INFO: task syz.3.2889:16945 blocked for more than 144 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.2889 state:D stack:28744 pid:16945 tgid:16942 ppid:5808 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0xdd/0x390 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776 device_lock include/linux/device.h:895 [inline] usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 chrdev_open+0x234/0x6a0 fs/char_dev.c:414 do_dentry_open+0x73e/0x1570 fs/open.c:962 vfs_open+0x82/0x3f0 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x21dc/0x3120 fs/namei.c:4796 do_filp_open+0x1f7/0x420 fs/namei.c:4823 do_sys_openat2+0x12e/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2fe6f5b78e RSP: 002b:00007f2fe51f5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f2fe51f66c0 RCX: 00007f2fe6f5b78e RDX: 0000000000101301 RSI: 00007f2fe51f5c00 RDI: ffffffffffffff9c RBP: 00007f2fe51f5c00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd R13: 00007f2fe7216038 R14: 00007f2fe7215fa0 R15: 00007ffc41929058 Showing all locks held in the system: 1 lock held by kworker/R-kvfre/6: 4 locks held by kworker/u8:0/12: 4 locks held by kworker/u8:1/13: 1 lock held by kworker/R-mm_pe/14: #0: ffffffff8e490c68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2730 [inline] #0: ffffffff8e490c68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x6bb/0xf40 kernel/workqueue.c:3560 1 lock held by khungtaskd/31: #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 2 locks held by kworker/u8:2/36: 3 locks held by kworker/1:1/48: 4 locks held by kworker/u8:3/50: 3 locks held by kworker/u8:4/63: 7 locks held by kworker/1:2/793: 4 locks held by kworker/u8:5/1314: 4 locks held by kworker/u8:6/2154: 4 locks held by kworker/1:3/2229: 3 locks held by kworker/R-ipv6_/3180: #0: ffff888031695948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000bd57c20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffffffff903f3328 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff903f3328 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734 2 locks held by kworker/R-bat_e/3405: 4 locks held by kworker/u8:7/4330: 2 locks held by klogd/5169: 2 locks held by udevd/5180: 1 lock held by dhcpcd/5475: 2 locks held by crond/5549: 2 locks held by getty/5565: #0: ffff88814cf640a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 2 locks held by syz-executor/5793: 5 locks held by kworker/u9:6/5819: #0: ffff888023398148 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc900042cfc98 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88804a4ccec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 net/bluetooth/hci_sync.c:331 #3: ffff88804a4cc0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x141/0xb20 net/bluetooth/hci_sync.c:5703 #4: ffffffff8e5efab8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343 4 locks held by kworker/1:4/5867: #0: ffff88805939dd48 ((wq_completion)wg-kex-wg2#14){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc90004d7fc98 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff8880a09e1308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff88807ab44890 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 2 locks held by kworker/0:4/5881: 2 locks held by kworker/0:8/5964: 4 locks held by kworker/u8:8/6066: 4 locks held by kworker/u8:9/6525: 4 locks held by kworker/u8:10/6670: 4 locks held by udevd/7138: #0: ffff88804bfbf9e0 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x1270 fs/seq_file.c:182 #1: ffff888054f03c88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 fs/kernfs/file.c:172 #2: ffff88805e5e3c38 (kn->active#22){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88805e5e3c38 (kn->active#22){.+.+}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 fs/kernfs/file.c:173 #3: ffff88802ad72198 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:900 [inline] #3: ffff88802ad72198 (&dev->mutex){....}-{4:4}, at: serial_show+0x26/0xa0 drivers/usb/core/sysfs.c:143 3 locks held by kworker/u8:11/8746: 4 locks held by kworker/u8:12/8748: 3 locks held by kworker/u8:13/8749: 3 locks held by kworker/u8:14/8750: 4 locks held by kworker/1:6/9397: #0: ffff88813fe52948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000b647c98 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffffffff903f3328 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x91/0x10e0 net/wireless/reg.c:2453 #3: ffff888036af8788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6360 [inline] #3: ffff888036af8788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_leave_invalid_chans net/wireless/reg.c:2441 [inline] #3: ffff888036af8788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_check_chans_work+0x12c/0x10e0 net/wireless/reg.c:2456 