INFO: task khidpd_16c00009:10086 blocked for more than 143 seconds.
      Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:khidpd_16c00009 state:D
 stack:28560 pid:10086 tgid:10086 ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0x1850/0x4c30 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6848
 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x355/0x620 kernel/sched/completion.c:148
 __flush_work+0xa37/0xc50 kernel/workqueue.c:4231
 __cancel_work_sync+0xbc/0x110 kernel/workqueue.c:4351
 hidp_session_remove+0x64/0x260 net/bluetooth/hidp/core.c:1169
 l2cap_unregister_user+0x19c/0x1c0 net/bluetooth/l2cap_core.c:1732
 hidp_session_thread+0x450/0x490 net/bluetooth/hidp/core.c:1304
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz.3.1194:10200 blocked for more than 145 seconds.
      Not tainted 6.13.0-rc3-syzkaller-00174-ga024e377efed #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.1194      state:D
 stack:27184 pid:10200 tgid:10199 ppid:5831   flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0x1850/0x4c30 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6848
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6905
 __mutex_lock_common kernel/locking/mutex.c:665 [inline]
 __mutex_lock+0x7e7/0xee0 kernel/locking/mutex.c:735
 l2cap_chan_connect+0xff/0xeb0 net/bluetooth/l2cap_core.c:6954
 l2cap_sock_connect+0x5c9/0x800 net/bluetooth/l2cap_sock.c:256
 __sys_connect_file net/socket.c:2055 [inline]
 __sys_connect+0x288/0x2d0 net/socket.c:2074
 __do_sys_connect net/socket.c:2080 [inline]
 __se_sys_connect net/socket.c:2077 [inline]
 __x64_sys_connect+0x7a/0x90 net/socket.c:2077
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7febad385d29
RSP: 002b:00007febae156038 EFLAGS: 00000246
 ORIG_RAX: 000000000000002a
RAX: ffffffffffffffda RBX: 00007febad575fa0 RCX: 00007febad385d29
RDX: 000000000000000e RSI: 0000000020000080 RDI: 0000000000000006
RBP: 00007febad401b08 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007febad575fa0 R15: 00007ffde9629e18
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/u8:1/12:
 #0: 
ffff88803081b148
 (
(wq_completion)ipv6_addrconf
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3204 [inline]
, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3310
 #1: 
ffffc90000117d00
 (
(work_completion)(&(&net->ipv6.addr_chk_work)->work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3205 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3310
 #2: 
ffffffff8fcb2a88
 (rtnl_mutex
){+.+.}-{4:4}
, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4755
1 lock held by khungtaskd/30:
 #0: 
ffffffff8e937ae0
 (
rcu_read_lock
){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6744
6 locks held by kworker/u8:2/35:
 #0: 
ffff88801baed948
 (
(wq_completion)netns
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3204 [inline]
, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3310
 #1: 
ffffc90000ab7d00
 (
net_cleanup_work
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3205 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3310
 #2: 
ffffffff8fca65d0
 (
pernet_ops_rwsem
){++++}-{4:4}
, at: cleanup_net+0x16a/0xd50 net/core/net_namespace.c:602
 #3: 
ffff88802d0730e8
 (
&dev->mutex
){....}-{4:4}
, at: device_lock include/linux/device.h:1014 [inline]
, at: devl_dev_lock net/devlink/devl_internal.h:108 [inline]
, at: devlink_pernet_pre_exit+0x13b/0x440 net/devlink/core.c:506
 #4: 
ffff888030e81250
 (
&devlink->lock_key
#22
){+.+.}-{4:4}
, at: devl_lock net/devlink/core.c:276 [inline]
, at: devl_dev_lock net/devlink/devl_internal.h:109 [inline]
, at: devlink_pernet_pre_exit+0x14d/0x440 net/devlink/core.c:506
 #5: 
ffffffff8e93cec0
 (
rcu_state.barrier_mutex
){+.+.}-{4:4}
, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:4565
3 locks held by kworker/u8:5/1143:
3 locks held by kworker/u8:6/1161:
 #0: 
ffff88801ac89148
 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline]
 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1840 kernel/workqueue.c:3310
 #1: 
ffffc9000410fd00
 (
(linkwatch_work).work
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3205 [inline]
, at: process_scheduled_works+0x976/0x1840 kernel/workqueue.c:3310
 #2: 
ffffffff8fcb2a88
 (
rtnl_mutex
){+.+.}-{4:4}
, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:281
2 locks held by getty/5589:
 #0: 
ffff8880356290a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (
&ldata->atomic_read_lock
){+.+.}-{4:4}
, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211
8 locks held by kworker/1:14/9214:
2 locks held by syz-executor/9968:
 #0: ffff88805ba94d80
 (
&hdev->req_lock
){+.+.}-{4:4}
, at: hci_dev_do_close net/bluetooth/hci_core.c:480 [inline]
, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2697
 #1: 
ffff88805ba94078
 (&hdev->lock
){+.+.}-{4:4}
, at: hci_dev_close_sync+0x5c8/0x11c0 net/bluetooth/hci_sync.c:5200
2 locks held by khidpd_16c00009/10086:
 #0: ffff88805ba94078
 (
&hdev->lock
){+.+.}-{4:4}
, at: l2cap_unregister_user+0x6a/0x1c0 net/bluetooth/l2cap_core.c:1726
 #1: 
ffffffff8fe3b650
 (
hidp_session_sem
){++++}-{4:4}
, at: hidp_session_remove+0x2d/0x260 net/bluetooth/hidp/core.c:1165
1 lock held by syz.3.1194/10200:
 #0: 
ffff88805ba94078
 (
&hdev->lock
){+.+.}-{4:4}
, at: l2cap_chan_connect+0xff/0xeb0 net/bluetooth/l2cap_core.c:6954
3 locks held by syz-executor/11689:
 #0: 
ffffffff901b9970
 (
&ops->srcu
#2
){.+.+}-{0:0}
, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
, at: rtnl_link_ops_get+0x22/0x250 net/core/rtnetlink.c:555
 #1: 
ffffffff8fcb2a88
 (
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
, at: rtnl_nets_lock net/core/rtnetlink.c:326 [inline]
, at: rtnl_newlink+0xce2/0x2210 net/core/rtnetlink.c:4011
 #2: 
ffffffff8e93cff8
 (
rcu_state.exp_mutex
){+.+.}-{4:4}
, at: exp_funnel_lock kernel/rcu/tree_exp.h:297 [inline]
, at: synchronize_rcu_expedited+0x381/0x830 kernel/rcu/tree_exp.h:976
2 locks held by syz-executor/11758:
 #0: 
ffffffff901b8590
 (
&ops->srcu
#2
){.+.+}-{0:0}
, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
, at: rtnl_link_ops_get+0x22/0x250 net/core/rtnetlink.c:555
 #1: 
ffffffff8fcb2a88
 (
rtnl_mutex
){+.+.}-{4:4}
, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
, at: rtnl_nets_lock net/core/rtnetlink.c:326 [inline]
, at: rtnl_newlink+0xce2/0x2210 net/core/rtnetlink.c:4011
2 locks held by syz.2.1597/11837:
 #0: 
ffffffff8fd154d0
 (
cb_lock){++++}-{4:4}
, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
 #1: 
ffffffff8fcb2a88
 (
rtnl_mutex
){+.+.}-{4:4}
, at: nl80211_pre_doit+0x5f/0x8b0 net/wireless/nl80211.c:16587
1 lock held by syz.5.1598/11838:
 #0: 
ffffffff8e93cff8
 (