INFO: task rcu_tasks_trace:13 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:rcu_tasks_trace state:D stack:26880 pid:13 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 rcu_tasks_wait_gp+0x49f/0xac0 kernel/rcu/tasks.h:693 rcu_tasks_one_gp+0xd27/0xef0 kernel/rcu/tasks.h:534 rcu_tasks_kthread+0x6e/0x90 kernel/rcu/tasks.h:562 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:6:4332 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:6 state:D stack:22544 pid:4332 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138 __synchronize_srcu+0x2b3/0x350 kernel/rcu/srcutree.c:1243 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:10:5164 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:10 state:D stack:22208 pid:5164 ppid:2 flags:0x00004000 Workqueue: quota_events_unbound quota_release_workfn Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138 __synchronize_srcu+0x2b3/0x350 kernel/rcu/srcutree.c:1243 quota_release_workfn+0x109/0x5e0 fs/quota/dquot.c:855 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 process_scheduled_works kernel/workqueue.c:2355 [inline] worker_thread+0xdd1/0x12a0 kernel/workqueue.c:2444 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:23:5193 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:23 state:D stack:22960 pid:5193 ppid:2 flags:0x00004000 Workqueue: events_unbound cfg80211_wiphy_work Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 __sta_info_destroy+0x33/0x50 net/mac80211/sta_info.c:1346 ieee80211_ibss_sta_expire net/mac80211/ibss.c:1278 [inline] ieee80211_sta_merge_ibss net/mac80211/ibss.c:1299 [inline] ieee80211_ibss_work+0x78f/0x1100 net/mac80211/ibss.c:1708 cfg80211_wiphy_work+0x224/0x260 net/wireless/core.c:433 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:26:5199 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:26 state:D stack:22800 pid:5199 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138 __synchronize_srcu+0x2b3/0x350 kernel/rcu/srcutree.c:1243 fsnotify_mark_destroy_workfn+0x106/0x2e0 fs/notify/mark.c:928 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task udevd:5979 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:23088 pid:5979 ppid:3639 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747 device_lock include/linux/device.h:885 [inline] uevent_show+0x16e/0x320 drivers/base/core.c:2669 dev_attr_show+0x50/0xb0 drivers/base/core.c:2372 sysfs_kf_seq_show+0x349/0x4b0 fs/sysfs/file.c:59 seq_read_iter+0x460/0xc50 fs/seq_file.c:230 call_read_iter include/linux/fs.h:2265 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x471/0x960 fs/read_write.c:470 ksys_read+0x14d/0x260 fs/read_write.c:613 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff4c18a7407 RSP: 002b:00007fff832f5bc0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007ff4c1f45880 RCX: 00007ff4c18a7407 RDX: 0000000000001000 RSI: 000055d5625f71b0 RDI: 0000000000000008 RBP: 00007ff4c19efff0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a R13: 00007ff4c19efea0 R14: 0000000000000000 R15: 000055d5625e20d0 INFO: task syz-executor:11109 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22352 pid:11109 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138 __flush_work+0x938/0xac0 kernel/workqueue.c:3076 flush_work kernel/workqueue.c:3097 [inline] flush_delayed_work+0x12d/0x180 kernel/workqueue.c:3221 invalidate_dquots fs/quota/dquot.c:606 [inline] dquot_disable+0x71f/0x1bc0 fs/quota/dquot.c:2333 ext4_quota_off+0xe9/0x530 fs/ext4/super.c:7129 ext4_quota_off_umount fs/ext4/super.c:1176 [inline] ext4_put_super+0xc9/0xc00 fs/ext4/super.c:1286 generic_shutdown_super+0x130/0x340 fs/super.c:501 kill_block_super+0x7c/0xe0 fs/super.c:1481 deactivate_locked_super+0x93/0xf0 fs/super.c:332 cleanup_mnt+0x471/0x4f0 fs/namespace.c:1191 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213 __syscall_exit_to_user_mode_work kernel/entry/common.c:295 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:306 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fdc5f79f3d7 RSP: 002b:00007fff49baf328 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 00007fdc5f8344fb RCX: 00007fdc5f79f3d7 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff49baf3e0 RBP: 00007fff49baf3e0 R08: 00007fff49bb03e0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff49bb0470 R13: 00007fdc5f8344fb R14: 000000000007ac4c R15: 00007fff49bb04b0 INFO: task khidpd_4c4a4155:13320 blocked for more than 147 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:khidpd_4c4a4155 state:D stack:28592 pid:13320 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c2/0x590 kernel/sched/completion.c:138 __flush_work+0x938/0xac0 kernel/workqueue.c:3076 __cancel_work_timer+0x3f4/0x560 kernel/workqueue.c:3163 hidp_session_remove+0xaa/0x2a0 net/bluetooth/hidp/core.c:1199 l2cap_unregister_user+0x180/0x1a0 net/bluetooth/l2cap_core.c:1786 hidp_session_thread+0x18d2/0x1960 net/bluetooth/hidp/core.c:1335 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz.0.2885:13322 blocked for more than 