INFO: task khugepaged:34 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:khugepaged state:D stack:27728 pid:34 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __flush_work+0x952/0xae0 kernel/workqueue.c:3076 __lru_add_drain_all+0x6a0/0x800 mm/swap.c:910 khugepaged_do_scan mm/khugepaged.c:2453 [inline] khugepaged+0x183/0x19a0 mm/khugepaged.c:2522 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task udevd:4266 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:26064 pid:4266 ppid:3637 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 device_lock include/linux/device.h:840 [inline] uevent_show+0x16c/0x320 drivers/base/core.c:2669 dev_attr_show+0x50/0xb0 drivers/base/core.c:2372 sysfs_kf_seq_show+0x349/0x4b0 fs/sysfs/file.c:59 seq_read_iter+0x49b/0xd50 fs/seq_file.c:230 call_read_iter include/linux/fs.h:2259 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x4a7/0xa00 fs/read_write.c:470 ksys_read+0x14c/0x250 fs/read_write.c:613 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd64a8a7407 RSP: 002b:00007fff906a5d10 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fd64af87880 RCX: 00007fd64a8a7407 RDX: 0000000000001000 RSI: 00005621e30eda00 RDI: 0000000000000008 RBP: 00007fd64a9efff0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a R13: 00007fd64a9efea0 R14: 0000000000000000 R15: 00005621e31183c0 INFO: task kworker/u4:6:4336 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:6 state:D stack:25520 pid:4336 ppid:2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 linkwatch_event+0xa/0x50 net/core/link_watch.c:263 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz.2.732:7003 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.732 state:D stack:25424 pid:7003 ppid:4275 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 synchronize_rcu_expedited+0x6e6/0x890 kernel/rcu/tree_exp.h:977 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 evdev_detach_client drivers/input/evdev.c:386 [inline] evdev_release+0x1f3/0x800 drivers/input/evdev.c:449 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f150e79ce59 RSP: 002b:00007ffd04e21848 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffd04e21930 RCX: 00007f150e79ce59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000046bbc R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b2ef20000 R11: 0000000000000246 R12: 00007ffd04e21970 R13: 00007f150ea15fac R14: 0000000000047513 R15: 00007f150ea15fa0 INFO: task syz.1.736:7011 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.736 state:D stack:25936 pid:7011 ppid:4274 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 evdev_detach_client drivers/input/evdev.c:386 [inline] evdev_release+0x1f3/0x800 drivers/input/evdev.c:449 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x982/0x2480 kernel/exit.c:881 do_group_exit+0x217/0x2d0 kernel/exit.c:1023 get_signal+0x1272/0x1350 kernel/signal.c:2871 arch_do_signal_or_restart+0xc4/0x1350 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f2f7335d68e RSP: 002b:00007ffe6fba35d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e6 RAX: 0000000000000000 RBX: 0000555572ef3500 RCX: 00007f2f7335d68e RDX: 00007ffe6fba3630 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f2f73617da0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000047de2 R13: 00007f2f7361609c R14: 0000000000047229 R15: 00007ffe6fba3760 INFO: task syz.0.737:7013 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.737 state:D stack:26064 pid:7013 ppid:4282 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 lockdep_unregister_key+0x4d2/0x550 kernel/locking/lockdep.c:6374 __qdisc_destroy+0x128/0x430 net/sched/sch_generic.c:1081 netdev_for_each_tx_queue include/linux/netdevice.h:2465 [inline] dev_shutdown+0x92/0x440 net/sched/sch_generic.c:1465 unregister_netdevice_many_notify+0xa76/0x19c0 net/core/dev.c:11014 unregister_netdevice_many net/core/dev.c:11077 [inline] unregister_netdevice_queue+0x328/0x370 net/core/dev.c:10960 unregister_netdevice include/linux/netdevice.h:3075 [inline] __tun_detach+0xd4a/0x1500 drivers/net/tun.c:685 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x109/0x1b0 drivers/net/tun.c:3492 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f15ecb9ce59 RSP: 002b:00007ffde9651688 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffde9651770 RCX: 00007f15ecb9ce59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000046d76 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b2ed20000 R11: 0000000000000246 R12: 00007ffde96517b0 R13: 00007f15ece15fac R14: 0000000000046de8 R15: 00007f15ece15fa0 INFO: task syz.4.739:7020 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.739 state:D stack:26832 pid:7020 ppid:4280 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 ethnl_default_dumpit+0x95/0xed0 net/ethtool/netlink.c:477 netlink_dump+0x6a3/0xd00 net/netlink/af_netlink.c:2236 __netlink_dump_start+0x537/0x6f0 net/netlink/af_netlink.c:2338 genl_family_rcv_msg_dumpit+0x323/0x3c0 net/netlink/genetlink.c:714 genl_family_rcv_msg net/netlink/genetlink.c:830 [inline] genl_rcv_msg+0x5cb/0x790 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1fb/0x450 net/netlink/af_netlink.c:2511 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ad/0xbd0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x5be/0x970 net/socket.c:2518 ___sys_sendmsg+0x2a2/0x360 net/socket.c:2572 __sys_sendmsg net/socket.c:2601 [inline] __do_sys_sendmsg net/socket.c:2610 [inline] __se_sys_sendmsg+0x1bb/0x2a0 net/socket.c:2608 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f3d3a99ce59 RSP: 