INFO: task kworker/1:1:43 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:1 state:D stack:20672 pid:43 tgid:43 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 reg_check_chans_work+0xa1/0xee0 net/wireless/reg.c:2453 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x52d/0xa60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/u8:3:50 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:3 state:D stack:22072 pid:50 tgid:50 ppid:2 task_flags:0x4208160 flags:0x00080000 Workqueue: ipv6_addrconf addrconf_verify_work Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 rtnl_net_lock include/linux/rtnetlink.h:130 [inline] addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x52d/0xa60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/u8:18:11580 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:18 state:D stack:22032 pid:11580 tgid:11580 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 linkwatch_event+0xe/0x60 net/core/link_watch.c:303 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x52d/0xa60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.0.3474:15875 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.3474 state:D stack:24760 pid:15875 tgid:15875 ppid:14226 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 tun_detach drivers/net/tun.c:634 [inline] tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2c7/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fae5cd8f749 RSP: 002b:00007fae5d10fb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fae5cfe7da0 RCX: 00007fae5cd8f749 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fae5cfe7da0 R08: 00000000000009d8 R09: 0000001d5d10fe7f R10: 00007fae5cfe7cb0 R11: 0000000000000246 R12: 0000000000089154 R13: 00007fae5cfe6270 R14: ffffffffffffffff R15: 00007fae5d10fca0 INFO: task syz.2.3478:15889 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.3478 state:D stack:24760 pid:15889 tgid:15889 ppid:12730 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 tun_detach drivers/net/tun.c:634 [inline] tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2c7/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff68a18f749 RSP: 002b:00007ff68a50fb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ff68a3e7da0 RCX: 00007ff68a18f749 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff68a3e7da0 R08: 0000000000001720 R09: 0000001d8a50fe7f R10: 00007ff68a3e7cb0 R11: 0000000000000246 R12: 00000000000896bc R13: 00007ff68a3e6450 R14: ffffffffffffffff R15: 00007ff68a50fca0 INFO: task syz.2.3478:15892 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.3478 state:D stack:25224 pid:15892 tgid:15889 ppid:12730 task_flags:0x400140 flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnl_nets_lock net/core/rtnetlink.c:341 [inline] rtnl_newlink+0x8e9/0x1c80 net/core/rtnetlink.c:4064 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6951 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:733 ____sys_sendmsg+0x505/0x820 net/socket.c:2608 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2662 __sys_sendmsg net/socket.c:2694 [inline] __do_sys_sendmsg net/socket.c:2699 [inline] __se_sys_sendmsg net/socket.c:2697 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2697 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff68a18f749 RSP: 002b:00007ff68afc8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ff68a3e6180 RCX: 00007ff68a18f749 RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000006 RBP: 00007ff68a213f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff68a3e6218 R14: 00007ff68a3e6180 R15: 00007ff68a50fa28 INFO: task syz.2.3478:15902 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.3478 state:D stack:25040 pid:15902 tgid:15889 ppid:12730 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnetlink_rcv_msg+0x71c/0xb70 net/core/rtnetlink.c:6957 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:733 ____sys_sendmsg+0x505/0x820 net/socket.c:2608 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2662 __sys_sendmsg net/socket.c:2694 [inline] __do_sys_sendmsg net/socket.c:2699 [inline] __se_sys_sendmsg net/socket.c:2697 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2697 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff68a18f749 RSP: 002b:00007ff68af86038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ff68a3e6360 RCX: 00007ff68a18f749 RDX: 0000000020000110 RSI: 0000200000000180 RDI: 000000000000000c RBP: 00007ff68a213f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff68a3e63f8 R14: 00007ff68a3e6360 R15: 00007ff68a50fa28 INFO: task syz.1.3480:15900 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.3480 state:D stack:24760 pid:15900 tgid:15900 ppid:14467 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 tun_detach drivers/net/tun.c:634 [inline] tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xe9/0x130 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x2c7/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f306158f749 RSP: 002b:00007f306190fb88 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f30617e7da0 RCX: 00007f306158f749 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f30617e7da0 R08: 00000000000110ac R09: 0000001d6190fe7f R10: 00007f30617e7cb0 R11: 0000000000000246 R12: 00000000000898ed R13: 00007f30617e6360 R14: ffffffffffffffff R15: 00007f306190fca0 INFO: task syz.1.3480:15906 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.3480 state:D stack:25224 pid:15906 tgid:15900 ppid:14467 task_flags:0x400140 flags:0x00080003 Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnl_nets_lock net/core/rtnetlink.c:341 [inline] rtnl_newlink+0x8e9/0x1c80 net/core/rtnetlink.c:4064 rtnetlink_rcv_msg+0x7cf/0xb70 net/core/rtnetlink.c:6951 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:733 ____sys_sendmsg+0x505/0x820 net/socket.c:2608 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2662 __sys_sendmsg net/socket.c:2694 [inline] __do_sys_sendmsg net/socket.c:2699 [inline] __se_sys_sendmsg net/socket.c:2697 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2697 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f306158f749 RSP: 002b:00007f3062448038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f30617e6180 RCX: 00007f306158f749 RDX: 0000000000000000 RSI: 0000200000000140 RDI: 0000000000000006 RBP: 00007f3061613f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f30617e6218 R14: 00007f30617e6180 R15: 00007f306190fa28 INFO: task syz.1.3480:15907 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.3480 state:D stack:24816 pid:15907 tgid:15900 ppid:14467 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5253 [inline] __schedule+0x17b2/0x4d40 kernel/sched/core.c:6861 __schedule_loop kernel/sched/core.c:6943 [inline] schedule+0x165/0x360 kernel/sched/core.c:6958 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7015 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnetlink_rcv_msg+0x71c/0xb70 net/core/rtnetlink.c:6957 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:733 ____sys_sendmsg+0x505/0x820 net/socket.c:2608 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2662 __sys_sendmsg net/socket.c:2694 [inline] __do_sys_sendmsg net/socket.c:2699 [inline] __se_sys_sendmsg