INFO: task syz.2.2099:14706 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.2099 state:D stack:25416 pid:14706 tgid:14706 ppid:5620 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 tun_detach drivers/net/tun.c:650 [inline] tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3587 __fput+0x418/0xa50 fs/file_table.c:512 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x204/0x770 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff6b399e159 RSP: 002b:00007ffee8080138 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ff6b3c27da0 RCX: 00007ff6b399e159 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007ff6b3c27da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007ff6b3c27cb0 R11: 0000000000000246 R12: 0000000000056c0d R13: 00007ff6b3c2618c R14: 00007ff6b3c26188 R15: 00007ff6b3c26180 INFO: task syz.2.2099:14712 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.2099 state:D stack:28808 pid:14712 tgid:14706 ppid:5620 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5533 [inline] __schedule+0x17db/0x58f0 kernel/sched/core.c:7284 __schedule_loop kernel/sched/core.c:7361 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7376 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7433 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c1/0x1550 kernel/locking/mutex.c:821 __tun_chr_ioctl+0x3da/0x1e70 drivers/net/tun.c:3229 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff6b399e159 RSP: 002b:00007ff6b48ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ff6b3c26270 RCX: 00007ff6b399e159 RDX: 00002000000000c0 RSI: 00000000400454ca RDI: 0000000000000003 RBP: 00007ff6b3a3506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff6b3c26308 R14: 00007ff6b3c26270 R15: 00007ffee807ffd8 Showing all locks held in the system: locks held by kthreadd/2: 2, last CPU#0: #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by pool_workqueue_/3: 1, on CPU#0: #0: ffffffff8ed62ce8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #0: ffffffff8ed62ce8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770 kernel/rcu/tree_exp.h:966 locks held by kworker/u8:0/12: 3, last CPU#0: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057200800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6908 [inline] #2: ffff888057200800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:550 locks held by kworker/u8:1/13: 4, last CPU#0: #0: ffff8880369f7940 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880369f7940 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880369f7940 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880369f7940 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000127c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000127c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000127c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000127c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e04980 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff88802b01e0e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #3: ffff88802b01e0e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: tcp_sock_set_nodelay+0x2a/0x180 net/ipv4/tcp.c:3682 locks held by pr/ttyS0/16: 1, last CPU#0: #0: ffffffff8ec36538 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8ec36538 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:439 [inline] #0: ffffffff8ec36538 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 locks held by khungtaskd/32: 1, last CPU#0: #0: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/37: 4, last CPU#0: #0: ffff888079c55940 ((wq_completion)krds_cp_wq#1/6){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888079c55940 ((wq_completion)krds_cp_wq#1/6){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888079c55940 ((wq_completion)krds_cp_wq#1/6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888079c55940 ((wq_completion)krds_cp_wq#1/6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000ad7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000ad7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000ad7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000ad7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e04080 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888057545360 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #3: ffff888057545360 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:3/50: 8, last CPU#0: #0: ffff88801c2f2940 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c2f2940 ((wq_completion)writeback){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c2f2940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801c2f2940 ((wq_completion)writeback){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90000bb7c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90000bb7c40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888036ce40e8 (&type->s_umount_key#35){++++}-{4:4}, at: super_trylock_shared+0x23/0xf0 fs/super.c:674 #3: ffff888036ce2c98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: percpu_down_read include/linux/percpu-rwsem.h:77 [inline] #3: ffff888036ce2c98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_read fs/ext4/ext4.h:1887 [inline] #3: ffff888036ce2c98 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x205/0x3b0 fs/ext4/inode.c:3031 #4: ffff888036ce0938 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x1fbf/0x2200 fs/jbd2/transaction.c:444 #5: ffff8880764ab878 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_map_blocks+0x77d/0x12c0 fs/ext4/inode.c:822 #6: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #6: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #7: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #7: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #7: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #7: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by kworker/u8:4/59: 3, last CPU#0: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000200fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000200fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000200fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000200fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057770800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6908 [inline] #2: ffff888057770800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:550 locks held by kworker/u8:5/60: 3, last CPU#0: #0: ffff88801f6a5140 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801f6a5140 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801f6a5140 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801f6a5140 