INFO: task kworker/u8:0:12 blocked for more than 145 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:0    state:D stack:24184 pid:12    tgid:12    ppid:2      task_flags:0x4208160 flags:0x00080000
Workqueue: ipv6_addrconf addrconf_verify_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7376
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xccb/0x1bd0 kernel/locking/mutex.c:821
 rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4770
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
locks held by kworker/u8:0/12: 3, on CPU#0:
 #0: ffff8880329fa140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000117d08 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 #2: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4770
locks held by kworker/u8:1/13: 2, last CPU#1:
 #0: ffff88801c093940 ((wq_completion)events_dfl_long){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000127d08 ((work_completion)(&(&ipvs->defense_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
locks held by pr/ttyS0/16: 1, last CPU#1:
 #0: ffffffff8edd88b8 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline]
 #0: ffffffff8edd88b8 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline]
 #0: ffffffff8edd88b8 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x49/0x60 kernel/printk/printk.c:291
locks held by kworker/1:0/25: 4, last CPU#1:
 #0: ffff888066f00d40 ((wq_completion)wg-kex-wg0#6){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc900001f7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88807cb71440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xc5/0x5f0 drivers/net/wireguard/noise.c:678
 #3: ffff88802ceab4b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xd8/0x5f0 drivers/net/wireguard/noise.c:679
locks held by khungtaskd/32: 1, last CPU#1:
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by kworker/u8:2/43: 3, last CPU#1:
 #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000b37d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff8880222ba258 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834
locks held by kworker/u8:3/50: 3, last CPU#0:
 #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000ba7d08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff888029f22258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834
locks held by kworker/u8:7/153: 4, last CPU#1:
 #0: ffff88807607d940 ((wq_completion)wg-kex-wg2#7){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90002e87d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff888026c69440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88807e438d18 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by kworker/1:2/1216: 3, on CPU#1:
 #0: ffff88801c05b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc900056ffd08 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
locks held by kworker/u8:12/1471: 6, last CPU#0:
 #0: ffff88803314c140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90005fcfd08 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: local_lock_release include/linux/local_lock_internal.h:62 [inline]
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x437/0x1600 net/core/dev.c:6759
 #3: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:249 [inline]
 #3: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK include/linux/netfilter.h:323 [inline]
 #3: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: __br_forward+0x21f/0x970 net/bridge/br_forward.c:115
 #4: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: ebt_do_table+0xe8/0x2250 net/bridge/netfilter/ebtables.c:214
 #5: ffffffff9bb56940 (&obj_hash[i].lock){-.-.}-{2:2}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #5: ffffffff9bb56940 (&obj_hash[i].lock){-.-.}-{2:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #5: ffffffff9bb56940 (&obj_hash[i].lock){-.-.}-{2:2}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 #5: ffffffff9bb56940 (&obj_hash[i].lock){-.-.}-{2:2}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495
locks held by kworker/u8:16/3389: 4, last CPU#0:
 #0: ffff888076078940 ((wq_completion)wg-kex-wg0#9){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc9000fdf7d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff888034f51440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88807e43f028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by klogd/4963: 2, last CPU#1:
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495
locks held by udevd/4974: 2, last CPU#1:
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495
locks held by dhcpcd/5268: 2, last CPU#0:
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495
locks held by dhcpcd/5269: 5, last CPU#1:
 #0: ffffffff8ef3deb0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline]
 #0: ffffffff8ef3deb0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline]
 #0: ffffffff8ef3deb0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x4816/0x8380 kernel/fork.c:2311
 #1: ffff88807cbb2800 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
 #1: ffff88807cbb2800 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716
 #2: ffff88802d5bf180 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
 #2: ffff88802d5bf180 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723
 #3: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #3: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #3: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
