INFO: task syz.0.8888:6915 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.8888 state:D stack:23864 pid:6915 tgid:6914 ppid:5253 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7008
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
call_ad+0x292/0xb60 net/netfilter/ipset/ip_set_core.c:1746
ip_set_ad+0x824/0x9d0 net/netfilter/ipset/ip_set_core.c:1841
nfnetlink_rcv_msg+0xc00/0x12c0 net/netfilter/nfnetlink.c:300
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
nfnetlink_rcv+0x2c0/0x27b0 net/netfilter/nfnetlink.c:667
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:721 [inline]
__sock_sendmsg net/socket.c:736 [inline]
____sys_sendmsg+0x972/0x9f0 net/socket.c:2585
___sys_sendmsg+0x2a5/0x360 net/socket.c:2639
__sys_sendmsg net/socket.c:2671 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff6cb59c819
RSP: 002b:00007ff6cc493028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ff6cb815fa0 RCX: 00007ff6cb59c819
RDX: 0000000000000014 RSI: 00002000000002c0 RDI: 000000000000000b
RBP: 00007ff6cb632c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff6cb816038 R14: 00007ff6cb815fa0 R15: 00007ffdd9c98e98
</TASK>
INFO: task syz.5.8913:7042 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.8913 state:D stack:26344 pid:7042 tgid:7041 ppid:5407 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7008
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
nfnetlink_rcv+0x2c0/0x27b0 net/netfilter/nfnetlink.c:667
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:721 [inline]
__sock_sendmsg net/socket.c:736 [inline]
____sys_sendmsg+0x972/0x9f0 net/socket.c:2585
___sys_sendmsg+0x2a5/0x360 net/socket.c:2639
__sys_sendmsg net/socket.c:2671 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa048b9c819
RSP: 002b:00007fa049a67028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fa048e15fa0 RCX: 00007fa048b9c819
RDX: 0000000020004000 RSI: 00002000000001c0 RDI: 0000000000000005
RBP: 00007fa048c32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa048e16038 R14: 00007fa048e15fa0 R15: 00007ffc0386abb8
</TASK>
INFO: task syz.2.8925:7119 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.8925 state:D stack:26416 pid:7119 tgid:7116 ppid:4647 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7008
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
nfnetlink_rcv+0x2c0/0x27b0 net/netfilter/nfnetlink.c:667
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:721 [inline]
__sock_sendmsg net/socket.c:736 [inline]
____sys_sendmsg+0x972/0x9f0 net/socket.c:2585
___sys_sendmsg+0x2a5/0x360 net/socket.c:2639
__sys_sendmsg net/socket.c:2671 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f16a8f9c819
RSP: 002b:00007f16a9e74028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f16a9216090 RCX: 00007f16a8f9c819
RDX: 0000000000000000 RSI: 0000200000000040 RDI: 0000000000000003
RBP: 00007f16a9032c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f16a9216128 R14: 00007f16a9216090 R15: 00007ffc349819e8
</TASK>
INFO: task syz.4.8941:7183 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.8941 state:D stack:25056 pid:7183 tgid:7182 ppid:5255 task_flags:0x400140 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5298 [inline]
__schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
__schedule_loop kernel/sched/core.c:6993 [inline]
schedule+0x164/0x360 kernel/sched/core.c:7008
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
__mutex_lock_common kernel/locking/mutex.c:692 [inline]
__mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
nfnetlink_rcv+0x2c0/0x27b0 net/netfilter/nfnetlink.c:667
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:721 [inline]
__sock_sendmsg net/socket.c:736 [inline]
____sys_sendmsg+0x972/0x9f0 net/socket.c:2585
___sys_sendmsg+0x2a5/0x360 net/socket.c:2639
__sys_sendmsg net/socket.c:2671 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2674
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc577d9c819
RSP: 002b:00007fc578d0e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fc578015fa0 RCX: 00007fc577d9c819
RDX: 0000000000040000 RSI: 0000200000000740 RDI: 000000000000000b
RBP: 00007fc577e32c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc578016038 R14: 00007fc578015fa0 R15: 00007ffef9efd838
</TASK>
Showing all locks held in the system:
1 lock held by pool_workqueue_/3:
1 lock held by khungtaskd/31:
#0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
#0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
#0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by getty/5579:
#0: ffff888036b310a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000322b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
3 locks held by kworker/1:6/32588:
#0: ffff88813fe0f148 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
#0: ffff88813fe0f148 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
#1: ffffc90004677c40 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
#1: ffffc90004677c40 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
#2: ffffffff8e7648f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
#2: ffffffff8e7648f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:961
2 locks held by syz.2.7737/1720:
1 lock held by syz.0.8888/6915:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: call_ad+0x292/0xb60 net/netfilter/ipset/ip_set_core.c:1746