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000202fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000202fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000202fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000202fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e05280 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:6/169: 2, last CPU#0: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90002fcfc40 ((work_completion)(&map->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002fcfc40 ((work_completion)(&map->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002fcfc40 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90002fcfc40 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 locks held by kworker/u8:7/1035: 3, last CPU#0: #0: ffff8880369f7140 ((wq_completion)krds_cp_wq#1/4){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880369f7140 ((wq_completion)krds_cp_wq#1/4){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880369f7140 ((wq_completion)krds_cp_wq#1/4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff8880369f7140 ((wq_completion)krds_cp_wq#1/4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90005277c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005277c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005277c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90005277c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e04680 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:8/1143: 3, last CPU#0: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900054e7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900054e7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900054e7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900054e7c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057700800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6908 [inline] #2: ffff888057700800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:550 locks held by kworker/u8:9/1164: 4, last CPU#0: #0: ffff888079c56140 ((wq_completion)krds_cp_wq#1/5){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888079c56140 ((wq_completion)krds_cp_wq#1/5){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888079c56140 ((wq_completion)krds_cp_wq#1/5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888079c56140 ((wq_completion)krds_cp_wq#1/5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90005727c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005727c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005727c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90005727c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e04380 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff8880575460e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #3: ffff8880575460e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:10/2989: 3, last CPU#0: #0: ffff888042b21940 ((wq_completion)krds_cp_wq#10/0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888042b21940 ((wq_completion)krds_cp_wq#10/0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888042b21940 ((wq_completion)krds_cp_wq#10/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888042b21940 ((wq_completion)krds_cp_wq#10/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000e3cfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e3cfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e3cfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000e3cfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057dac980 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/R-ipv6_/3197: 3, on CPU#1: #0: ffff88803274a140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88803274a140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88803274a140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88803274a140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000ee2fc20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000ee2fc20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000ee2fc20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000ee2fc20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4235 locks held by kworker/R-bat_e/3228: 7, last CPU#1: #0: ffff888033234140 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888033234140 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888033234140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888033234140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000ef3fc20 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000ef3fc20 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000ef3fc20 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000ef3fc20 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: local_lock_acquire include/linux/local_lock_internal.h:46 [inline] #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 net/core/dev.c:6760 #3: ffff8880b8739ad8 (&data->lock){..-.}-{2:2}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffff8880b8739ad8 (&data->lock){..-.}-{2:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffff8880b8739ad8 (&data->lock){..-.}-{2:2}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #3: ffff8880b8739ad8 (&data->lock){..-.}-{2:2}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 #4: ffffffff9abeb468 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_assert_init+0xb0/0x380 lib/debugobjects.c:1070 #5: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #5: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #5: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #5: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 #6: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #6: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #6: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: veth_xmit+0x66/0xe60 drivers/net/veth.c:358 locks held by kworker/u8:11/3369: 3, last CPU#0: #0: ffff888028bf5140 ((wq_completion)krds_cp_wq#1/2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888028bf5140 ((wq_completion)krds_cp_wq#1/2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888028bf5140 ((wq_completion)krds_cp_wq#1/2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888028bf5140 ((wq_completion)krds_cp_wq#1/2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000f41fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000f41fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000f41fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000f41fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e04c80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by klogd/4975: 2, last CPU#0: #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0 