002b:00007f3d38bf6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f3d3ac16180 RCX: 00007f3d3a99ce59 RDX: 0000000000000000 RSI: 0000200000000480 RDI: 0000000000000005 RBP: 00007f3d3aa32d6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3d3ac16218 R14: 00007f3d3ac16180 R15: 00007fff848c7b48 INFO: task syz.3.740:7026 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.740 state:D stack:29168 pid:7026 ppid:4285 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 lru_cache_disable+0x22/0x30 mm/swap.c:953 do_mbind mm/mempolicy.c:1297 [inline] kernel_mbind mm/mempolicy.c:1481 [inline] __do_sys_mbind mm/mempolicy.c:1558 [inline] __se_sys_mbind+0x483/0x810 mm/mempolicy.c:1554 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fe42e79ce59 RSP: 002b:00007fe42f5bc028 EFLAGS: 00000246 ORIG_RAX: 00000000000000ed RAX: ffffffffffffffda RBX: 00007fe42ea16090 RCX: 00007fe42e79ce59 RDX: 0000000000000001 RSI: 0000000000800000 RDI: 0000200000001000 RBP: 00007fe42e832d6f R08: 0000000000000000 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe42ea16128 R14: 00007fe42ea16090 R15: 00007fff3b039ea8 Showing all locks held in the system: 3 locks held by kworker/0:0/7: #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc900000c7d00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8cb2e770 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8cb2ef90 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 3 locks held by kworker/0:1/14: #0: ffff88802eddb538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90000137d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4672 1 lock held by khungtaskd/28: #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8cb2dde0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513 1 lock held by khugepaged/34: #0: ffffffff8cbd4ea8 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x66/0x800 mm/swap.c:865 4 locks held by kworker/u5:0/48: #0: ffff88801d281138 ((wq_completion)hci13#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90000b97d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880320d4428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 2 locks held by getty/4034: #0: ffff88814d79b098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x429/0x1390 drivers/tty/n_tty.c:2198 4 locks held by udevd/4266: #0: ffff88801e3dbe80 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xad/0xd50 fs/seq_file.c:182 #1: ffff888028b99488 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x58/0x410 fs/kernfs/file.c:172 #2: ffff88814724b008 (kn->active#5){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff88814724b008 (kn->active#5){++++}-{0:0}, at: kernfs_seq_start+0xae/0x410 fs/kernfs/file.c:173 #3: ffff88807bacd190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:840 [inline] #3: ffff88807bacd190 (&dev->mutex){....}-{3:3}, at: uevent_show+0x16c/0x320 drivers/base/core.c:2669 4 locks held by kworker/u5:1/4276: #0: ffff88801fb94938 ((wq_completion)hci16#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90003f87d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880320e4428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 4 locks held by kworker/u5:2/4279: #0: ffff8880559e1938 ((wq_completion)hci12#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90003fd7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880320d0428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 4 locks held by kworker/u5:3/4281: #0: ffff888052f70138 ((wq_completion)hci10#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90003fe7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880320c4428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 3 locks held by syz-executor/4285: #0: ffff88805c0f5468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:526 [inline] #0: ffff88805c0f5468 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x20e/0x500 net/bluetooth/hci_core.c:2731 #1: ffff88805c0f4428 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x45b/0xf40 net/bluetooth/hci_sync.c:5234 #2: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1829 [inline] #2: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xac/0x290 net/bluetooth/hci_conn.c:2504 4 locks held by kworker/u5:5/4288: #0: ffff888054b1b938 ((wq_completion)hci14#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004037d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880320dc428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 4 locks held by kworker/u5:6/4289: #0: ffff888056a37138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004047d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880320e0428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 4 locks held by kworker/u5:7/4290: #0: ffff888072db7138 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004057d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880320c8428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 4 locks held by kworker/u5:8/4291: #0: ffff8880788e7138 ((wq_completion)hci9#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004067d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff88801ff2c428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 3 locks held by kworker/u4:6/4336: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004647d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263 6 locks held by kworker/1:8/4947: 1 lock held by syz.2.732/7003: #0: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #0: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962 2 locks held by syz.0.737/7013: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3492 #1: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #1: ffffffff8cb33ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 3 locks held by syz.4.739/7020: #0: ffffffff8dda8b10 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860 #1: ffff88807a8e0698 (nlk_cb_mutex-GENERIC){+.