INFO: task kworker/u8:21:6489 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:21 state:D stack:22584 pid:6489 tgid:6489 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ef/0x4fb0 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 linkwatch_event+0xe/0x60 net/core/link_watch.c:303 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0x89f/0xd90 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 INFO: task syz-executor:11540 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22392 pid:11540 tgid:11540 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ef/0x4fb0 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnl_nets_lock net/core/rtnetlink.c:341 [inline] rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3c0/0x550 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f937695b58e RSP: 002b:00007fff5bfe4e18 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055556615b500 RCX: 00007f937695b58e RDX: 0000000000000054 RSI: 00007f9377744670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007fff5bfe4e94 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f9377744670 R15: 0000000000000000 INFO: task syz-executor:11544 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22392 pid:11544 tgid:11544 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ef/0x4fb0 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnl_nets_lock net/core/rtnetlink.c:341 [inline] rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3c0/0x550 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f89c895b58e RSP: 002b:00007ffd1232b8e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555587df3500 RCX: 00007f89c895b58e RDX: 000000000000004c RSI: 00007f89c9744670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffd1232b964 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f89c9744670 R15: 0000000000000000 INFO: task syz-executor:11548 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22392 pid:11548 tgid:11548 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ef/0x4fb0 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnl_nets_lock net/core/rtnetlink.c:341 [inline] rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3c0/0x550 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f2d35b58e RSP: 002b:00007ffd1efd21f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555566882500 RCX: 00007f5f2d35b58e RDX: 000000000000008c RSI: 00007f5f2e144670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffd1efd2274 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f5f2e144670 R15: 0000000000000000 INFO: task syz-executor:11550 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22392 pid:11550 tgid:11550 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ef/0x4fb0 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnl_nets_lock net/core/rtnetlink.c:341 [inline] rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3c0/0x550 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd416d5b58e RSP: 002b:00007ffd34123068 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055559000d500 RCX: 00007fd416d5b58e RDX: 000000000000008c RSI: 00007fd417b44670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffd341230e4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fd417b44670 R15: 0000000000000000 INFO: task syz-executor:11551 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22392 pid:11551 tgid:11551 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ef/0x4fb0 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnl_nets_lock net/core/rtnetlink.c:341 [inline] rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3c0/0x550 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7dd0f5b58e RSP: 002b:00007ffed941ce68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00005555688a4500 RCX: 00007f7dd0f5b58e RDX: 000000000000008c RSI: 00007f7dd1d44670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffed941cee4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f7dd1d44670 R15: 0000000000000000 INFO: task syz-executor:11554 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22392 pid:11554 tgid:11554 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ef/0x4fb0 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 rtnl_lock net/core/rtnetlink.c:80 [inline] rtnl_nets_lock net/core/rtnetlink.c:341 [inline] rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:742 __sys_sendto+0x3c0/0x550 net/socket.c:2206 __do_sys_sendto net/socket.c:2213 [inline] __se_sys_sendto net/socket.c:2209 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2209 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f506e95b58e RSP: 002b:00007ffe39713248 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000055555f8f4500 RCX: 00007f506e95b58e RDX: 000000000000004c RSI: 00007f506f744670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffe397132c4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f506f744670 R15: 0000000000000000 Showing all locks held in the system: 1 lock held by ksoftirqd/1/23: 4 locks held by kworker/1:0/24: 1 lock held by khungtaskd/32: #0: ffffffff8e35a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e35a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e35a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 9 locks held by kworker/1:2/909: 6 locks held by kworker/u8:10/4852: #0: ffff88801b29f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88801b29f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000dad7bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000dad7bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f799e90 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xfe/0x7b0 net/core/net_namespace.c:670 #3: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1c/0x200 drivers/net/wireguard/device.c:419 #4: ffff888057afd4e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_netns_pre_exit+0xb0/0x200 drivers/net/wireguard/device.c:424 #5: ffffffff8e360c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline] #5: ffffffff8e360c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:956 2 locks held by klogd/5180: 2 locks held by getty/5578: #0: ffff8880350450a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211 4 locks held by kworker/1:3/5835: 5 locks held by kworker/u9:7/5843: #0: ffff8880575b7148 ((wq_completion)hci8){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff8880575b7148 ((wq_completion)hci8){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900040dfbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900040dfbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88807dbacec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff88807dbac0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8e360c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline] #4: ffffffff8e360c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:956 6 locks held by kworker/u9:10/5847: #0: ffff888031ca4148 ((wq_completion)hci9){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888031ca4148 ((wq_completion)hci9){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000402fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000402fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88802f7e4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff88802f7e40c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 #5: ffff88807de4b338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5b0 net/bluetooth/l2cap_core.c:1763 