147 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.2885 state:D stack:26256 pid:13322 ppid:10233 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 synchronize_rcu_expedited+0x6e6/0x890 kernel/rcu/tree_exp.h:977 __tun_detach+0x8ac/0x1590 drivers/net/tun.c:669 tun_detach drivers/net/tun.c:701 [inline] tun_chr_close+0x109/0x1b0 drivers/net/tun.c:3506 __fput+0x20a/0x8b0 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213 __syscall_exit_to_user_mode_work kernel/entry/common.c:295 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:306 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f1aff99e199 RSP: 002b:00007ffeffaf1628 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffeffaf1710 RCX: 00007f1aff99e199 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 000000000007adb8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b32920000 R11: 0000000000000246 R12: 00007ffeffaf1750 R13: 00007f1affc25fac R14: 000000000007ae1a R15: 00007f1affc25fa0 INFO: task syz.9.2887:13329 blocked for more than 148 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.9.2887 state:D stack:27440 pid:13329 ppid:12714 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5246 [inline] __schedule+0x107f/0x4030 kernel/sched/core.c:6563 schedule+0xb9/0x180 kernel/sched/core.c:6639 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 namespace_unlock+0x23f/0x440 fs/namespace.c:1502 drop_collected_mounts fs/namespace.c:1991 [inline] put_mnt_ns+0xdb/0x120 fs/namespace.c:4493 free_nsproxy+0x49/0x3c0 kernel/nsproxy.c:191 do_exit+0x9d0/0x2570 kernel/exit.c:886 do_group_exit+0x229/0x2e0 kernel/exit.c:1030 get_signal+0x1259/0x1340 kernel/signal.c:2884 arch_do_signal_or_restart+0xc4/0x1310 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213 __syscall_exit_to_user_mode_work kernel/entry/common.c:295 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:306 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f3f9d79e199 RSP: 002b:00007f3f9e6320e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007f3f9da25fa8 RCX: 00007f3f9d79e199 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f3f9da25fac RBP: 00007f3f9da25fa0 R08: 001ae15493eba67d R09: 0000000000000000 R10: 000000000000005e R11: 0000000000000246 R12: 0000000000000000 R13: 00007f3f9da26038 R14: 00007fff54be4de0 R15: 00007fff54be4ec8 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8cb2e230 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8cb2ea50 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517 1 lock held by khungtaskd/28: #0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8cb2d8a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6669 5 locks held by kworker/u4:2/29: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90000a5fd00 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffff8880293507a8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5694 [inline] #2: ffff8880293507a8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x31/0x260 net/wireless/core.c:420 #3: ffff888062d10d40 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1119 [inline] #3: ffff888062d10d40 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0xa8/0x1100 net/mac80211/ibss.c:1680 #4: ffff888029351760 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_sta_expire net/mac80211/ibss.c:1256 [inline] ffff888029351760 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_sta_merge_ibss net/mac80211/ibss.c:1299 [inline] ffff888029351760 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0x580/0x1100 net/mac80211/ibss.c:1708 2 locks held by getty/4028: #0: ffff88814dc68098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 drivers/tty/n_tty.c:2198 6 locks held by kworker/0:6/4317: 2 locks held by kworker/u4:6/4332: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90004447d00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 2 locks held by kworker/u4:10/5164: #0: ffff8881416f3938 ((wq_completion)quota_events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc9000683fd00 ((quota_release_work).work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 3 locks held by kworker/u4:16/5179: 4 locks held by kworker/u4:21/5189: #0: ffff88801761e938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc9000c84fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd49ed0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:594 #3: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x18/0x1c0 drivers/net/wireguard/device.c:420 5 locks held by kworker/u4:23/5193: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc9000c88fd00 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffff888078f187a8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5694 [inline] #2: ffff888078f187a8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_wiphy_work+0x31/0x260 net/wireless/core.c:420 #3: ffff8880731e4d40 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1119 [inline] #3: ffff8880731e4d40 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0xa8/0x1100 net/mac80211/ibss.c:1680 #4: ffff888078f19760 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_sta_expire net/mac80211/ibss.c:1256 [inline] #4: ffff888078f19760 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_sta_merge_ibss net/mac80211/ibss.c:1299 [inline] #4: ffff888078f19760 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0x580/0x1100 net/mac80211/ibss.c:1708 2 locks held by kworker/u4:26/5199: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc9000c8efd00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 3 locks held by kworker/1:15/5826: #0: ffff888017471938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc90004027d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3} , at: reg_check_chans_work+0x82/0xd40 net/wireless/reg.c:2499 4 locks held by udevd/5979: #0: ffff8880674fe1c8 ( &p->lock ){+.+.}-{3:3}, at: seq_read_iter+0x9d/0xc50 fs/seq_file.c:182 #1: ffff888061c03088 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x59/0x410 fs/kernfs/file.c:172 #2: ffff8880226d0578 (kn->active#5){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff8880226d0578 (kn->active#5){++++}-{0:0}, at: kernfs_seq_start+0xae/0x410 fs/kernfs/file.c:173 #3: ffff888043f65a20 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:885 [inline] #3: ffff888043f65a20 (&dev->mutex){....}-{3:3}, at: uevent_show+0x16e/0x320 drivers/base/core.c:2669 3 locks held by kworker/1:17/8420: #0: ffff88802f137d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #1: ffffc900039a7d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4687 1 lock held by syz-executor/11109: #0: ffff8880657000e0 (&type->s_umount_key#32){++++}-{3:3}, at: deactivate_super+0xa0/0xd0 fs/super.c:362 2 locks held by khidpd_4c4a4155/13320: #0: ffff888022c30428 (&hdev->lock){+.+.}-{3:3}, at: l2cap_unregister_user+0x67/0x1a0 net/bluetooth/l2cap_core.c:1780 #1: ffffffff8dee0db0 (hidp_session_sem){++++}-{3:3}, at: hidp_session_remove+0x28/0x2a0 net/bluetooth/hidp/core.c:1186 2 locks held by syz.0.2885/13322: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3506 #1: ffffffff8cb33578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #1: ffffffff8cb33578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962 1 lock held by syz.9.2887/13329: #0: ffffffff8cb33578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #0: ffffffff8cb33578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 1 lock held by syz.8.2889/13331: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by dhcpcd/13334: #0: ffff888062dd4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 4 locks held by syz.5.2892/13338: #0: ffffffff8ddb7a50 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860 #1: ffff8880623e4698 (nlk_cb_mutex-GENERIC){+.+.}-{3:3}, at: __netlink_dump_start+0x11e/0x6f0 net/netlink/af_netlink.c:2310 #2: ffffffff8ddb7868 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #2: ffffffff8ddb7868 (genl_mutex){+.+.}-{3:3}, at: genl_lock_dumpit+0x47/0x90 net/netlink/genetlink.c:639 #3: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: nl802154_dump_wpan_phy+0x9a/0x990 net/ieee802154/nl802154.c:585 2 locks held by syz.5.2892/13339: #0: ffffffff8ddb7a50 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860 #1: ffffffff8ddb7868 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #1: ffffffff8ddb7868 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x107/0x790 net/netlink/genetlink.c:848 2 locks held by syz.5.2892/13340: #0: ffffffff8ddb7a50 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860 #1: ffffffff8ddb7868 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #1: ffffffff8ddb7868 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x107/0x790 net/netlink/genetlink.c:848 1 lock held by dhcpcd/13341: #0: ffff888028442130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888028442130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13342: #0: ffff8880274f0130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff8880274f0130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13343: #0: ffff8880445bc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff8880445bc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13344: #0: ffff888056158130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888056158130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13345: #0: ffff88802b07a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88802b07a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13346: #0: ffff88802b078130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88802b078130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13347: #0: ffff88807a562130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88807a562130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13348: #0: ffff8880772de130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff8880772de130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13349: #0: ffff8880772dc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff8880772dc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13350: #0: ffff888027aa4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888027aa4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13351: #0: ffff888044160130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888044160130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13352: #0: ffff8880641bc130 (sk_lock-AF_PACKET){+.