mm/page_owner.c:301 locks held by udevd/4986: 1, last CPU#0: #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 locks held by dhcpcd/5280: 2, last CPU#0: #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1112 [inline] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x219/0x5f0 security/tomoyo/file.c:727 #1: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #1: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 locks held by dhcpcd/5281: 4, last CPU#0: #0: ffffffff8ee36730 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline] #0: ffffffff8ee36730 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10f/0x480 kernel/fork.c:1595 #1: ffff888036c74378 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #1: ffff888036c74378 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716 #2: ffff888029f51078 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline] #2: ffff888029f51078 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723 #3: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #3: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 locks held by getty/5376: 2, on CPU#0: #0: ffff888036c130a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz-executor/5607: 2, last CPU#0: #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by syz-executor/5618: 1, last CPU#0: #0: ffff888057540fe0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: do_ipv6_setsockopt+0x956/0x2960 net/ipv6/ipv6_sockglue.c:563 locks held by syz-executor/5621: 2, last CPU#0: #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __page_table_check_zero+0x6c/0x430 mm/page_table_check.c:138 locks held by syz-executor/5631: 2, last CPU#0: #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:305 [inline] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1112 [inline] #0: ffffffff8f4f2938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_check_open_permission+0x1d3/0x470 security/tomoyo/file.c:772 #1: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #1: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 locks held by kworker/0:7/5806: 4, last CPU#0: #0: ffff88803256f940 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88803256f940 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88803256f940 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88803256f940 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90004affc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004affc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004affc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90004affc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88807c05f530 (&idev->mc_lock){+.+.}-{4:4}, at: mld_ifc_work+0x2d/0xd60 net/ipv6/mcast.c:2738 #3: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #3: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 locks held by kworker/u8:12/6084: 3, last CPU#0: #0: ffff88807c2a7940 ((wq_completion)krds_cp_wq#6/0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807c2a7940 ((wq_completion)krds_cp_wq#6/0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807c2a7940 ((wq_completion)krds_cp_wq#6/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88807c2a7940 ((wq_completion)krds_cp_wq#6/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000336fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000336fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000336fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000336fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057dae180 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/1:18/9255: 4, last CPU#1: #0: ffff88803256f940 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88803256f940 ((wq_completion)mld){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88803256f940 ((wq_completion)mld){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88803256f940 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000415fc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000415fc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000415fc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000415fc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888034165530 (&idev->mc_lock){+.+.}-{4:4}, at: mld_ifc_work+0x2d/0xd60 net/ipv6/mcast.c:2738 #3: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: mld_sendpack+0x206/0xe10 net/ipv6/mcast.c:1862 locks held by kworker/u8:13/11167: 3, last CPU#0: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90005c0fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005c0fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005c0fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90005c0fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057710800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6908 [inline] #2: ffff888057710800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:550 locks held by kworker/u8:14/11168: 4, last CPU#0: #0: ffff888055294940 ((wq_completion)krds_cp_wq#13/0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888055294940 ((wq_completion)krds_cp_wq#13/0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888055294940 ((wq_completion)krds_cp_wq#13/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888055294940 ((wq_completion)krds_cp_wq#13/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9001b827c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9001b827c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9001b827c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9001b827c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888028cebc80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #3: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 locks held by kworker/u8:15/11169: 4, last CPU#0: #0: ffff888028bf7140 ((wq_completion)krds_cp_wq#1/1){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888028bf7140 ((wq_completion)krds_cp_wq#1/1){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888028bf7140 ((wq_completion)krds_cp_wq#1/1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888028bf7140 ((wq_completion)krds_cp_wq#1/1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000341fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000341fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000341fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000341fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057e04f80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff8880769360e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #3: ffff8880769360e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:16/11438: 2, on