Extracting prog: 16m10.801134282s Minimizing prog: 1h4m11.752363671s Simplifying prog options: 9m25.065354225s Extracting C: 4m38.898745367s Simplifying C: 1h9m39.86896314s extracting reproducer from 32 programs testing a last program of every proc single: executing 7 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet6_int-accept4$tipc-setsockopt$TIPC_GROUP_JOIN-socketpair$unix-fsetxattr$trusted_overlay_origin-connect$unix-syz_open_procfs-read$FUSE-pread64-sendmmsg$unix-unshare-unshare-prctl$PR_SCHED_CORE-socket$nl_netfilter-syz_io_uring_setup-syz_fuse_handle_req-syz_usb_connect-preadv-ioctl$BLKZEROOUT detailed listing: executing program 0: setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xd1, 0x0, 0x0) r0 = accept4$tipc(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f00000000c0)={0x42, 0x1, 0x2}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000100), &(0x7f0000001140), 0x2, 0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) r3 = syz_open_procfs(0x0, &(0x7f0000000180)='net/ipv6_route\x00') read$FUSE(r3, &(0x7f00000061c0)={0x2020}, 0x2020) pread64(r3, &(0x7f0000003b00)=""/195, 0xc3, 0x591f) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) unshare(0x2000200) unshare(0x40000200) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_io_uring_setup(0x320, &(0x7f0000001280)={0x0, 0xb713, 0x400, 0x0, 0x1}, &(0x7f0000000000), &(0x7f0000001180), &(0x7f0000000000)) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0xf2, 0x207fff) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000000)={0x600, 0x1000000}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_j1939-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-socket$nl_route-keyctl$instantiate-add_key-add_key$user-keyctl$read-sendmsg$NFT_BATCH-syz_open_dev$dvb_demux-ioctl$DVB_DEMUX_DMX_SET_PES_FILTER-bind$inet6-sendto$inet6-ioctl$BTRFS_IOC_BALANCE_CTL-socket$igmp-unshare-capset-socket$netlink detailed listing: executing program 0: socket$can_j1939(0x1d, 0x2, 0x7) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$nl_route(0x10, 0x3, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r3 = add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f0000000080)="13", 0x1, 0xfffffffffffffffd) keyctl$read(0xb, r3, &(0x7f0000000240)=""/112, 0x349b7f55) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000000c0)=ANY=[], 0xf4}}, 0x4080) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x20000) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x800, &(0x7f00000002c0)={0xa, 0x4e23, 0x20000000, @loopback}, 0x1c) ioctl$BTRFS_IOC_BALANCE_CTL(r0, 0x40049421, 0x1) socket$igmp(0x2, 0x3, 0x2) unshare(0x22020600) capset(&(0x7f0000000040)={0x19980330}, &(0x7f0000000080)={0x6, 0xe, 0x13e, 0x89, 0xffffffff, 0x2}) socket$netlink(0x10, 0x3, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program crashed: INFO: task hung in addrconf_dad_work single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'veth0\x00'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00'}) sendmsg$nl_route_sched(r0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00'}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0x34, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in corrupted a never seen crash title: INFO: rcu detected stall in corrupted, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program crashed: INFO: task hung in addrconf_dad_work extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: task hung in addrconf_dad_work simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in advance_sched a never seen crash title: INFO: rcu detected stall in advance_sched, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in corrupted a never seen crash title: INFO: rcu detected stall in corrupted, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in advance_sched a never seen crash title: INFO: rcu detected stall in advance_sched, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: task hung in addrconf_dad_work testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in corrupted a never seen crash title: INFO: rcu detected stall in corrupted, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in corrupted a never seen crash title: INFO: rcu detected stall in corrupted, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in corrupted a never seen crash title: INFO: rcu detected stall in corrupted, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in corrupted a never seen crash title: INFO: rcu detected stall in corrupted, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: rcu detected stall in corrupted a never seen crash title: INFO: rcu detected stall in corrupted, ignore testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched program crashed: INFO: task hung in rtnetlink_rcv_msg a never seen crash title: INFO: task hung in rtnetlink_rcv_msg, ignore testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program crashed: INFO: rcu detected stall in corrupted validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program crashed: INFO: rcu detected stall in corrupted validation run: crashed=true testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newqdisc={0xa4, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x74, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x484}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xa4}}, 0x0) program crashed: INFO: task hung in synchronize_rcu validation run: crashed=true reproducing took 2h58m45.564432648s repro crashed as (corrupted=false): INFO: task kworker/u8:1:13 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:1 state:D stack:21760 pid:13 tgid:13 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x16dc/0x5500 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 __synchronize_srcu+0x23b/0x2f0 kernel/rcu/srcutree.c:1496 fsnotify_connector_destroy_workfn+0x44/0xb0 fs/notify/mark.c:385 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/u8:11:3105 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:11 state:D stack:21560 pid:3105 tgid:3105 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x16dc/0x5500 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 __synchronize_srcu+0x23b/0x2f0 kernel/rcu/srcutree.c:1496 fsnotify_mark_destroy_workfn+0x109/0x2f0 fs/notify/mark.c:1172 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 2 locks held by kworker/u8:1/13: #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90000127c40 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90000127c40 (connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 6 locks held by ktimers/1/29: 1 lock held by khungtaskd/38: #0: ffffffff8e1c3040 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8e1c3040 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8e1c3040 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 5 locks held by kworker/u8:2/43: 3 locks held by kworker/u8:3/56: #0: ffff88803102b138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88803102b138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000122fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000122fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x123/0x16e0 net/ipv6/addrconf.c:4229 5 locks held by kworker/u9:0/59: #0: ffff88805d076138 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88805d076138 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000125fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000125fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88803293cf80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff88803293c0b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 3 locks held by kworker/u8:7/1056: #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90005c8fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90005c8fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88805ee108d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6884 [inline] #2: ffff88805ee108d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:524 2 locks held by kworker/u8:11/3105: #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000df4fc40 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000df4fc40 ((reaper_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 3 locks held by kworker/u8:13/4273: #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000ef9fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000ef9fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88805e7508d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6884 [inline] #2: ffff88805e7508d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:524 5 locks held by kworker/u9:1/4897: #0: ffff88802c821938 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c821938 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90010597c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90010597c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888038a98f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff888038a980b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 2 locks held by getty/5337: #0: ffff8880290ee0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211 5 locks held by kworker/u9:2/5625: #0: ffff88802c51f138 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c51f138 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90004367c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90004367c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888029284f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff8880292840b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 1 lock held by syz-executor/5727: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 1 lock held by syz-executor/5728: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x65e/0xdf0 net/ipv6/addrconf.c:5062 2 locks held by syz-executor/5730: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 #1: ffff88805d67d978 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x227/0x420 drivers/net/wireguard/device.c:50 1 lock held by syz-executor/5731: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 3 locks held by kworker/1:4/5734: #0: ffff88813ff1e538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff1e538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003d17c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003d17c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xac/0x1110 net/wireless/reg.c:2469 5 locks held by kworker/u9:3/5735: #0: ffff88802c571938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c571938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003d97c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003d97c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88805cd64f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff88805cd640b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 6 locks held by kworker/u9:4/5737: #0: ffff88802c7b6138 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c7b6138 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003a07c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003a07c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888045f44f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff888045f440b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 #5: ffff88803bfb9370 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x520 net/bluetooth/l2cap_core.c:1808 5 locks held by kworker/u9:5/5738: #0: ffff88802c7b6938 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c7b6938 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003a67c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003a67c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888045f70f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff888045f700b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 1 lock held by syz-executor/5999: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 1 lock held by syz-executor/6012: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6013: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6016: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6020: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by dhcpcd/6035: #0: ffff8880254c6358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff8880254c6358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6036: #0: ffff88805f1c4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff88805f1c4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6037: #0: ffff88803afb4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff88803afb4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6038: #0: ffff8880265be358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff8880265be358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6039: #0: ffff888025ff6358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff888025ff6358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6040: #0: ffff88802754e358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff88802754e358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by syz-executor/6042: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6053: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6054: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6055: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6058: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 4 locks held by kworker/u9:7/6075: #0: ffff888032d78138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888032d78138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90004677c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90004677c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff8880356880b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3714 #3: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #3: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3748 1 lock held by syz-executor/6077: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:lookup_chain_cache kernel/locking/lockdep.c:-1 [inline] RIP: 0010:lookup_chain_cache_add kernel/locking/lockdep.c:3821 [inline] RIP: 0010:validate_chain kernel/locking/lockdep.c:3876 [inline] RIP: 0010:__lock_acquire+0xaba/0x2ce0 kernel/locking/lockdep.c:5237 Code: c6 4a 3d 9a 8d 67 48 0f b9 3a 90 48 bb eb 83 b5 80 46 86 c8 61 48 0f af dd 48 c1 eb 2d 48 8b 04 dd 00 15 62 93 48 85 c0 74 1c <48> 83 c0 f8 74 16 48 8b 48 18 48 39 e9 0f 84 bb 01 00 00 48 8b 40 RSP: 0018:ffffc90000a3f858 EFLAGS: 00000086 RAX: ffffffff93d843b8 RBX: 000000000006e0bd RCX: 0000000000040000 RDX: 00000000442a0012 RSI: 000000005b213290 RDI: ffff88801d2b3e00 RBP: 8ccf27b01246fe5e R08: ffffffff8952a0a8 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88805ee6e400 R12: ffff88801d2b4aa8 R13: ffff88801d2b4aa8 R14: ffff88801d2b3e00 R15: 0000000000000004 FS: 0000000000000000(0000) GS:ffff888125d3a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005594ccf0da38 CR3: 000000000dfb0000 CR4: 00000000003526f0 Call Trace: lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56 spin_lock include/linux/spinlock_rt.h:45 [inline] advance_sched+0xc8/0xc90 net/sched/sch_taprio.c:930 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x18f/0x260 kernel/time/hrtimer.c:2113 handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 final repro crashed as (corrupted=false): INFO: task kworker/u8:1:13 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:1 state:D stack:21760 pid:13 tgid:13 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x16dc/0x5500 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 __synchronize_srcu+0x23b/0x2f0 kernel/rcu/srcutree.c:1496 fsnotify_connector_destroy_workfn+0x44/0xb0 fs/notify/mark.c:385 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/u8:11:3105 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:11 state:D stack:21560 pid:3105 tgid:3105 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5510 [inline] __schedule+0x16dc/0x5500 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7326 schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153 __synchronize_srcu+0x23b/0x2f0 kernel/rcu/srcutree.c:1496 fsnotify_mark_destroy_workfn+0x109/0x2f0 fs/notify/mark.c:1172 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: 2 locks held by kworker/u8:1/13: #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90000127c40 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90000127c40 (connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 6 locks held by ktimers/1/29: 1 lock held by khungtaskd/38: #0: ffffffff8e1c3040 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8e1c3040 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffffffff8e1c3040 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 5 locks held by kworker/u8:2/43: 3 locks held by kworker/u8:3/56: #0: ffff88803102b138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88803102b138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000122fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000122fc40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x123/0x16e0 net/ipv6/addrconf.c:4229 5 locks held by kworker/u9:0/59: #0: ffff88805d076138 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88805d076138 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000125fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000125fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88803293cf80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff88803293c0b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 3 locks held by kworker/u8:7/1056: #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90005c8fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90005c8fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88805ee108d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6884 [inline] #2: ffff88805ee108d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:524 2 locks held by kworker/u8:11/3105: #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000df4fc40 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000df4fc40 ((reaper_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 3 locks held by kworker/u8:13/4273: #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc9000ef9fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc9000ef9fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88805e7508d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6884 [inline] #2: ffff88805e7508d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:524 5 locks held by kworker/u9:1/4897: #0: ffff88802c821938 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c821938 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90010597c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90010597c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888038a98f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff888038a980b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 2 locks held by getty/5337: #0: ffff8880290ee0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211 5 locks held by kworker/u9:2/5625: #0: ffff88802c51f138 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c51f138 