INFO: task kworker/1:1:47 blocked for more than 143 seconds. Not tainted 6.15.0-rc4-syzkaller-00011-gf15d97df5afa #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:1 state:D stack:21672 pid:47 tgid:47 ppid:2 task_flags:0x4208060 flags:0x00004000 Workqueue: events rfkill_sync_work Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x16e2/0x4cd0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0x165/0x360 kernel/sched/core.c:6860 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 device_lock include/linux/device.h:922 [inline] nfc_dev_down net/nfc/core.c:143 [inline] nfc_rfkill_set_block+0x50/0x2e0 net/nfc/core.c:179 rfkill_set_block+0x1d2/0x440 net/rfkill/core.c:346 rfkill_sync net/rfkill/core.c:379 [inline] rfkill_sync_work+0x114/0x200 net/rfkill/core.c:1056 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/1:5:5930 blocked for more than 143 seconds. Not tainted 6.15.0-rc4-syzkaller-00011-gf15d97df5afa #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:5 state:D stack:22408 pid:5930 tgid:5930 ppid:2 task_flags:0x4208060 flags:0x00004000 Workqueue: events rfkill_global_led_trigger_worker Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x16e2/0x4cd0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0x165/0x360 kernel/sched/core.c:6860 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917 __mutex_lock_common kernel/locking/mutex.c:678 [inline] __mutex_lock+0x724/0xe80 kernel/locking/mutex.c:746 rfkill_global_led_trigger_worker+0x27/0xd0 net/rfkill/core.c:182 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz.5.817:8699 blocked for more than 143 seconds. Not tainted 6.15.0-rc4-syzkaller-00011-gf15d97df5afa #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.817 state:D stack:25400 pid:8699 tgid:8699 ppid:5843 task_flags:0x400040 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x16e2/0x4cd0 kernel/sched/core.c:6767 __schedule_loop kernel/sched/core.c:6845 [inline] schedule+0x165/0x360 kernel/sched/core.c:6860 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:148 __flush_work+0x9b9/0xbc0 kernel/workqueue.c:4244 __cancel_work_sync+0xbe/0x110 kernel/workqueue.c:4364 rfkill_unregister+0x92/0x220 net/rfkill/core.c:1139 nfc_unregister_device+0x96/0x2a0 net/nfc/core.c:1167 virtual_ncidev_close+0x56/0x90 drivers/nfc/virtual_ncidev.c:172 __fput+0x44c/0xa70 fs/file_table.c:465 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work+0x5e/0x80 include/linux/resume_user_mode.h:50 exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x9a/0x120 kernel/entry/common.c:218 do_syscall_64+0x103/0x210 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f888ff8e969 RSP: 002b:00007ffcc4c05838 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f88901b7ba0 RCX: 00007f888ff8e969 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f88901b7ba0 R08: 0000000000000c50 R09: 00000006c4c05b2f R10: 00000000003ff18c R11: 0000000000000246 R12: 0000000000053762 R13: 00007f88901b6080 R14: ffffffffffffffff R15: 00007ffcc4c05950 Showing all locks held in the system: 6 locks held by kworker/u8:0/12: #0: ffff8880b8839b58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 kernel/sched/core.c:613 #1: ffff8880b8823b08 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x39e/0x6d0 kernel/sched/psi.c:987 #2: ffff8880b8825558 (&base->lock){-.-.}-{2:2}, at: lock_timer_base kernel/time/timer.c:1046 [inline] #2: ffff8880b8825558 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1ae/0xf30 kernel/time/timer.c:1127 #3: ffffffff999d87b8 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0xbb/0x420 lib/debugobjects.c:818 #4: ffffffff8dde7c08 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145 #5: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #5: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #5: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x29/0x2a0 mm/pgtable-generic.c:287 1 lock held by khungtaskd/31: #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8df3b860 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6764 4 locks held by kworker/1:1/47: #0: ffff88801a078d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801a078d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc90000b87c60 ((work_completion)(&rfkill->sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90000b87c60 ((work_completion)(&rfkill->sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8f5c7fe8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_sync_work+0x2e/0x200 net/rfkill/core.c:1055 #3: ffff88807dc17100 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline] #3: ffff88807dc17100 (&dev->mutex){....