INFO: task syz-executor:18510 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:25384 pid:18510 ppid:1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
rtnl_lock net/core/rtnetlink.c:78 [inline]
rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x4a9/0x6b0 net/socket.c:2201
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0xf0 net/socket.c:2209
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0b9f35e90e
RSP: 002b:00007ffcc98d2d48 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555571cd7500 RCX: 00007f0b9f35e90e
RDX: 0000000000000028 RSI: 00007f0ba0154670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffcc98d2dc4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f0ba0154670 R15: 0000000000000000
</TASK>
INFO: task syz-executor:18514 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:25384 pid:18514 ppid:1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
rtnl_lock net/core/rtnetlink.c:78 [inline]
rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x4a9/0x6b0 net/socket.c:2201
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0xf0 net/socket.c:2209
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f443755e90e
RSP: 002b:00007ffd5b4041b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555556c62500 RCX: 00007f443755e90e
RDX: 0000000000000028 RSI: 00007f4438354670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffd5b404234 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f4438354670 R15: 0000000000000000
</TASK>
INFO: task syz-executor:18518 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:25384 pid:18518 ppid:1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
rtnl_lock net/core/rtnetlink.c:78 [inline]
rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x4a9/0x6b0 net/socket.c:2201
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0xf0 net/socket.c:2209
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f69e0d5e90e
RSP: 002b:00007ffdf5f44418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555573cf7500 RCX: 00007f69e0d5e90e
RDX: 0000000000000028 RSI: 00007f69e1b54670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffdf5f44494 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f69e1b54670 R15: 0000000000000000
</TASK>
Showing all locks held in the system:
1 lock held by khungtaskd/29:
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by getty/5528:
#0: ffff88802de570a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
3 locks held by kworker/0:3/5813:
#0: ffff888017c72538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c72538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900048e7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900048e7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x92/0xd90 net/wireless/reg.c:2463
3 locks held by kworker/u4:33/9923:
#0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000cfafd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000cfafd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
3 locks held by kworker/1:2/13021:
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000bb9fd00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000bb9fd00 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
6 locks held by kworker/u4:38/14314:
#0: ffff888140045138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888140045138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc90004407d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc90004407d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3ca0d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 net/core/net_namespace.c:606
#3: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x1c/0x1c0 drivers/net/wireguard/device.c:421
#4: ffff8880245ed468 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_netns_pre_exit+0xb0/0x1c0 drivers/net/wireguard/device.c:426
#5: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#5: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
1 lock held by syz-executor/15439:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3514
2 locks held by kworker/u4:54/15965:
#0: ffff8880b8e3c298 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:559
#1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#1: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: perf_iterate_sb+0x28/0x6a0 kernel/events/core.c:8101
4 locks held by syz.4.2873/18411:
1 lock held by syz.7.2883/18453:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3514
1 lock held by syz-executor/18459:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3514
3 locks held by syz-executor/18473:
#0: ffff888032884e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:521 [inline]
#0: ffff888032884e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 net/bluetooth/hci_core.c:2709
#1: ffff8880328840b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 net/bluetooth/hci_sync.c:5326
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2016 [inline]
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 net/bluetooth/hci_conn.c:2571
5 locks held by syz-executor/18476:
#0: ffff88804dd64e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:521 [inline]
#0: ffff88804dd64e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 net/bluetooth/hci_core.c:2709
#1: ffff88804dd640b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 net/bluetooth/hci_sync.c:5326
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2016 [inline]
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 net/bluetooth/hci_conn.c:2571
#3: ffff88805c381b38 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_conn_del+0x7b/0x630 net/bluetooth/l2cap_core.c:1793
#4: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#4: ffffffff8d137778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
3 locks held by syz-executor/18479:
#0: ffff888042dd4e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:521 [inline]
#0: ffff888042dd4e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x212/0x500 net/bluetooth/hci_core.c:2709
