INFO: task kworker/1:0:23 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:24360 pid:23 ppid:2 flags:0x00004000 Workqueue: events_power_efficient crda_timeout_work Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x15ae/0x4660 kernel/sched/core.c:6701 schedule+0xbd/0x170 kernel/sched/core.c:6775 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747 crda_timeout_work+0x15/0x50 net/wireless/reg.c:539 process_one_work kernel/workqueue.c:2653 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 INFO: task kworker/1:2:788 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:2 state:D stack:24784 pid:788 ppid:2 flags:0x00004000 Workqueue: events reg_todo Call Trace: context_switch kernel/sched/core.c:5382 [inline] __schedule+0x15ae/0x4660 kernel/sched/core.c:6701 schedule+0xbd/0x170 kernel/sched/core.c:6775 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747 wiphy_lock include/net/cfg80211.h:5777 [inline] reg_process_self_managed_hints+0x80/0x130 net/wireless/reg.c:3182 reg_todo+0x875/0x970 net/wireless/reg.c:3195 process_one_work kernel/workqueue.c:2653 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Showing all locks held in the system: 2 locks held by kthreadd/2: 4 locks held by kworker/u4:0/11: 3 locks held by kworker/u4:1/12: #0: ffff88802c2f9d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff88802c2f9d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc90000117d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc90000117d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #2: ffffffff8e3d6b08 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4730 3 locks held by kworker/1:0/23: #0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc900001d7d00 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc900001d7d00 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #2: ffffffff8e3d6b08 (rtnl_mutex){+.+.}-{3:3}, at: crda_timeout_work+0x15/0x50 net/wireless/reg.c:539 1 lock held by khungtaskd/28: #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633 3 locks held by kworker/u4:2/41: 2 locks held by kworker/1:1/42: #0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc90000b2fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc90000b2fd00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 4 locks held by kworker/u4:3/48: 2 locks held by kworker/0:2/56: 4 locks held by kworker/u4:4/67: 4 locks held by kworker/1:2/788: #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc90003acfd00 (reg_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc90003acfd00 (reg_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #2: ffffffff8e3d6b08 (rtnl_mutex){+.+.}-{3:3}, at: reg_todo+0x1c/0x970 net/wireless/reg.c:3192 #3: ffff88807b6d8768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5777 [inline] #3: ffff88807b6d8768 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: reg_process_self_managed_hints+0x80/0x130 net/wireless/reg.c:3182 4 locks held by kworker/u4:5/1132: 4 locks held by kworker/u4:6/2924: 4 locks held by kworker/u4:7/2937: 3 locks held by kworker/u4:8/3419: 4 locks held by kworker/u4:9/3435: 3 locks held by kworker/u4:10/3459: 8 locks held by kworker/u4:11/3484: 4 locks held by kworker/u4:12/3525: 1 lock held by klogd/5131: 4 locks held by udevd/5142: 2 locks held by dhcpcd/5436: 5 locks held by dhcpcd/5437: 2 locks held by getty/5532: #0: ffff88802cc150a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032832f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217 4 locks held by syz-executor/5774: 3 locks held by kworker/1:3/5777: #0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc90004447d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc90004447d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #2: ffffffff8e3d6b08 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x92/0xd90 net/wireless/reg.c:2463 2 locks held by syz-executor/5788: 1 lock held by syz-executor/5789: #0: ffff88814cc08458 (&xt[i].mutex){+.+.}-{3:3}, at: xt_find_target+0x81/0x230 net/netfilter/x_tables.c:254 2 locks held by syz-executor/5790: 1 lock held by syz.0.168/6264: 7 locks held by syz.3.177/6283: 2 locks held by kworker/u4:13/6287: 2 locks held by kworker/u4:14/6288: 8 locks held by kworker/u4:15/6290: 3 locks held by kworker/1:6/6292: #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #1: ffffc9000330fd00 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline] #1: ffffc9000330fd00 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2730 #2: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline] #2: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004 3 locks held by kworker/u4:16/6293: 3 locks held by syz-executor/6294: 3 locks held by kworker/1:7/6295: ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xf59/0xfa0 kernel/hung_task.c:379 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 6290 Comm: kworker/u4:15 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:__sanitizer_cov_trace_switch+0x41/0xe0 kernel/kcov.c:-1 Code: c3 00 00 00 f3 48 0f bc c8 48 83 c1 fd 48 83 f9 03 0f 87 b0 00 00 00 48 8b 06 48 85 c0 0f 84 a4 00 00 00 41 57 41 56 41 54 53 <48> 8d 4c 09 01 48 8b 54 24 20 65 4c 8b 05 5d 3e 7c 7e 45 31 c9 eb RSP: 0018:ffffc900001efd90 EFLAGS: 00000202 RAX: 0000000000000008 RBX: 0000000000000000 RCX: 0000000000000001 RDX: 000000000000001f RSI: ffffffff8cfa05c0 RDI: 0000000000000005 RBP: ffffc900001efed8 R08: ffff888027dd5a00 R09: 0000000000000002 R10: 0000000000000001 R11: 0000000000000100 R12: ffffffff8f8c6ed2 R13: ffffc900001efe88 R14: 0000000000000005 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0307beb158 CR3: 000000000cf32000 CR4: 00000000003506e0 Call Trace: unwind_next_frame+0x748/0x2990 arch/x86/kernel/unwind_orc.c:515 arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1811 [inline] slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837 slab_free mm/slub.c:3830 [inline] __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843 skb_kfree_head net/core/skbuff.c:946 [inline] skb_free_head net/core/skbuff.c:958 [inline] skb_release_data+0x609/0x7f0 net/core/skbuff.c:988 skb_release_all net/core/skbuff.c:1054 [inline] __kfree_skb net/core/skbuff.c:1068 [inline] consume_skb+0xb2/0x110 net/core/skbuff.c:1284 nft_synproxy_eval_v4+0x36b/0x4e0 net/netfilter/nft_synproxy.c:-1 nft_synproxy_do_eval+0x332/0x550 net/netfilter/nft_synproxy.c:140 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x44b/0x1620 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x29b/0x380 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline] nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:259 [inline] NF_HOOK+0x21d/0x3b0 include/linux/netfilter.h:302 NF_HOOK+0x32d/0x3b0 include/linux/netfilter.h:304 __netif_receive_skb_one_core net/core/dev.c:5646 [inline] __netif_receive_skb+0xcc/0x290 net/core/dev.c:5760 process_backlog+0x380/0x710 net/core/dev.c:6088 __napi_poll+0xbb/0x460 net/core/dev.c:6650 napi_poll net/core/dev.c:6717 [inline] net_rx_action+0x65f/0xcc0 net/core/dev.c:6853 handle_softirqs+0x27d/0x820 kernel/softirq.c:578 do_softirq+0xfa/0x1a0 kernel/softirq.c:479 __local_bh_enable_ip+0x184/0x1c0 kernel/softirq.c:406 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_local_purge+0x2c1/0x340 net/batman-adv/translation-table.c:1416 batadv_tt_purge+0x35/0xa20 net/batman-adv/translation-table.c:3632 process_one_work kernel/workqueue.c:2653 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293