CPU#1: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000b3c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000b3c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000b3c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000b3c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 locks held by kworker/u8:17/11440: 3, last CPU#0: #0: ffff888079c55140 ((wq_completion)krds_cp_wq#1/7){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888079c55140 ((wq_completion)krds_cp_wq#1/7){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888079c55140 ((wq_completion)krds_cp_wq#1/7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff888079c55140 ((wq_completion)krds_cp_wq#1/7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000b3d7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000b3d7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000b3d7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000b3d7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888057dafc80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:18/11442: 4, last CPU#0: #0: ffff88807c937140 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807c937140 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807c937140 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88807c937140 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc9000b3e7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000b3e7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000b3e7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc9000b3e7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff888029f19440 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12e/0x810 drivers/net/wireguard/noise.c:529 #3: ffff88802c0920e8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x13f/0x810 drivers/net/wireguard/noise.c:530 locks held by kworker/u8:20/11444: 3, last CPU#0: #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b0ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc90004fbfc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004fbfc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004fbfc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc90004fbfc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffff88802b376258 (&devlink->lock_key#3){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40 drivers/net/netdevsim/dev.c:834 locks held by kworker/0:23/14556: 3, on CPU#0: #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #0: ffff88801b06b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #1: ffffc900053e7c40 (deferred_process_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900053e7c40 (deferred_process_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900053e7c40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline] #1: ffffc900053e7c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479 #2: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104 locks held by syz.0.2087/14648: 2, last CPU#0: #0: ffff8880776136b8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff8880776136b8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1299 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290 locks held by syz.1.2097/14701: 2, last CPU#0: #0: ffff88807ef829f8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff88807ef829f8 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1299 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290 locks held by syz.2.2099/14706: 1, on CPU#0: #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:650 [inline] #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3587 locks held by syz.2.2099/14707: 3, last CPU#0: #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3da/0x1e70 drivers/net/tun.c:3229 #1: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #1: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #2: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by syz.2.2099/14712: 1, on CPU#1: #0: ffffffff90254960 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3da/0x1e70 drivers/net/tun.c:3229 locks held by kworker/u8:16/14720: 2, last CPU#0: #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline] #0: ffffffff8eeac770 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305 #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #1: ffffffff8ed5c920 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 3228 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:rcu_read_lock_held+0x0/0x50 kernel/rcu/update.c:346 Code: 05 e9 ec ce 0e c3 cc cc cc cc cc 66 66 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 53 e8 36 c8 3b 0a 85 c0 74 26 31 db e8 4b f9 00 00 84 RSP: 0018:ffffc90000a18178 EFLAGS: 00000202 RAX: ffffffff8a92ee74 RBX: 0000000000000001 RCX: ffff888033221f40 RDX: 8000000000000100 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc90000a182d8 R08: 0000000000000100 R09: ffffc90000a18410 R10: ffffc90000a18260 R11: fffff5200014304e R12: 1ffff1100f30ff0c R13: dffffc0000000000 R14: ffff88807ebc1800 R15: ffffc90000a183d8 FS: 0000000000000000(0000) GS:ffff888124dc5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055556360e4e8 CR3: 000000007f040000 CR4: 00000000003526f0 Call Trace: __find_rr_leaf+0x34d/0x740 net/ipv6/route.c:839 find_rr_leaf net/ipv6/route.c:894 [inline] rt6_select net/ipv6/route.c:938 [inline] fib6_table_lookup+0x3c6/0xae0 net/ipv6/route.c:2216 ip6_pol_route+0x229/0x14d0 net/ipv6/route.c:2253 pol_lookup_func include/net/ip6_fib.h:672 [inline] __fib6_rule_action net/ipv6/fib6_rules.c:240 [inline] fib6_rule_action+0x9d8/0xc00 net/ipv6/fib6_rules.c:278 fib_rules_lookup+0x770/0xeb0 net/core/fib_rules.c:338 fib6_rule_lookup+0x19b/0x6e0 net/ipv6/fib6_rules.c:115 ip6_route_input_lookup net/ipv6/route.c:2324 [inline] ip6_route_input+0x78d/0xb20 net/ipv6/route.c:2627 ip6_rcv_finish+0x141/0x280 net/ipv6/ip6_input.c:117 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325 __netif_receive_skb_one_core net/core/dev.c:6300 [inline] __netif_receive_skb net/core/dev.c:6413 [inline] process_backlog+0x795/0x18b0 net/core/dev.c:6764 __napi_poll+0xaa/0x330 net/core/dev.c:7833 napi_poll net/core/dev.c:7896 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:8053 handle_softirqs+0x226/0x860 kernel/softirq.c:645 do_softirq+0x77/0xd0 kernel/softirq.c:546 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 spin_unlock_bh include/linux/spinlock.h:407 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2709 [inline] batadv_tt_purge+0x4ee/0xa40 net/batman-adv/translation-table.c:4099 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 rescuer_thread+0x7c5/0x10e0 kernel/workqueue.c:3703 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245