 #4: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #4: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #4: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: page_ext_get+0x25/0x1a0 mm/page_ext.c:522
locks held by kworker/0:3/5341: 4, last CPU#0:
 #0: ffff88807c0c2d40 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90003087d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88807c5e5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xc5/0x5f0 drivers/net/wireguard/noise.c:678
 #3: ffff88802cea9700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xd8/0x5f0 drivers/net/wireguard/noise.c:679
locks held by getty/5361: 2, on CPU#1:
 #0: ffff888031dcc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000321e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0 drivers/tty/n_tty.c:2211
locks held by syz-executor/5592: 2, last CPU#0:
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #0: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 #1: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495
locks held by kworker/1:3/5815: 4, last CPU#1:
 #0: ffff88807d629140 ((wq_completion)wg-kex-wg0#8){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90003207d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88807adbd440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xc5/0x5f0 drivers/net/wireguard/noise.c:678
 #3: ffff88807e43b4b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_response+0xd8/0x5f0 drivers/net/wireguard/noise.c:679
locks held by syz-executor/5834: 1, on CPU#0:
 #0: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:650 [inline]
 #0: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3587
locks held by syz-executor/5835: 1, on CPU#0:
 #0: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:650 [inline]
 #0: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3587
locks held by kworker/1:6/5997: 4, on CPU#1:
 #0: ffff88807c0c2d40 ((wq_completion)wg-kex-wg2#6){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc9000250fd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88807c5e5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
 #3: ffff88802cea9700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632
locks held by kworker/0:5/6092: 2, last CPU#0:
 #0: ffff88801c059d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90003747d08 ((work_completion)(&(&tbl->gc_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
locks held by syz-executor/15547: 1, last CPU#0:
 #0: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:650 [inline]
 #0: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3587
locks held by kworker/u8:5/15551: 4, last CPU#1:
 #0: ffff888078c0b940 ((wq_completion)wg-kex-wg0){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc9000772fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88807ccb9440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88807e4ab4b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by kworker/u8:6/15552: 3, on CPU#1:
 #0: ffff88801c094140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90006f77d08 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffffffff90cd4880 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:313
locks held by syz-executor/15554: 4, last CPU#1:
 #0: ffffffff8ef3deb0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline]
 #0: ffffffff8ef3deb0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline]
 #0: ffffffff8ef3deb0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x4816/0x8380 kernel/fork.c:2311
 #1: ffff888034f9f180 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
 #1: ffff888034f9f180 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716
 #2: ffff88802d5be540 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
 #2: ffff88802d5be540 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723
 #3: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #3: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #3: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
locks held by kworker/u8:8/15555: 4, last CPU#0:
 #0: ffff8880227a0140 ((wq_completion)wg-kex-wg2#9){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90007947d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88802236d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88807e43c888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by syz-executor/15556: 3, last CPU#1:
 #0: ffffffff8f90af38 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #0: ffffffff8f90af38 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #0: ffffffff8f90af38 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1112 [inline]
 #0: ffffffff8f90af38 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_check_open_permission+0x169/0x3c0 security/tomoyo/file.c:772
 #1: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #1: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #1: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 #2: ffffffff8edec5a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xbd/0x2090 arch/x86/kernel/unwind_orc.c:495
locks held by kworker/u8:9/15559: 4, last CPU#1:
 #0: ffff88807afc3940 ((wq_completion)wg-kex-wg2){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90007affd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff8880265bd440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88807e4a8330 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by syz-executor/15560: 2, last CPU#1:
 #0: ffffffff8f90af38 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #0: ffffffff8f90af38 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #0: ffffffff8f90af38 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1112 [inline]
 #0: ffffffff8f90af38 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_check_open_permission+0x169/0x3c0 security/tomoyo/file.c:772
 #1: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
 #1: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline]
 #1: ffffffff8effd698 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
locks held by kworker/u8:11/15561: 4, last CPU#0:
 #0: ffff888078c0e940 ((wq_completion)wg-kex-wg0#7){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000bc7d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88807adbd440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88807e43bea0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by kworker/u8:14/15566: 4, last CPU#0:
 #0: ffff8880227a0140 ((wq_completion)wg-kex-wg2#9){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc900056bfd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88802236d440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88807e43d270 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by kworker/u8:15/15567: 4, last CPU#1:
 #0: ffff88807afc3140 ((wq_completion)wg-kex-wg1){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90003e27d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88807eec1440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88807e4aa0e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by kworker/u8:17/15568: 4, on CPU#1:
 #0: ffff8880227a1140 ((wq_completion)wg-kex-wg2#5){+.+.}-{0:0}, at: process_one_work+0x1466/0x1b10 kernel/workqueue.c:3371
 #1: ffffc90000a57d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3372
 #2: ffff88807c5e5440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88802cea9700 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 1471 Comm: kworker/u8:12 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: bat_events batadv_dat_purge
RIP: 0010:__find_rr_leaf+0xcd/0x1040 net/ipv6/route.c:851
Code: 48 89 84 24 08 01 00 00 48 c7 c0 80 f2 a0 8e 4c 89 64 24 48 48 c1 e8 03 4c 01 e8 48 89 44 24 30 e9 8d 03 00 00 e8 b3 d3 8c f7 <4c> 8d bb c0 00 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 1f
RSP: 0018:ffffc900000069e8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff88802cd5e400 RCX: 0000000000000101
RDX: ffff88802abbcb00 RSI: ffffffff8a7f749d RDI: ffff88802abbcb00
RBP: ffff88802cd5e464 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000100
FS:  0000000000000000(0000) GS:ffff888123b4f000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000560d1cf7ecf0 CR3: 000000000eb96000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 find_rr_leaf net/ipv6/route.c:894 [inline]
 rt6_select net/ipv6/route.c:938 [inline]
 fib6_table_lookup+0x50f/0xa10 net/ipv6/route.c:2261
 ip6_pol_route+0x1d5/0x1310 net/ipv6/route.c:2298
 pol_lookup_func include/net/ip6_fib.h:670 [inline]
 fib6_rule_lookup+0x537/0x720 net/ipv6/fib6_rules.c:123
 ip6_route_input_lookup net/ipv6/route.c:2369 [inline]
 ip6_route_input+0x662/0xc50 net/ipv6/route.c:2672
 ip6_rcv_finish_core.isra.0+0x1b1/0x1260 net/ipv6/ip6_input.c:106
 ip6_rcv_finish+0x130/0x300 net/ipv6/ip6_input.c:117
 ip_sabotage_in+0x21e/0x290 net/bridge/br_netfilter_hooks.c:988
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xbf/0x220 net/netfilter/core.c:619
 nf_hook.constprop.0+0x2a6/0x750 include/linux/netfilter.h:280
 NF_HOOK include/linux/netfilter.h:323 [inline]
 ipv6_rcv+0xa4/0x3d0 net/ipv6/ip6_input.c:351
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6297
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6410
 netif_receive_skb_internal net/core/dev.c:6496 [inline]
 netif_receive_skb+0x139/0x7d0 net/core/dev.c:6555
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70
 br_handle_frame_finish+0xa6b/0x1f70 net/bridge/br_input.c:235
 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1165
 br_nf_pre_routing_finish_ipv6+0x659/0xdd0 net/bridge/br_netfilter_ipv6.c:153
 NF_HOOK include/linux/netfilter.h:325 [inline]
 br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:183
 br_nf_pre_routing+0x90f/0x1560 net/bridge/br_netfilter_hooks.c:513
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xd59/0x1670 net/bridge/br_input.c:451
 __netif_receive_skb_core.constprop.0+0x6c5/0x3530 net/core/dev.c:6184
 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6295
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6410
 process_backlog+0x487/0x1600 net/core/dev.c:6761
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7830
 napi_poll net/core/dev.c:7893 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:8050
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 do_softirq kernel/softirq.c:546 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:533
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 __batadv_dat_purge.part.0+0x294/0x3c0 net/batman-adv/distributed-arp-table.c:252
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:233 [inline]
 batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:271
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
net_ratelimit: 25160 callbacks suppressed
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)