}-{4:4}, at: nfc_dev_down net/nfc/core.c:143 [inline] #3: ffff88807dc17100 (&dev->mutex){....}-{4:4}, at: nfc_rfkill_set_block+0x50/0x2e0 net/nfc/core.c:179 2 locks held by getty/5577: #0: ffff88802ffde0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900033532f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222 3 locks held by kworker/1:5/5930: #0: ffff88801a078d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline] #0: ffff88801a078d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b1/0x17a0 kernel/workqueue.c:3319 #1: ffffc90004d77c60 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline] #1: ffffc90004d77c60 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ec/0x17a0 kernel/workqueue.c:3319 #2: ffffffff8f5c7fe8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_global_led_trigger_worker+0x27/0xd0 net/rfkill/core.c:182 1 lock held by syz.5.817/8699: #0: ffff88807dc17100 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:922 [inline] #0: ffff88807dc17100 (&dev->mutex){....}-{4:4}, at: nfc_unregister_device+0x63/0x2a0 net/nfc/core.c:1165 2 locks held by syz-executor/8902: #0: ffff888079c41118 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x6e0 drivers/bluetooth/hci_vhci.c:470 #1: ffffffff8f5c7fe8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_register+0x37/0x8e0 net/rfkill/core.c:1071 1 lock held by syz.1.990/9270: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 2 locks held by syz.3.991/9275: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 #1: ffffffff8f5c7fe8 (rfkill_global_mutex){+.+.}-{4:4}, at: rfkill_fop_open+0x12d/0x820 net/rfkill/core.c:1178 1 lock held by syz.4.995/9286: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz.0.1001/9309: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz.2.1006/9327: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9331: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9332: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9334: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9336: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9338: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9340: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9342: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9344: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9346: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9348: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9350: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 1 lock held by syz-executor/9352: #0: ffffffff8e7ad068 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x51/0x330 drivers/char/misc.c:143 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc4-syzkaller-00011-gf15d97df5afa #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline] watchdog+0xfee/0x1030 kernel/hung_task.c:437 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 6444 Comm: kworker/u8:11 Not tainted 6.15.0-rc4-syzkaller-00011-gf15d97df5afa #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025 Workqueue: events_unbound toggle_allocation_gate RIP: 0010:set_ptes arch/x86/include/asm/jump_label.h:-1 [inline] RIP: 0010:__text_poke+0x410/0xbf0 arch/x86/kernel/alternative.c:2279 Code: 0f 95 c0 20 d8 0f b6 c0 48 f7 d8 49 31 c7 4d 21 e7 4d 09 ef 4c 8b 2d 6f de 2f 0c 48 89 44 24 68 e9 79 07 00 00 e8 90 57 59 00 <4c> 89 7c 24 10 4c 8b 7c 24 10 48 8b 5c 24 18 49 89 dd 49 c1 ed 03 RSP: 0018:ffffc9000f7cf740 EFLAGS: 00000082 RAX: ffffffff822ca8f7 RBX: 0000000000000000 RCX: ffff88802eca5a00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000005 RBP: ffffc9000f7cf890 R08: ffffffff8f7ec977 R09: 1ffffffff1efd92e R10: dffffc0000000000 R11: fffffbfff1efd92f R12: 000ffffffffff000 R13: ffff88801a070000 R14: 8000000000000063 R15: 8000000002170063 FS: 0000000000000000(0000) GS:ffff8881260cc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f19d0e51cd5 CR3: 000000000dd36000 CR4: 0000000000350ef0 Call Trace: text_poke arch/x86/kernel/alternative.c:2354 [inline] text_poke_bp_batch+0x76b/0x940 arch/x86/kernel/alternative.c:2743 text_poke_flush arch/x86/kernel/alternative.c:2856 [inline] text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2863 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146 static_key_disable_cpuslocked+0xc5/0x1b0 kernel/jump_label.c:240 static_key_disable+0x1a/0x20 kernel/jump_label.c:248 toggle_allocation_gate+0x1a1/0x240 mm/kfence/core.c:855 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17a0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x4e/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245