4 locks held by kworker/1:8/6034: 7 locks held by kworker/1:9/6098: 3 locks held by kworker/u8:21/6489: #0: ffff88813fe29948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88813fe29948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9001d14fbc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9001d14fbc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303 3 locks held by kworker/u8:23/6510: #0: ffff888030802148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888030802148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000e357bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000e357bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 2 locks held by syz-executor/11540: #0: ffffffff8fd09658 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8fd09658 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8fd09658 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 5 locks held by kworker/u9:0/11541: #0: ffff888053dc9148 ((wq_completion)hci10){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888053dc9148 ((wq_completion)hci10){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000f667bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000f667bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888035174ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff8880351740c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 2 locks held by syz-executor/11544: #0: ffffffff8fcf1340 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8fcf1340 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8fcf1340 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 2 locks held by syz-executor/11548: #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 2 locks held by syz-executor/11550: #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 2 locks held by syz-executor/11551: #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8ef0f5a8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 2 locks held by syz-executor/11554: #0: ffffffff8fcf1340 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8fcf1340 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8fcf1340 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570 #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #1: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071 3 locks held by kworker/1:19/11591: #0: ffff88813fe11948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88813fe11948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90011b7fbc0 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90011b7fbc0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104 1 lock held by syz-executor/11600: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11602: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 5 locks held by kworker/u9:2/11605: #0: ffff888031c67948 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888031c67948 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900031d7bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900031d7bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888026154ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff8880261540c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 1 lock held by syz-executor/11609: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11615: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11618: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11621: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11632: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11636: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11640: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11644: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11647: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 1 lock held by syz-executor/11650: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 5 locks held by kworker/u9:3/11653: #0: ffff88802646c948 ((wq_completion)hci7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88802646c948 ((wq_completion)hci7){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90003157bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90003157bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888054ea0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff888054ea00c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 5 locks held by kworker/u9:4/11654: #0: ffff88807525f948 ((wq_completion)hci11){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88807525f948 ((wq_completion)hci11){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9001dd0fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9001dd0fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888055654ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff8880556540c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 5 locks held by kworker/u9:5/11655: #0: ffff88807cedd148 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88807cedd148 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90003f6fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90003f6fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff8880628d0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff8880628d00c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 5 locks held by kworker/u9:6/11656: #0: ffff88803259f148 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88803259f148 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90003f7fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90003f7fbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88808ebc0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff88808ebc00c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 4 locks held by kworker/u9:8/11664: #0: ffff88807b336148 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88807b336148 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90011367bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90011367bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff8880332b40c0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x950 net/bluetooth/hci_event.c:3695 #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x54c/0x950 net/bluetooth/hci_event.c:3729 1 lock held by syz-executor/11666: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 4 locks held by kworker/u9:9/11668: #0: ffff8880794f5948 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff8880794f5948 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900041cfbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900041cfbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88803282c0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x950 net/bluetooth/hci_event.c:3695 #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x54c/0x950 net/bluetooth/hci_event.c:3729 1 lock held by syz-executor/11670: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 4 locks held by kworker/u9:11/11672: #0: ffff888055b12948 ((wq_completion)hci20#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888055b12948 ((wq_completion)hci20#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000431fbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000431fbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff8880549800c0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x950 net/bluetooth/hci_event.c:3695 #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x54c/0x950 net/bluetooth/hci_event.c:3729 1 lock held by