1 lock held by syz-executor/10280: 4 locks held by kworker/u8:15/11190: 4 locks held by kworker/u8:16/11191: 3 locks held by kworker/u8:17/11193: 4 locks held by kworker/u8:18/13943: #0: ffff888028c93148 ((wq_completion)wg-kex-wg1){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232 #1: ffffc9000413fc98 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233 #2: ffff88805a711308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff88807ba2c890 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 3 locks held by kworker/u8:19/13949: 4 locks held by kworker/1:0/14831: 1 lock held by syz-executor/16484: 4 locks held by udevd/16632: 5 locks held by udevd/16655: 1 lock held by syz.3.2889/16945: #0: ffff888144b90198 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline] #0: ffff888144b90198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x870 drivers/usb/core/devio.c:1054 4 locks held by syz.6.2890/16953: 4 locks held by kworker/1:7/16958: 4 locks held by kworker/1:8/16959: 1 lock held by kworker/u8:20/16960: ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xcc3/0xfe0 kernel/hung_task.c:515 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6670 Comm: kworker/u8:10 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026 Workqueue: wg-kex-wg2 wg_packet_handshake_send_worker RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:81 [inline] RIP: 0010:__orc_find+0x70/0xf0 arch/x86/kernel/unwind_orc.c:103 Code: ec 72 4e 4c 89 e2 48 29 ea 48 89 d6 48 c1 ea 3f 48 c1 fe 02 48 01 f2 48 d1 fa 48 8d 5c 95 00 48 89 da 48 c1 ea 03 0f b6 34 0a <48> 89 da 83 e2 07 83 c2 03 40 38 f2 7c 05 40 84 f6 75 4b 48 63 13 RSP: 0018:ffffc90000007208 EFLAGS: 00000a02 RAX: ffffffff91b028b8 RBX: ffffffff910bfd58 RCX: dffffc0000000000 RDX: 1ffffffff2217fab RSI: 0000000000000000 RDI: ffffffff910bfd44 RBP: ffffffff910bfd54 R08: ffffffff91b028e2 R09: 0000000000000007 R10: 0000000000000200 R11: 0000000000058af1 R12: ffffffff910bfd5c R13: ffffffff868af1eb R14: ffffffff910bfd44 R15: ffffffff910bfd50 FS: 0000000000000000(0000) GS:ffff8881245db000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4e42e00218 CR3: 0000000075ad0000 CR4: 00000000003526f0 Call Trace: orc_find arch/x86/kernel/unwind_orc.c:238 [inline] unwind_next_frame+0x2ec/0x1ea0 arch/x86/kernel/unwind_orc.c:510 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_noprof+0x2ad/0x780 mm/slub.c:5270 __skb_ext_alloc+0x1a/0x80 net/core/skbuff.c:7026 skb_ext_add+0x3dd/0x7e0 net/core/skbuff.c:7130 nf_bridge_alloc include/net/netfilter/br_netfilter.h:12 [inline] br_nf_pre_routing_ipv6+0xc7/0x8b0 net/bridge/br_netfilter_ipv6.c:172 br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0xa68/0x1510 net/bridge/br_input.c:442 __netif_receive_skb_core.constprop.0+0x6d7/0x3460 net/core/dev.c:6039 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6150 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6265 process_backlog+0x37a/0x1580 net/core/dev.c:6617 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0xa40/0xf20 net/core/dev.c:7896 handle_softirqs+0x1ea/0x910 kernel/softirq.c:622 do_softirq kernel/softirq.c:523 [inline] do_softirq+0xac/0xe0 kernel/softirq.c:510 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450 local_bh_enable include/linux/bottom_half.h:33 [inline] fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline] kernel_fpu_end arch/x86/kernel/fpu/core.c:506 [inline] kernel_fpu_end+0x64/0x80 arch/x86/kernel/fpu/core.c:499 blake2s_compress+0x78/0xf0 lib/crypto/x86/blake2s.h:42 blake2s_final+0xc9/0x160 lib/crypto/blake2s.c:142 blake2s.constprop.0+0x181/0x210 include/crypto/blake2s.h:157 compute_mac1 drivers/net/wireguard/cookie.c:80 [inline] wg_cookie_add_mac_to_packet+0x51/0x1c0 drivers/net/wireguard/cookie.c:163 wg_packet_send_handshake_initiation+0x1c6/0x360 drivers/net/wireguard/send.c:35 wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257 process_scheduled_works kernel/workqueue.c:3340 [inline] worker_thread+0x5da/0xe40 kernel/workqueue.c:3421 kthread+0x3b3/0x730 kernel/kthread.c:463 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 net_ratelimit: 21842 callbacks suppressed bridge0: received packet on veth0_to_bridge with own address as source address (addr:46:4a:25:63:b5:bb, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:46:4a:25:63:b5:bb, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:46:4a:25:63:b5:bb, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) net_ratelimit: 21839 callbacks suppressed bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:46:4a:25:63:b5:bb, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth0_to_bridge with own address as source address (addr:46:4a:25:63:b5:bb, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)