1 lock held by syz.5.8913/7042:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.2.8925/7119:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.4.8941/7183:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.7.8970/7425:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.7.8970/7432:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.8.9061/8002:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.6.9075/8068:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.1.9140/8409:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.9.9175/8634:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.5.9212/8894:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.3.9221/8932:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.2.9313/9591:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.4.9326/9711:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.4.9326/9712:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.0.9393/9953:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.8.9409/10002:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
5 locks held by syz-executor/10160:
#0: ffff8880b42a4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
#0: ffff8880b42a4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
#1: ffff8880b42a40c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5356
#2: ffffffff8fd567e8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
#2: ffffffff8fd567e8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2650
#3: ffff88803573ab00 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x92/0x570 net/bluetooth/l2cap_core.c:1777
#4: ffffffff8e7648f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
#4: ffffffff8e7648f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:961
1 lock held by syz-executor/10176:
#0: ffffffff8fbca488 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline]
#0: ffffffff8fbca488 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3436
1 lock held by syz.7.9483/10302:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.6.9493/10342:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.6.9493/10343:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
1 lock held by syz.6.9493/10345:
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnl_lock net/netfilter/nfnetlink.c:96 [inline]
#0: ffffffff9a7b4098 (nfnl_subsys_ipset){+.+.}-{4:4}, at: nfnetlink_rcv_msg+0xa6e/0x12c0 net/netfilter/nfnetlink.c:293
3 locks held by syz.1.9514/10477:
#0: ffff888054778ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
#0: ffff888054778ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716
#1: ffff8880547780c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5356
#2: ffffffff8fd567e8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline]
#2: ffffffff8fd567e8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2650
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xfd9/0x1030 kernel/hung_task.c:515
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 10176 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
RIP: 0010:chain_hlock_class_idx kernel/locking/lockdep.c:438 [inline]
RIP: 0010:remove_class_from_lock_chain kernel/locking/lockdep.c:6198 [inline]
RIP: 0010:remove_class_from_lock_chains kernel/locking/lockdep.c:6236 [inline]
RIP: 0010:zap_class+0xf1/0x340 kernel/locking/lockdep.c:6281
Code: 08 c1 75 d7 45 8b 75 00 41 f6 c6 fc 0f 84 e1 00 00 00 41 c1 ee 08 4a 8d 1c 75 10 84 25 93 49 81 fe 00 00 50 00 73 2f 0f b7 03 <25> ff 1f 00 00 49 39 c7 74 33 49 ff c6 41 8b 45 00 89 c1 c1 e9 08
RSP: 0018:ffffc90005c4f7e0 EFLAGS: 00000083
RAX: 000000000000018e RBX: ffffffff9325a2e0 RCX: 000000000004da00
RDX: ffffffff93e08438 RSI: 0000000000000003 RDI: 000000000006bd08
RBP: ffffffff942488b0 R08: ffffffff81af1328 R09: ffffffff8e75e5e0
R10: dffffc0000000000 R11: fffffbfff2023337 R12: 000000000007a393
R13: ffffffff94253c90 R14: 0000000000000f68 R15: 0000000000000fd6
FS: 0000000000000000(0000) GS:ffff888125455000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055786f6c2ee8 CR3: 000000007f24a000 CR4: 00000000003526f0
Call Trace:
<TASK>
__lockdep_free_key_range kernel/locking/lockdep.c:6407 [inline]
lockdep_unregister_key+0x1c3/0x350 kernel/locking/lockdep.c:6609
qdisc_lock_uninit include/net/pkt_sched.h:332 [inline]
__qdisc_destroy+0x1ab/0x4a0 net/sched/sch_generic.c:1102
qdisc_put net/sched/sch_generic.c:1128 [inline]
dev_shutdown+0x34c/0x440 net/sched/sch_generic.c:1493
unregister_netdevice_many_notify+0x11a9/0x2370 net/core/dev.c:12434
unregister_netdevice_many net/core/dev.c:12509 [inline]
unregister_netdevice_queue+0x31f/0x360 net/core/dev.c:12323
unregister_netdevice include/linux/netdevice.h:3418 [inline]
__tun_detach+0x6d9/0x15d0 drivers/net/tun.c:621
tun_detach drivers/net/tun.c:637 [inline]
tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3436
__fput+0x44f/0xa70 fs/file_table.c:469
task_work_run+0x1d9/0x270 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x70f/0x23c0 kernel/exit.c:976
do_group_exit+0x21b/0x2d0 kernel/exit.c:1118
__do_sys_exit_group kernel/exit.c:1129 [inline]
__se_sys_exit_group kernel/exit.c:1127 [inline]
__x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1127
x64_sys_call+0x221a/0x2240 arch/x86/include/generated/asm/syscalls_64.h:232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f678a59c819
Code: Unable to access opcode bytes at 0x7f678a59c7ef.
RSP: 002b:00007ffc6ada2f28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f678a633bd9 RCX: 00007f678a59c819
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000043
RBP: 00007f678a633beb R08: 0000000000000000 R09: 00000000000927c0
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
R13: 00000000000927c0 R14: 0000000000163039 R15: 00007ffc6ada30d0
</TASK>