INFO: task kworker/u8:3:57 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:3    state:D stack:19200 pid:57    tgid:57    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1553/0x5240 kernel/sched/core.c:6908
 __schedule_loop kernel/sched/core.c:6990 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7286
 rt_mutex_slowlock_block+0x508/0x680 kernel/locking/rtmutex.c:1647
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline]
 rt_mutex_slowlock+0x2dc/0x7b0 kernel/locking/rtmutex.c:1800
 __rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:534 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:552
 rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
 netdev_run_todo+0x2e0/0xde0 net/core/dev.c:11695
 nsim_destroy+0x3ae/0x680 drivers/net/netdevsim/netdev.c:1189
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1528
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1540 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1764
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
 devlink_reload+0x1d1/0x8e0 net/devlink/dev.c:461
 devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:507
 ops_pre_exit_list net/core/net_namespace.c:161 [inline]
 ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
 cleanup_net+0x56e/0x800 net/core/net_namespace.c:704
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/0:1:21037 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:1     state:D stack:21568 pid:21037 tgid:21037 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events fqdir_free_fn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1553/0x5240 kernel/sched/core.c:6908
 __schedule_loop kernel/sched/core.c:6990 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7286
 rt_mutex_slowlock_block+0x508/0x680 kernel/locking/rtmutex.c:1647
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1760 [inline]
 rt_mutex_slowlock+0x2dc/0x7b0 kernel/locking/rtmutex.c:1800
 __rt_mutex_lock kernel/locking/rtmutex.c:1815 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:534 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:552
 rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
 fqdir_free_fn+0x33/0x140 net/ipv4/inet_fragment.c:166
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
4 locks held by pr/legacy/17:
6 locks held by rcuc/0/20:
2 locks held by rcuc/1/28:
1 lock held by khungtaskd/38:
 #0: ffffffff8ddcb880 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8ddcb880 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8ddcb880 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
6 locks held by kworker/u8:3/57:
 #0: ffff88801aee1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff88801aee1138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc9000123fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc9000123fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffffffff8f14c000 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 net/core/net_namespace.c:675
 #3: ffff88805de2e0d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88805de2e0d8 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:108 [inline]
 #3: ffff88805de2e0d8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x117/0x3f0 net/devlink/core.c:504
 #4: ffff888024736300 (&devlink->lock_key#4){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:274 [inline]
 #4: ffff888024736300 (&devlink->lock_key#4){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:109 [inline]
 #4: ffff888024736300 (&devlink->lock_key#4){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x3f0 net/devlink/core.c:504
 #5: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
4 locks held by kworker/u9:0/60:
 #0: ffff8880605a7938 ((wq_completion)hci5#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff8880605a7938 ((wq_completion)hci5#2){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc9000126fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc9000126fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffff88804dfe80b0 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xa0/0x1430 net/bluetooth/hci_event.c:5715
 #3: ffffffff8f2e49d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2136
6 locks held by kworker/1:2/827:
11 locks held by kworker/u8:8/1062:
2 locks held by getty/5551:
 #0: ffff888037ae60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13c0 drivers/tty/n_tty.c:2211
3 locks held by kworker/0:9/5956:
3 locks held by kworker/u8:11/6410:
 #0: ffff888019c44138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff888019c44138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc90005a4fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc90005a4fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
1 lock held by syz-executor/20310:
 #0: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
2 locks held by syz-executor/20816:
 #0: ffffffff8f14c000 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
1 lock held by syz.0.6704/20853:
 #0: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
1 lock held by syz.1.6711/20875:
 #0: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
1 lock held by syz.4.6720/20903:
 #0: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
2 locks held by syz-executor/21012:
 #0: ffffffff8f14c000 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
2 locks held by syz-executor/21024:
 #0: ffffffff8f14c000 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
3 locks held by kworker/0:1/21037:
 #0: ffff888019c03938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff888019c03938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc9001ee0fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc9001ee0fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
2 locks held by syz-executor/21040:
 #0: ffffffff8f14c000 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
1 lock held by syz-executor/21093:
 #0: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
1 lock held by syz-executor/21152:
 #0: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
1 lock held by syz-executor/21182:
 #0: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
1 lock held by syz-executor/21202:
 #0: ffffffff8ddd1af0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828
2 locks held by syz-executor/21395:
 #0: ffff88806e598f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
 #0: ffff88806e598f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
 #1: ffff88806e5980b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5346
1 lock held by syz-executor/21588:
 #0: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline]
 #0: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3436
4 locks held by syz-executor/21631:
 #0: ffff888064320f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
 #0: ffff888064320f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
 #1: ffff8880643200b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5346
 #2: ffffffff8f2e49d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
 #2: ffffffff8f2e49d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2644
 #3: ffff888050e48368 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5c0 net/bluetooth/l2cap_core.c:1755
1 lock held by syz-executor/21797:
 #0: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071
2 locks held by syz-executor/21857:
 #0: ffffffff8f14c000 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock_killable include/linux/rtnetlink.h:145 [inline]
 #1: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: register_netdev+0x18/0x60 net/core/dev.c:11537
2 locks held by syz-executor/21892:
 #0: ffffffff8f14c000 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146
1 lock held by syz-executor/21946:
 #0: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f15a7b8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978
1 lock held by syz.3.6865/21951:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xfd9/0x1030 kernel/hung_task.c:515
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 1062 Comm: kworker/u8:8 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/27/2026
Workqueue: bat_events batadv_tt_purge
RIP: 0010:hlock_class kernel/locking/lockdep.c:234 [inline]
RIP: 0010:mark_lock+0x3c/0x190 kernel/locking/lockdep.c:4731
Code: 00 03 00 83 f9 01 bb 09 00 00 00 83 db 00 83 fa 08 0f 45 da bd 01 00 00 00 89 d9 d3 e5 25 ff 1f 00 00 48 0f a3 05 b4 a1 b5 11 <73> 10 48 69 c0 c8 00 00 00 48 8d 88 f0 03 f7 92 eb 42 83 3d bb 31
RSP: 0018:ffffc900055df8a0 EFLAGS: 00000007
RAX: 0000000000000a6a RBX: 0000000000000002 RCX: 0000000000000002
RDX: 0000000000000002 RSI: ffff8880281b8be0 RDI: ffff8880281b8000
RBP: 0000000000000004 R08: ffffffff8f6a39b7 R09: 1ffffffff1ed4736
R10: dffffc0000000000 R11: fffffbfff1ed4737 R12: ffff8880281b8be0
R13: 0000000000000246 R14: ffff8880281b8bb8 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff88812633c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9e4c79450f CR3: 000000000dbba000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 mark_held_locks kernel/locking/lockdep.c:4325 [inline]
 __trace_hardirqs_on_caller kernel/locking/lockdep.c:4343 [inline]
 lockdep_hardirqs_on_prepare+0x110/0x260 kernel/locking/lockdep.c:4410
 trace_hardirqs_on+0x28/0x40 kernel/trace/trace_preemptirq.c:78
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:178 [inline]
 _raw_spin_unlock_irqrestore+0x30/0x80 kernel/locking/spinlock.c:194
 raw_spin_unlock_irqrestore_wake include/linux/sched/wake_q.h:97 [inline]
 rtlock_slowlock kernel/locking/rtmutex.c:1896 [inline]
 rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
 __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
 rt_spin_lock+0x17a/0x400 kernel/locking/spinlock_rt.c:57
 spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
 batadv_tt_local_purge+0x143/0x380 net/batman-adv/translation-table.c:1313
 batadv_tt_purge+0x35/0xa10 net/batman-adv/translation-table.c:3509
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>