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90004367c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90004367c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888029284f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff8880292840b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 1 lock held by syz-executor/5727: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 1 lock held by syz-executor/5728: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x65e/0xdf0 net/ipv6/addrconf.c:5062 2 locks held by syz-executor/5730: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 #1: ffff88805d67d978 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x227/0x420 drivers/net/wireguard/device.c:50 1 lock held by syz-executor/5731: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 3 locks held by kworker/1:4/5734: #0: ffff88813ff1e538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88813ff1e538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003d17c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003d17c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xac/0x1110 net/wireless/reg.c:2469 5 locks held by kworker/u9:3/5735: #0: ffff88802c571938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c571938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003d97c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003d97c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff88805cd64f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff88805cd640b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 6 locks held by kworker/u9:4/5737: #0: ffff88802c7b6138 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c7b6138 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003a07c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003a07c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888045f44f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff888045f440b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 #5: ffff88803bfb9370 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x520 net/bluetooth/l2cap_core.c:1808 5 locks held by kworker/u9:5/5738: #0: ffff88802c7b6938 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff88802c7b6938 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90003a67c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90003a67c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff888045f70f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331 #3: ffff888045f700b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894 #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #4: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410 1 lock held by syz-executor/5999: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158 1 lock held by syz-executor/6012: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6013: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6016: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6020: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by dhcpcd/6035: #0: ffff8880254c6358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff8880254c6358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6036: #0: ffff88805f1c4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff88805f1c4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6037: #0: ffff88803afb4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff88803afb4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6038: #0: ffff8880265be358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff8880265be358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6039: #0: ffff888025ff6358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff888025ff6358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by dhcpcd/6040: #0: ffff88802754e358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline] #0: ffff88802754e358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229 1 lock held by syz-executor/6042: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6053: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6054: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6055: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 1 lock held by syz-executor/6058: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 4 locks held by kworker/u9:7/6075: #0: ffff888032d78138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff888032d78138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #1: ffffc90004677c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffffc90004677c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405 #2: ffff8880356880b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3714 #3: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline] #3: ffffffff8f7350d8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3748 1 lock held by syz-executor/6077: #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8f5ac938 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd7/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:lookup_chain_cache kernel/locking/lockdep.c:-1 [inline] RIP: 0010:lookup_chain_cache_add kernel/locking/lockdep.c:3821 [inline] RIP: 0010:validate_chain kernel/locking/lockdep.c:3876 [inline] RIP: 0010:__lock_acquire+0xaba/0x2ce0 kernel/locking/lockdep.c:5237 Code: c6 4a 3d 9a 8d 67 48 0f b9 3a 90 48 bb eb 83 b5 80 46 86 c8 61 48 0f af dd 48 c1 eb 2d 48 8b 04 dd 00 15 62 93 48 85 c0 74 1c <48> 83 c0 f8 74 16 48 8b 48 18 48 39 e9 0f 84 bb 01 00 00 48 8b 40 RSP: 0018:ffffc90000a3f858 EFLAGS: 00000086 RAX: ffffffff93d843b8 RBX: 000000000006e0bd RCX: 0000000000040000 RDX: 00000000442a0012 RSI: 000000005b213290 RDI: ffff88801d2b3e00 RBP: 8ccf27b01246fe5e R08: ffffffff8952a0a8 R09: 0000000000000000 R10: 0000000000000000 R11: ffff88805ee6e400 R12: ffff88801d2b4aa8 R13: ffff88801d2b4aa8 R14: ffff88801d2b3e00 R15: 0000000000000004 FS: 0000000000000000(0000) GS:ffff888125d3a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005594ccf0da38 CR3: 000000000dfb0000 CR4: 00000000003526f0 Call Trace: lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5868 rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56 spin_lock include/linux/spinlock_rt.h:45 [inline] advance_sched+0xc8/0xc90 net/sched/sch_taprio.c:930 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x18f/0x260 kernel/time/hrtimer.c:2113 handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0x69/0x100 kernel/softirq.c:1151 smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245