syz-executor/11677: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 4 locks held by kworker/u9:12/11679: #0: ffff88803235e148 ((wq_completion)hci21#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88803235e148 ((wq_completion)hci21#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000449fbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000449fbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff8880678540c0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x950 net/bluetooth/hci_event.c:3695 #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x54c/0x950 net/bluetooth/hci_event.c:3729 1 lock held by syz-executor/11680: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 5 locks held by kworker/u9:14/11683: #0: ffff888024dd5948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888024dd5948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900044afbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900044afbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88807a6c0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff88807a6c00c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 5 locks held by kworker/u9:15/11684: #0: ffff888027f0b148 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888027f0b148 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90003eefbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90003eefbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888054330ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff8880543300c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 4 locks held by kworker/u9:16/11686: #0: ffff88802982f148 ((wq_completion)hci23#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88802982f148 ((wq_completion)hci23#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90004597bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90004597bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88807e44c0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x950 net/bluetooth/hci_event.c:3695 #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x54c/0x950 net/bluetooth/hci_event.c:3729 1 lock held by syz-executor/11687: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 4 locks held by kworker/u9:17/11688: #0: ffff888024c0c948 ((wq_completion)hci22#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff888024c0c948 ((wq_completion)hci22#2){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900047cfbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900047cfbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888079dd40c0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x9b/0x950 net/bluetooth/hci_event.c:3695 #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #3: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x54c/0x950 net/bluetooth/hci_event.c:3729 1 lock held by syz-executor/11691: #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f7a8808 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978 5 locks held by kworker/u9:19/11694: #0: ffff8880278bd948 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff8880278bd948 ((wq_completion)hci6){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900047ffbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900047ffbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88805b830ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff88805b8300c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x8a3/0xed0 net/bluetooth/hci_sync.c:5703 #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8f934bc8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xf90/0xfe0 kernel/hung_task.c:515 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 6034 Comm: kworker/1:8 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: wg-kex-wg2 wg_packet_handshake_receive_worker RIP: 0010:rcu_read_lock include/linux/rcupdate.h:868 [inline] RIP: 0010:class_rcu_constructor include/linux/rcupdate.h:1195 [inline] RIP: 0010:unwind_next_frame+0xd6/0x23c0 arch/x86/kernel/unwind_orc.c:495 Code: 31 f6 31 d2 b9 02 00 00 00 45 31 c0 45 31 c9 41 57 e8 ee 6f 2a 00 48 83 c4 08 e8 85 f3 03 0a 85 c0 74 3a e8 8c 95 33 00 84 c0 <75> 31 e8 73 f3 03 0a 85 c0 74 28 80 3d a8 0d 44 0e 00 75 1f c6 05 RSP: 0018:ffffc90000a085f8 EFLAGS: 00000002 RAX: 0000000000000001 RBX: ffffffff81b00647 RCX: 0000000080000103 RDX: 00000000da7f2539 RSI: ffffffff8be73860 RDI: ffffffff8be73820 RBP: dffffc0000000000 R08: ffffffff8174c0e5 R09: ffffffff8e35a360 R10: dffffc0000000000 R11: ffffffff81ae5cd0 R12: 1ffff920001410d9 R13: ffffc90000a08700 R14: ffffc90000a086c8 R15: ffffffff8174c0e5 FS: 0000000000000000(0000) GS:ffff888125a28000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6f129ab940 CR3: 000000000e146000 CR4: 0000000000350ef0 Call Trace: arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free mm/slub.c:6674 [inline] kfree+0x1be/0x650 mm/slub.c:6882 dummy_timer+0xb59/0x45d0 drivers/usb/gadget/udc/dummy_hcd.c:1989 __run_hrtimer kernel/time/hrtimer.c:1777 [inline] __hrtimer_run_queues+0x527/0xc30 kernel/time/hrtimer.c:1841 hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1858 handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:finish_task_switch+0x241/0x920 kernel/sched/core.c:5118 Code: 0f 84 bd 01 00 00 48 85 db 0f 85 e4 01 00 00 0f 1f 44 00 00 4c 8b 75 d0 4c 89 e7 e8 39 73 e8 09 e8 74 96 37 00 fb 4c 8b 65 c0 <49> 8d bc 24 48 16 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0 RSP: 0018:ffffc90004f072f8 EFLAGS: 00000202 RAX: 000000000002100d RBX: 0000000000000000 RCX: 0000000080000001 RDX: 0000000000000007 RSI: ffffffff8dacf9d6 RDI: ffffffff8be73880 RBP: ffffc90004f07350 R08: ffffffff8fced977 R09: 1ffffffff1f9db2e R10: dffffc0000000000 R11: fffffbfff1f9db2f R12: ffff8880262ddb80 R13: dffffc0000000000 R14: ffff88801cef5b80 R15: ffff8880b873b498 context_switch kernel/sched/core.c:5263 [inline] __schedule+0x14f7/0x4fb0 kernel/sched/core.c:6867 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7194 irqentry_exit+0x597/0x620 kernel/entry/common.c:216 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:page_slab mm/slab.h:143 [inline] RIP: 0010:virt_to_slab mm/slab.h:178 [inline] RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:131 [inline] RIP: 0010:qlist_free_all+0x4a/0x100 mm/kasan/quarantine.c:176 Code: 89 ef 4d 89 f4 4d 85 f6 75 40 4c 8b 25 ef 95 ad 0b 4c 89 ff e8 07 e1 4c ff 48 c1 e8 06 48 83 e0 c0 49 8d 0c 04 49 8b 44 04 08 <48> 89 c2 48 ff ca a8 01 48 0f 44 d1 0f b6 42 33 c1 e0 18 3d 00 00 RSP: 0018:ffffc90004f07680 EFLAGS: 00000206 RAX: ffff88813ff27140 RBX: ffffc90004f076b8 RCX: ffffea00007cc000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffff88801f300000 R08: ffffea00027a5c80 R09: 1ffffffff1f9db2e R10: dffffc0000000000 R11: fffffbfff1f9db2f R12: ffffea0000000000 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88801f300000 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] __kmalloc_cache_noprof+0x36f/0x6e0 mm/slub.c:5775 kmalloc_noprof include/linux/slab.h:957 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] keypair_create drivers/net/wireguard/noise.c:100 [inline] wg_noise_handshake_begin_session+0xd5/0xbd0 drivers/net/wireguard/noise.c:827 wg_receive_handshake_packet drivers/net/wireguard/receive.c:176 [inline] wg_packet_handshake_receive_worker+0x700/0x10c0 drivers/net/wireguard/receive.c:213 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0x89f/0xd90 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246