INFO: task syz.1.4069:24872 blocked for more than 143 seconds.
Tainted: G U L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.4069 state:D stack:27464 pid:24872 tgid:24866 ppid:16196 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xfe6/0x5fa0 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
nfsd_nl_threads_set_doit+0x687/0xbc0 fs/nfsd/nfsctl.c:1596
genl_family_rcv_msg_doit+0x214/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x560/0x800 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2550
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x8b0/0xda0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa54/0xc30 net/socket.c:2592
___sys_sendmsg+0x190/0x1e0 net/socket.c:2646
__sys_sendmsg+0x170/0x220 net/socket.c:2678
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48c9b9af79
RSP: 002b:00007f48ca979028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f48c9e16180 RCX: 00007f48c9b9af79
RDX: 0000000000004000 RSI: 0000200000000480 RDI: 0000000000000006
RBP: 00007f48c9c316e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48c9e16218 R14: 00007f48c9e16180 R15: 00007ffefe9b99a8
Showing all locks held in the system:
3 locks held by kworker/0:1/10:
#0: ffff88813fe15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900000f7c98 ((work_completion)(&(&data->open_timeout)->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88801e3c3118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:478 [inline]
#2: ffff88801e3c3118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_open_timeout+0x26/0x40 drivers/bluetooth/hci_vhci.c:636
3 locks held by kworker/1:0/24:
#0: ffff88813fe15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffff8880b8524608 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:225 [inline]
#1: ffff8880b8524608 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2b71/0x5fa0 kernel/sched/core.c:6861
#2: ffff8880279299e0 (slock-AF_INET){+.-.}-{3:3}, at: spin_lock_bh include/linux/spinlock.h:356 [inline]
#2: ffff8880279299e0 (slock-AF_INET){+.-.}-{3:3}, at: mptcp_release_cb+0x1a0/0x710 net/mptcp/protocol.c:3650
1 lock held by khungtaskd/31:
#0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
2 locks held by syz-executor/15307:
#0: ffff888035a5c0e0 (&type->s_umount_key#51){++++}-{4:4}, at: __super_lock fs/super.c:57 [inline]
#0: ffff888035a5c0e0 (&type->s_umount_key#51){++++}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
#0: ffff888035a5c0e0 (&type->s_umount_key#51){++++}-{4:4}, at: deactivate_super fs/super.c:506 [inline]
#0: ffff888035a5c0e0 (&type->s_umount_key#51){++++}-{4:4}, at: deactivate_super+0xdf/0x110 fs/super.c:503
#1: ffffffff8ea476a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0 fs/nfsd/nfssvc.c:575
3 locks held by kworker/u12:0/22288:
#0: ffff88804d2db148 ((wq_completion)hci12){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000b757c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888027ff8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:1/22308:
#0: ffff88807e3b3148 ((wq_completion)hci11){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000b4d7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888044440ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
4 locks held by kworker/u11:6/22340:
#0: ffff88801c29f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000b147c98 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffffffff903dd430 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xab/0x830 net/core/net_namespace.c:670
#3: ffffffff8e5ef8f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311
2 locks held by syz.0.4028/24654:
#0: ffffffff904a2bd0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
#1: ffffffff8ea476a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x687/0xbc0 fs/nfsd/nfsctl.c:1596
3 locks held by kworker/u12:2/24849:
#0: ffff888058bc2948 ((wq_completion)hci10){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000cd67c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88801ef1cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
2 locks held by syz.1.4069/24872:
#0: ffffffff904a2bd0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
#1: ffffffff8ea476a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x687/0xbc0 fs/nfsd/nfsctl.c:1596
2 locks held by syz.5.4175/25466:
#0: ffffffff904a2bd0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
#1: ffffffff8ea476a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0xd5/0x1b20 fs/nfsd/nfsctl.c:1886
2 locks held by syz.3.4247/25821:
#0: ffffffff904a2bd0 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218
#1: ffffffff8ea476a8 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_threads_set_doit+0x687/0xbc0 fs/nfsd/nfsctl.c:1596
1 lock held by syz.8.4460/26848:
#0: ffffffff8e5ef7c0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x48/0x6d0 kernel/rcu/tree.c:3816
1 lock held by syz.9.4461/26857:
#0: ffffffff903dd430 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577
3 locks held by kworker/u12:3/26859:
#0: ffff888058bc4148 ((wq_completion)hci9){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000debfc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88804fa80ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:4/26866:
#0: ffff88803e570948 ((wq_completion)hci13){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000de7fc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff8880b37ccec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:5/26867:
#0: ffff88805a44e948 ((wq_completion)hci14){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000dedfc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888030cd8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:6/26868:
#0: ffff88807cf95948 ((wq_completion)hci18){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000dfa7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88802555cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:7/26870:
#0: ffff888077852948 ((wq_completion)hci19){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000dfc7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888043528ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:8/26871:
#0: ffff888012560948 ((wq_completion)hci20){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000dfd7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff8880675b0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:9/26873:
#0: ffff888031b48148 ((wq_completion)hci21){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000dff7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888067418ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:10/26874:
#0: ffff88801e737948 ((wq_completion)hci15){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e007c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888029960ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:11/26876:
#0: ffff888029262148 ((wq_completion)hci22){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e027c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888012580ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:12/26877:
#0: ffff88806a5dc148 ((wq_completion)hci26){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e037c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888081004ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:13/26879:
#0: ffff88806a5d9148 ((wq_completion)hci24){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e06fc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88806805cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:14/26882:
#0: ffff88804fce9948 ((wq_completion)hci27){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e0b7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888059470ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:15/26884:
#0: ffff88807ba51948 ((wq_completion)hci23){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e0d7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888064cf0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:16/26886:
#0:
ffff88806a5da948
(
(wq_completion)hci25
){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e0f7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2:
ffff888063c18ec0
(
&hdev->req_lock
){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:17/26888:
#0: ffff888029264148 ((wq_completion)hci16){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e117c98
((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff8880637d8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:18/26890:
#0: ffff88804fce8148 ((wq_completion)hci17){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e137c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888047d90ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
6 locks held by kworker/u12:19/26891:
3 locks held by kworker/u12:20/26894:
3 locks held by kworker/u12:21/26897:
#0: ffff88803d72e948 ((wq_completion)hci30){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e7bfc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888069218ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:22/26899:
#0: ffff88803cd9a948 ((wq_completion)hci34){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e7dfc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88805bc04ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:23/26901:
#0: ffff88806a5df148 ((wq_completion)hci32){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000de37c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888033a68ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:24/26904:
#0: ffff88803fb54948 ((wq_completion)hci41){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e80fc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88805d50cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:25/26905:
#0: ffff88803cd9b148 ((wq_completion)hci35){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e81fc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888030ec4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:26/26906:
#0: ffff8880b4055148 ((wq_completion)hci40){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1:
ffffc9000e82fc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2:
ffff88806d1e8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:27/26907:
#0: ffff888029d8a948 ((wq_completion)hci48){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e83fc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88805d2f0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:28/26909:
#0: ffff8880695ac948 ((wq_completion)hci49){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000e86fc98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff8880690a4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:29/26912:
#0:
ffff8880b3612148
(
(wq_completion)hci52
){+.+.}-{0:0}
, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1:
ffffc9000e8b7c98
(
(work_completion)(&hdev->power_on)
){+.+.}-{0:0}
, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2:
ffff88801e3e4ec0
(
&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:30/26913:
3 locks held by kworker/u12:31/26915:
4 locks held by kworker/u12:32/26916:
3 locks held by kworker/u12:33/26918:
3 locks held by kworker/u12:34/26919:
3 locks held by kworker/u12:35/26920:
3 locks held by kworker/u12:37/26922:
3 locks held by kworker/u12:38/26923:
3 locks held by kworker/u12:39/26924:
3 locks held by kworker/u12:40/26925:
3 locks held by kworker/u12:41/26926:
3 locks held by kworker/u12:42/26927:
3 locks held by kworker/u12:43/26928:
3 locks held by kworker/u12:44/26929:
3 locks held by kworker/u12:45/26930:
#0: ffff888034d57148 ((wq_completion)hci73){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000eed7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88802fba8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:46/26931:
#0: ffff888065dd7148 ((wq_completion)hci45){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000eee7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88802a4e8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:47/26932:
#0: ffff888029d8d948 ((wq_completion)hci50){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000eef7c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88807bc30ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:48/26933:
#0: ffff8880b3613948 ((wq_completion)hci54){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000ef07c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888055528ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:49/26934:
#0: ffff888029d8f148 ((wq_completion)hci53){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000ef17c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2:
ffff88802f7a0ec0
(
&hdev->req_lock
){+.+.}-{4:4}
, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:50/26935:
3 locks held by kworker/u12:51/26936:
#0: ffff8880b3615948 ((wq_completion)hci56){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000ef37c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff8880462a8ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:52/26937:
#0: ffff88802b730948 ((wq_completion)hci57){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000ef57c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888047738ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:53/26938:
#0: ffff888065dd3948 ((wq_completion)hci43){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000ef67c98 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88806a274ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:54/26939:
#0: ffff8880b363d948 (
(wq_completion)hci51
){+.+.}-{0:0}
, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1:
ffffc9000ef8fc98
(
(work_completion)(&hdev->power_on)
){+.+.}-{0:0}
, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2:
ffff8880449fcec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0xb0 net/bluetooth/hci_core.c:428
3 locks held by kworker/u12:55/26940:
3 locks held by kworker/u12:56/26941:
3 locks held by kworker/u12:57/26942:
3 locks held by kworker/u12:58/26943:
3 locks held by kworker/u12:59/26944:
3 locks held by kworker/u12:60/26945:
3 locks held by kworker/u12:61/26946:
5 locks held by kworker/u12:62/26947:
3 locks held by kworker/u12:63/26948:
3 locks held by kworker/u12:64/26949:
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G U L syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 26945 Comm: kworker/u12:60 Tainted: G U L syzkaller #0 PREEMPT(full)
Tainted: [U]=USER, [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: hci65 hci_power_on
RIP: 0010:io_serial_out+0x8f/0xb0 drivers/tty/serial/8250/8250_port.c:407
Code: 48 8d 7d 40 44 89 e1 48 b8 00 00 00 00 00 fc ff df 48 89 fa d3 e3 48 c1 ea 03 80 3c 02 00 75 1c 66 03 5d 40 44 89 e8 89 da ee <5b> 5d 41 5c 41 5d c3 cc cc cc cc e8 21 64 08 fd eb a0 e8 aa 64 08
RSP: 0018:ffffc9000f0173f8 EFLAGS: 00000002
RAX: 0000000000000033 RBX: 00000000000003f8 RCX: 0000000000000000
RDX: 00000000000003f8 RSI: ffffffff85674435 RDI: ffffffff9b1f3260
RBP: ffffffff9b1f3220 R08: 0000000000000001 R09: 000000000000001f
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000033 R14: 0000000000000010 R15: ffffffff856743d0
FS: 0000000000000000(0000) GS:ffff8881245e2000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6ec6a51e9c CR3: 000000006d696000 CR4: 00000000003526f0
Call Trace:
serial_port_out include/linux/serial_core.h:811 [inline]
serial8250_console_putchar drivers/tty/serial/8250/8250_port.c:3192 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3264 [inline]
serial8250_console_write+0xde8/0x1900 drivers/tty/serial/8250/8250_port.c:3342
console_emit_next_record kernel/printk/printk.c:3129 [inline]
console_flush_one_record+0x790/0xe50 kernel/printk/printk.c:3215
console_flush_all kernel/printk/printk.c:3289 [inline]
__console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
console_unlock+0x103/0x260 kernel/printk/printk.c:3359
vprintk_emit+0x407/0x6b0 kernel/printk/printk.c:2426
_printk+0xcf/0x110 kernel/printk/printk.c:2451
bt_err+0xec/0x122 net/bluetooth/lib.c:296
__hci_cmd_sync_status_sk+0x165/0x190 net/bluetooth/hci_sync.c:271
__hci_cmd_sync_status net/bluetooth/hci_sync.c:287 [inline]
hci_reset_sync net/bluetooth/hci_sync.c:3664 [inline]
hci_init1_sync net/bluetooth/hci_sync.c:3750 [inline]
hci_init_sync net/bluetooth/hci_sync.c:4886 [inline]
hci_dev_init_sync net/bluetooth/hci_sync.c:5078 [inline]
hci_dev_open_sync+0xce9/0x25c0 net/bluetooth/hci_sync.c:5156
hci_dev_do_open+0x2a/0xb0 net/bluetooth/hci_core.c:430
hci_power_on+0x131/0x630 net/bluetooth/hci_core.c:959
process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246