+.}-{0:0} , at: lock_sock include/net/sock.h:1805 [inline] , at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13353: #0: ffff888078c4c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888078c4c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by syz-executor/13357: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13359: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13363: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13365: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13367: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by dhcpcd/13371: #0: ffff888055f24130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff888055f24130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13372: #0: ffff888066bd0130 (sk_lock-AF_PACKET){+.+.}-{0:0} , at: lock_sock include/net/sock.h:1805 [inline] , at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13373: #0: ffff88804561a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88804561a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13374: #0: ffff88806083a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88806083a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by dhcpcd/13376: #0: ffff888074804130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] ffff888074804130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3285 1 lock held by syz-executor/13379: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13380: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13386: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13387: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13390: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13395: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13397: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13402: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13404: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 1 lock held by syz-executor/13406: #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd56d68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xf0e/0xf50 kernel/hung_task.c:377 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4317 Comm: kworker/0:6 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Workqueue: events hidp_session_dev_work RIP: 0010:memset+0x22/0x40 mm/kasan/shadow.c:47 Code: 00 00 00 e9 b0 ec ff ff 55 41 56 53 48 89 d3 89 f5 49 89 fe 48 8b 4c 24 18 48 89 d6 ba 01 00 00 00 e8 92 ec ff ff 84 c0 74 11 <4c> 89 f7 89 ee 48 89 da 5b 41 5e 5d e9 7d 4a 54 08 31 c0 5b 41 5e RSP: 0018:ffffc900043c6ae0 EFLAGS: 00000202 RAX: ffffffff8a24d901 RBX: 0000000000000018 RCX: ffffffff8a24da05 RDX: 0000000000000001 RSI: 0000000000000018 RDI: ffffc900043c6b80 RBP: 0000000000000000 R08: ffffc900043c6b97 R09: 1ffff92000878d72 R10: dffffc0000000000 R11: fffff52000878d73 R12: ffffffffffffffff R13: 00000000000eb5c4 R14: ffffc900043c6b80 R15: ffff0a1000000609 FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005640294fc000 CR3: 000000007c511000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: number+0x285/0xef0 lib/vsprintf.c:458 vsnprintf+0x12d3/0x1c20 lib/vsprintf.c:2871 sprintf+0xe4/0x140 lib/vsprintf.c:3009 print_time kernel/printk/printk.c:1274 [inline] info_print_prefix+0x168/0x360 kernel/printk/printk.c:1300 record_print_text+0x17e/0x4a0 kernel/printk/printk.c:1349 console_emit_next_record+0x5a4/0xb50 kernel/printk/printk.c:2760 console_flush_all kernel/printk/printk.c:-1 [inline] console_unlock+0x223/0x630 kernel/printk/printk.c:2906 vprintk_emit+0x4b3/0x6a0 kernel/printk/printk.c:2303 dev_vprintk_emit+0x32c/0x3de drivers/base/core.c:4948 dev_printk_emit+0xeb/0x139 drivers/base/core.c:4959 _dev_warn+0x11b/0x16c drivers/base/core.c:5015 hid_parser_main+0x7d3/0xb80 drivers/hid/hid-core.c:643 hid_open_report+0x84c/0xed0 drivers/hid/hid-core.c:1287 hid_parse include/linux/hid.h:1135 [inline] hid_generic_probe+0x39/0x80 drivers/hid/hid-generic.c:63 __hid_device_probe drivers/hid/hid-core.c:2678 [inline] hid_device_probe+0x2b8/0x520 drivers/hid/hid-core.c:2717 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x24a/0xb40 drivers/base/dd.c:638 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:804 driver_probe_device+0x4f/0x420 drivers/base/dd.c:834 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:962 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a7/0x480 drivers/base/dd.c:1034 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489 device_add+0xbcf/0x1050 drivers/base/core.c:3712 hid_add_device+0x361/0x500 drivers/hid/hid-core.c:2863 hidp_session_dev_add net/bluetooth/hidp/core.c:876 [inline] hidp_session_dev_work+0x41/0x150 net/bluetooth/hidp/core.c:915 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295