+.}-{3:3}, at: __netlink_dump_start+0x11f/0x6f0 net/netlink/af_netlink.c:2305 #2: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: ethnl_default_dumpit+0x95/0xed0 net/ethtool/netlink.c:477 1 lock held by syz-executor/7029: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7034: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7036: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7038: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7041: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by dhcpcd/7043: #0: ffff88807bcee130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88807bcee130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/7044: #0: ffff888079672130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888079672130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/7045: #0: ffff888073834130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888073834130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/7046: #0: ffff88805496e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88805496e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/7047: #0: ffff8880794d4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff8880794d4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by dhcpcd/7048: #0: ffff888026c7a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888026c7a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xce0 net/packet/af_packet.c:3249 1 lock held by syz-executor/7050: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7055: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7057: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7059: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7062: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7065: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7070: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 4 locks held by kworker/u5:9/7071: #0: ffff88801a66b138 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc9000604fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff88808e63c428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 1 lock held by syz-executor/7073: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 1 lock held by syz-executor/7074: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 4 locks held by kworker/u5:10/7076: #0: ffff8880559ef938 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc9000bf8fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880320e8428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 4 locks held by kworker/u5:11/7077: #0: ffff88807d17c938 ((wq_completion)hci17#2){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc9000bf9fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffff8880779f4428 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x94/0xa50 net/bluetooth/hci_event.c:3763 #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1814 [inline] #3: ffffffff8dea6be8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x607/0xa50 net/bluetooth/hci_event.c:3796 1 lock held by syz-executor/7081: #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd48728 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6154 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xeee/0xf30 kernel/hung_task.c:377 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 4947 Comm: kworker/1:8 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:check_kcov_mode kernel/kcov.c:193 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x32/0x60 kernel/kcov.c:216 Code: 84 e8 7f 7e 65 8b 15 85 e8 7f 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 1c 16 00 00 00 74 2c 8b 91 f8 15 00 00 <83> fa 02 75 21 48 8b 91 00 16 00 00 48 8b 32 48 8d 7e 01 8b 89 fc RSP: 0018:ffffc9000cbaeb18 EFLAGS: 00000246 RAX: ffffffff881dbe1c RBX: ffff88807e74610d RCX: ffff8880274f9dc0 RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000020 RBP: ffffc9000cbaed20 R08: ffff8880274f9dc0 R09: 0000000000000020 R10: 00000000000000bc R11: 0000000000000002 R12: dffffc0000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 00000000000006f5 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005622bf339000 CR3: 000000000c88e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: convert_chmap_v3 sound/usb/stream.c:359 [inline] snd_usb_get_audioformat_uac3 sound/usb/stream.c:1028 [inline] __snd_usb_parse_audio_interface+0x343c/0x4b00 sound/usb/stream.c:1202 snd_usb_parse_audio_interface+0x36/0xb0 sound/usb/stream.c:1274 snd_usb_create_stream+0x3ec/0x610 sound/usb/card.c:209 snd_usb_create_streams sound/usb/card.c:330 [inline] usb_audio_probe+0x130b/0x1d90 sound/usb/card.c:892 usb_probe_interface+0x5c5/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2aa/0xc70 drivers/base/dd.c:639 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489 device_add+0xa00/0xfb0 drivers/base/core.c:3697 usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2aa/0xc70 drivers/base/dd.c:639 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489 device_add+0xa00/0xfb0 drivers/base/core.c:3697 usb_new_device+0xd66/0x1650 drivers/usb/core/hub.c:2659 hub_port_connect drivers/usb/core/hub.c:5517 [inline] hub_port_connect_change drivers/usb/core/hub.c:5657 [inline] port_event drivers/usb/core/hub.c:5817 [inline] hub_event+0x2dcf/0x5560 drivers/usb/core/hub.c:5899 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295