net/socket.c:2697 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2697 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f306158f749 RSP: 002b:00007f3062427038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f30617e6270 RCX: 00007f306158f749 RDX: 0000000020000110 RSI: 0000200000000180 RDI: 000000000000000a RBP: 00007f3061613f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f30617e6308 R14: 00007f30617e6270 R15: 00007f306190fa28 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8df414c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8df414c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8df414c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 3 locks held by kworker/1:1/43: #0: ffff88801a056948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff88801a056948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3346 #1: ffffc90000b37b80 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc90000b37b80 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3346 #2: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xa1/0xee0 net/wireless/reg.c:2453 3 locks held by kworker/u8:3/50: #0: ffff88814cbcf948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff88814cbcf948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3346 #1: ffffc90000bb7b80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc90000bb7b80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3346 #2: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 7 locks held by kworker/u8:7/1153: 2 locks held by getty/5597: #0: ffff88814dee70a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 3 locks held by kworker/u8:18/11580: #0: ffff88801a069948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3238 [inline] #0: ffff88801a069948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3346 #1: ffffc9001bfbfb80 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3239 [inline] #1: ffffc9001bfbfb80 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3346 #2: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303 1 lock held by syz.0.3474/15875: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436 2 locks held by syz.3.3477/15887: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x7a4/0x1150 net/core/dev_ioctl.c:840 #1: ffff88807bb62d38 (&dev_instance_lock_key#14){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2765 [inline] #1: ffff88807bb62d38 (&dev_instance_lock_key#14){+.+.}-{4:4}, at: napi_disable+0x4e/0x80 net/core/dev.c:7508 1 lock held by syz.2.3478/15889: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436 1 lock held by syz.2.3478/15892: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8e9/0x1c80 net/core/rtnetlink.c:4064 1 lock held by syz.2.3478/15902: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 net/core/rtnetlink.c:6957 1 lock held by syz.1.3480/15900: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436 1 lock held by syz.1.3480/15906: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8e9/0x1c80 net/core/rtnetlink.c:4064 1 lock held by syz.1.3480/15907: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x71c/0xb70 net/core/rtnetlink.c:6957 1 lock held by syz.4.3486/15925: #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x83c/0x1150 net/core/dev_ioctl.c:867 2 locks held by syz-executor/15932: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15935: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15938: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15941: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15945: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15954: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15957: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15960: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15964: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15969: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15974: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15977: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15981: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15984: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 2 locks held by syz-executor/15996: #0: ffffffff8f2e55b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x3cc/0x570 net/core/net_namespace.c:576 #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #1: ffffffff8f2f2548 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2082 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline] watchdog+0xf3c/0xf80 kernel/hung_task.c:495 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x52d/0xa60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:hlock_class kernel/locking/lockdep.c:246 [inline] RIP: 0010:mark_lock+0x3e/0x190 kernel/locking/lockdep.c:4731 Code: 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 94 04 df 11 73 10 <48> 69 c0 c8 00 00 00 48 8d 88 70 63 1e 93 eb 42 83 3d 1b 94 e2 17 RSP: 0018:ffffc90000a089e0 EFLAGS: 00000007 RAX: 00000000000000b7 RBX: 0000000000000008 RCX: 0000000000000008 RDX: 0000000000000008 RSI: ffff88801ce9e6b0 RDI: ffff88801ce9db80 RBP: 0000000000000100 R08: ffffffff81916597 R09: ffff8880534265e8 R10: dffffc0000000000 R11: ffffffff81aeafa0 R12: ffffffffffffff03 R13: ffff88801ce9e6b0 R14: ffff88801ce9db80 R15: ffff88801ce9e6b0 FS: 0000000000000000(0000) GS:ffff8881261c5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f44edb17d60 CR3: 000000005ca96000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000006800 DR2: 0000000000009951 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: mark_usage kernel/locking/lockdep.c:4674 [inline] __lock_acquire+0x6b6/0x2cf0 kernel/locking/lockdep.c:5191 lock_acquire+0x117/0x340 kernel/locking/lockdep.c:5868 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:557 [inline] try_to_wake_up+0x67/0x12b0 kernel/sched/core.c:4109 hrtimer_wakeup+0x4e/0x60 kernel/time/hrtimer.c:2013 __run_hrtimer kernel/time/hrtimer.c:1777 [inline] __hrtimer_run_queues+0x51c/0xc30 kernel/time/hrtimer.c:1841 hrtimer_interrupt+0x45b/0xaa0 kernel/time/hrtimer.c:1903 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1044 [inline] __sysvec_apic_timer_interrupt+0x102/0x3e0 arch/x86/kernel/apic/apic.c:1061 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1055 [inline] sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1055 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:82 Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 63 14 22 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 RAX: aa4b7791a2c32300 RBX: ffffffff819729e7 RCX: aa4b7791a2c32300 RDX: 0000000000000001 RSI: ffffffff8d762d2a RDI: ffffffff8bbfa900 RBP: ffffc90000197f10 R08: ffff8880b893341b R09: 1ffff11017126683 R10: dffffc0000000000 R11: ffffed1017126684 R12: ffffffff8f801370 R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110039d3b70 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline] default_idle+0x13/0x20 arch/x86/kernel/process.c:767 default_idle_call+0x73/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:190 [inline] do_idle+0x1e7/0x510 kernel/sched/idle.c:330 cpu_startup_entry+0x44/0x60 kernel/sched/idle.c:428 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:315 common_startup_64+0x13e/0x147