833: 1 lock held by syz-executor/5836: 3 locks held by kworker/1:3/5837: 4 locks held by kworker/1:4/5838: #0: ffff88813ff19948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238 #1: ffffc9000405fd00 (reg_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239 #2: ffffffff900fdf48 (rtnl_mutex){+.+.}-{4:4}, at: reg_todo+0x1c/0x900 net/wireless/reg.c:3189 #3: ffff88807aff0788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6358 [inline] #3: ffff88807aff0788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0x9e/0x210 net/wireless/reg.c:3179 5 locks held by kworker/u9:3/5840: #0: ffff888028ed3148 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238 #1: ffffc9000409fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239 #2: ffff888034d98dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331 #3: ffff888034d980b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x13f/0xb20 net/bluetooth/hci_sync.c:5679 #4: ffffffff90370748 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2103 [inline] #4: ffffffff90370748 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x14f/0x330 net/bluetooth/hci_conn.c:1312 3 locks held by syz-executor/5845: 1 lock held by kworker/R-wg-cr/5858: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5859: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5860: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5861: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5862: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5863: 1 lock held by kworker/R-wg-cr/5865: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5866: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5868: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5869: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 1 lock held by kworker/R-wg-cr/5870: 1 lock held by kworker/R-wg-cr/5871: #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline] #0: ffffffff8e27a148 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556 4 locks held by kworker/0:3/5878: 2 locks held by kworker/0:4/5897: 2 locks held by kworker/1:5/5898: 3 locks held by kworker/1:6/5918: #0: ffff88813ff1a948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238 #1: ffffc9000458fd00 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239 #2: ffffffff900fdf48 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x15/0x50 net/wireless/reg.c:541 2 locks held by syz.1.8/5952: 3 locks held by syz.0.14/5965: #0: ffffffff8f051648 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8f051648 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x53d/0xf90 drivers/tty/tty_io.c:2120 #1: ffff8880296b21c0 (&tty->legacy_mutex){+.+.}-{4:4}, at: tty_init_dev.part.0+0x37/0x500 drivers/tty/tty_io.c:1406 #2: ffffffff8e3b1980 (console_lock){+.+.}-{0:0}, at: class_console_lock_constructor include/linux/console.h:669 [inline] #2: ffffffff8e3b1980 (console_lock){+.+.}-{0:0}, at: con_install+0x99/0x600 drivers/tty/vt/vt.c:3647 4 locks held by kworker/u8:10/5968: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline] watchdog+0xf3f/0x1170 kernel/hung_task.c:495 kthread+0x3c2/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:kernel_text_address+0x4/0x100 kernel/extable.c:95 Code: 83 90 89 44 24 04 e8 8b d7 9e 00 8b 44 24 04 eb a9 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 <53> 48 89 fb 48 83 ec 08 48 81 ff 00 00 00 81 72 18 48 81 ff 30 c7 RSP: 0018:ffffc90000a08288 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffffffff89371dc5 RCX: ffffc90000a0820c RDX: 1ffff92000141060 RSI: ffffffff8dad99d8 RDI: ffffffff89371dc5 RBP: ffffc90000a08300 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000004 R11: 0000000000093177 R12: ffffffff81a6e560 R13: ffffc90000a08378 R14: 0000000000000000 R15: ffff88801d2cdac0 FS: 0000000000000000(0000) GS:ffff888124ae7000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe0874a8ac CR3: 00000000760ee000 CR4: 00000000003526f0 Call Trace: __kernel_text_address+0xd/0x40 kernel/extable.c:79 unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:369 arch_stack_walk+0xa6/0x100 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:56 kasan_save_track+0x14/0x30 mm/kasan/common.c:77 unpoison_slab_object mm/kasan/common.c:342 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:368 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4946 [inline] slab_alloc_node mm/slub.c:5245 [inline] kmem_cache_alloc_noprof+0x250/0x6e0 mm/slub.c:5252 __skb_ext_alloc+0x1a/0x80 net/core/skbuff.c:6982 skb_ext_add+0x232/0x7a0 net/core/skbuff.c:7086 nf_bridge_alloc include/net/netfilter/br_netfilter.h:12 [inline] br_nf_pre_routing_ipv6+0xca/0x8c0 net/bridge/br_netfilter_ipv6.c:172 br_nf_pre_routing+0x860/0x15b0 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0xad8/0x14b0 net/bridge/br_input.c:442 __netif_receive_skb_core.constprop.0+0xa25/0x4bd0 net/core/dev.c:5966 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6077 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6192 process_backlog+0x439/0x15e0 net/core/dev.c:6544 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:7594 napi_poll net/core/dev.c:7657 [inline] net_rx_action+0x97f/0xef0 net/core/dev.c:7784 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622 do_softirq kernel/softirq.c:523 [inline] do_softirq+0xb2/0xf0 kernel/softirq.c:510 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] cfg80211_inform_single_bss_data+0x9ae/0x1df0 net/wireless/scan.c:2401 cfg80211_inform_bss_data+0x22b/0x3be0 net/wireless/scan.c:3240 cfg80211_inform_bss_frame_data+0x26f/0x750 net/wireless/scan.c:3331 ieee80211_bss_info_update+0x310/0xab0 net/mac80211/scan.c:226 ieee80211_rx_bss_info net/mac80211/ibss.c:1094 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1573 [inline] ieee80211_ibss_rx_queued_mgmt+0x191b/0x2fe0 net/mac80211/ibss.c:1600 ieee80211_iface_process_skb net/mac80211/iface.c:1694 [inline] ieee80211_iface_work+0xe2e/0x1360 net/mac80211/iface.c:1748 cfg80211_wiphy_work+0x2c4/0x580 net/wireless/core.c:435 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c2/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245