#1: ffff888042dd40b8 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x552/0x1130 net/bluetooth/hci_sync.c:5326
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2016 [inline]
#2: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0x99/0x220 net/bluetooth/hci_conn.c:2571
4 locks held by kworker/u5:2/18482:
#0: ffff88805e168538 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88805e168538 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900038d7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900038d7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffff88806b9780b8 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0x900 net/bluetooth/hci_event.c:3683
#3: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2001 [inline]
#3: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x535/0x900 net/bluetooth/hci_event.c:3717
1 lock held by syz-executor/18510:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/18514:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
4 locks held by kworker/u5:4/18516:
#0: ffff88802ea1f938 ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88802ea1f938 ((wq_completion)hci3#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc90004187d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc90004187d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffff88806b9000b8 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0x900 net/bluetooth/hci_event.c:3683
#3: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2001 [inline]
#3: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x535/0x900 net/bluetooth/hci_event.c:3717
1 lock held by syz-executor/18518:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/18522:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
4 locks held by kworker/u5:6/18524:
#0: ffff88805e56cd38 ((wq_completion)hci4#3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88805e56cd38 ((wq_completion)hci4#3){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900041ffd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900041ffd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffff88806b9040b8 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0x900 net/bluetooth/hci_event.c:3683
#3: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2001 [inline]
#3: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x535/0x900 net/bluetooth/hci_event.c:3717
3 locks held by kworker/1:3/18533:
1 lock held by syz-executor/18534:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/18537:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/18540:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
4 locks held by kworker/u5:7/18542:
#0: ffff888026590538 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888026590538 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900032b7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900032b7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffff88806b90c0b8 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0x900 net/bluetooth/hci_event.c:3683
#3: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2001 [inline]
#3: ffffffff8e543f48 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x535/0x900 net/bluetooth/hci_event.c:3717
1 lock held by syz-executor/18546:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by dhcpcd/18551:
#0: ffff88803bb74130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88803bb74130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18552:
#0: ffff8880816cc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff8880816cc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18553:
#0: ffff88803935a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88803935a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18554:
#0: ffff88803be96130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88803be96130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18555:
#0: ffff88808246e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88808246e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18556:
#0: ffff8880820ac130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff8880820ac130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18557:
#0: ffff888081f6e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888081f6e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18558:
#0: ffff88808373c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88808373c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18559:
#0: ffff888083786130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888083786130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18560:
#0: ffff8880849f2130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff8880849f2130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18561:
#0: ffff8880827cc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff8880827cc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18562:
#0: ffff888029b1e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888029b1e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18563:
#0: ffff888035e26130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888035e26130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18564:
#0: ffff88806646e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88806646e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18565:
#0: ffff888027370130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888027370130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18566:
#0: ffff888041a44130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888041a44130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18567:
#0: ffff88807b316130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88807b316130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18568:
#0: ffff88806a464130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88806a464130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18569:
#0: ffff888079f80130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888079f80130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18570:
#0: ffff888042dbe130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888042dbe130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18571:
#0: ffff88804985a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88804985a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18572:
#0: ffff888025aee130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888025aee130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18573:
#0: ffff88804a342130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88804a342130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by dhcpcd/18574:
#0: ffff888040812130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888040812130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by syz-executor/18577:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/18582:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/18584:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by dhcpcd/18586:
#0: ffff88807a644130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88807a644130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
1 lock held by syz-executor/18588:
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by dhcpcd/18592:
#0: ffff888044572130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888044572130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3264
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf59/0xfa0 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 18411 Comm: syz.4.2873 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:check_preemption_disabled+0x42/0x110 lib/smp_processor_id.c:55
Code: 65 8b 05 9d bd 76 75 65 8b 0d 92 bd 76 75 f7 c1 ff ff ff 7f 74 1f 65 48 8b 0c 25 28 00 00 00 48 3b 4c 24 08 0f 85 c4 00 00 00 <48> 83 c4 10 5b 41 5e 41 5f 5d c3 48 c7 04 24 00 00 00 00 9c 8f 04
RSP: 0018:ffffc900001f0a60 EFLAGS: 00000046
RAX: 0000000000000001 RBX: ffffc900001f0ab8 RCX: 59316d4560cac400
RDX: 0000000000010100 RSI: ffffffff8ac9c460 RDI: ffffffff8b1d0ca0
RBP: 0000000000000000 R08: ffffffff8e8c7aef R09: 1ffffffff1d18f5d
R10: dffffc0000000000 R11: fffffbfff1d18f5e R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f132341b6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055a5dca12168 CR3: 0000000023ff6000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
irq_exit_rcu+0x15/0x20 kernel/softirq.c:675
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0x56/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:seqcount_lockdep_reader_access+0x19a/0x1d0 include/linux/seqlock.h:105
Code: 00 4d 85 e4 75 16 e8 35 c9 0f 00 eb 15 e8 2e c9 0f 00 e8 29 3d 15 09 4d 85 e4 74 ea e8 1f c9 0f 00 fb 48 c7 04 24 0e 36 e0 45 <4b> c7 04 3e 00 00 00 00 43 c7 44 3e 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc900001f0b60 EFLAGS: 00000246
RAX: ffffffff8177a861 RBX: 0000000000000000 RCX: ffff888069db3c00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001f0c18 R08: ffffffff911eb5ff R09: 1ffffffff223d6bf
R10: dffffc0000000000 R11: fffffbfff223d6c0 R12: 0000000000000200
R13: 0000020e5a0d2da4 R14: 1ffff9200003e16c R15: dffffc0000000000
timekeeping_get_delta kernel/time/timekeeping.c:254 [inline]
timekeeping_get_ns kernel/time/timekeeping.c:388 [inline]
ktime_get+0x7f/0x280 kernel/time/timekeeping.c:848
hrtimer_forward_now include/linux/hrtimer.h:509 [inline]
mac80211_hwsim_beacon+0x156/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2304
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:finish_task_switch+0x267/0x8f0 kernel/sched/core.c:5256
Code: 2f 09 85 c0 0f 84 30 01 00 00 48 85 db 0f 85 4f 01 00 00 0f 1f 44 00 00 4c 89 e7 e8 93 d0 38 09 e8 1e 19 30 00 fb 4c 8b 65 b8 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0
RSP: 0018:ffffc900032c7600 EFLAGS: 00000286
RAX: 59316d4560cac400 RBX: 0000000000000000 RCX: 59316d4560cac400
RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d0ca0
RBP: ffffc900032c7650 R08: ffffffff911eb5ff R09: 1ffffffff223d6bf
R10: dffffc0000000000 R11: fffffbfff223d6c0 R12: ffff888069db3c00
R13: 1ffff110171e79a9 R14: dffffc0000000000 R15: ffff8880b8f3cd48
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x15b6/0x4660 kernel/sched/core.c:6701
preempt_schedule_irq+0xbf/0x150 kernel/sched/core.c:7011
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:constant_test_bit arch/x86/include/asm/bitops.h:207 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
RIP: 0010:tif_need_resched include/linux/thread_info.h:184 [inline]
RIP: 0010:need_resched include/linux/sched.h:2272 [inline]
RIP: 0010:preempt_schedule_common+0x11/0xc0 kernel/sched/core.c:6876
Code: 41 5e 5d c3 e8 10 00 00 00 eb d0 e8 79 b1 f7 ff 66 0f 1f 84 00 00 00 00 00 41 57 41 56 53 49 bf 00 00 00 00 00 fc ff df eb 0d <48> f7 03 08 00 00 00 0f 84 99 00 00 00 65 ff 05 13 85 6e 75 65 8b
RSP: 0018:ffffc900032c79e0 EFLAGS: 00000246
RAX: 1ffff1100d3b6780 RBX: ffff888069db3c00 RCX: 59316d4560cac400
RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d0ca0
RBP: ffffc900032c7a78 R08: ffffffff911eb5ff R09: 1ffffffff223d6bf
R10: dffffc0000000000 R11: fffffbfff223d6c0 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff888069db50c8 R15: dffffc0000000000
preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6892
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
smp_call_function_single+0x48d/0x5a0 kernel/smp.c:652
task_function_call kernel/events/core.c:120 [inline]
perf_install_in_context+0x5bb/0x920 kernel/events/core.c:2950
__do_sys_perf_event_open kernel/events/core.c:12949 [inline]
__se_sys_perf_event_open+0x1841/0x1c60 kernel/events/core.c:12601
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f132259e0d9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f132341b028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007f1322825fa0 RCX: 00007f132259e0d9
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000480
RBP: 00007f1322635024 R08: 000000000000000a R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1322826038 R14: 00007f1322825fa0 R15: 00007ffd9ccd1c78
</TASK>