INFO: task udevd:5090 blocked for more than 143 seconds. Not tainted 6.9.0-rc7-next-20240506-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:23824 pid:5090 tgid:5090 ppid:4544 flags:0x00000002 Call Trace: context_switch kernel/sched/core.c:5408 [inline] __schedule+0x17e8/0x4a50 kernel/sched/core.c:6745 __schedule_loop kernel/sched/core.c:6822 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6837 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6894 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x6a4/0xd70 kernel/locking/mutex.c:752 btrfs_control_ioctl+0x150/0x3e0 fs/btrfs/super.c:2225 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f701071ad49 RSP: 002b:00007ffc85064ed8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f701071ad49 RDX: 00007ffc85064ee8 RSI: 0000000090009427 RDI: 0000000000000009 RBP: 0000000000000009 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc85065f28 R14: 000056086bde4d00 R15: 00007ffc85066c48 INFO: task syz-executor.2:5227 blocked for more than 144 seconds. Not tainted 6.9.0-rc7-next-20240506-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.2 state:D stack:24848 pid:5227 tgid:5225 ppid:5114 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5408 [inline] __schedule+0x17e8/0x4a50 kernel/sched/core.c:6745 __schedule_loop kernel/sched/core.c:6822 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6837 schedule_timeout+0xb0/0x310 kernel/time/timer.c:2557 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 __flush_work+0xaa9/0xd00 kernel/workqueue.c:4211 __lru_add_drain_all+0x504/0x570 mm/swap.c:902 invalidate_bdev+0x76/0xa0 block/bdev.c:95 btrfs_get_bdev_and_sb+0xfb/0x170 fs/btrfs/volumes.c:490 btrfs_open_one_device fs/btrfs/volumes.c:654 [inline] open_fs_devices+0x2b4/0x1260 fs/btrfs/volumes.c:1193 btrfs_get_tree_super fs/btrfs/super.c:1818 [inline] btrfs_get_tree+0x504/0x1920 fs/btrfs/super.c:2081 vfs_get_tree+0x90/0x2a0 fs/super.c:1780 fc_mount+0x1b/0xb0 fs/namespace.c:1125 btrfs_get_tree_subvol fs/btrfs/super.c:2044 [inline] btrfs_get_tree+0x652/0x1920 fs/btrfs/super.c:2082 vfs_get_tree+0x90/0x2a0 fs/super.c:1780 do_new_mount+0x2be/0xb40 fs/namespace.c:3352 do_mount fs/namespace.c:3692 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f917c27f3aa RSP: 002b:00007f917d0afef8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f917d0aff80 RCX: 00007f917c27f3aa RDX: 0000000020000000 RSI: 0000000020000140 RDI: 00007f917d0aff40 RBP: 0000000020000000 R08: 00007f917d0aff80 R09: 0000000000008059 R10: 0000000000008059 R11: 0000000000000202 R12: 0000000020000140 R13: 00007f917d0aff40 R14: 000000000000559e R15: 0000000020000280 Showing all locks held in the system: 6 locks held by kworker/0:0/8: 2 locks held by kworker/0:1/9: 2 locks held by kworker/u8:0/11: #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90000107d00 ( connector_reaper_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 4 locks held by kworker/u8:1/12: #0: ffff888015ed5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] ffff888015ed5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90000117d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] ffffc90000117d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8f5d8c10 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x16a/0xcc0 net/core/net_namespace.c:591 #3: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #3: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 1 lock held by khungtaskd/30: #0: ffffffff8e333da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline] #0: ffffffff8e333da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline] #0: ffffffff8e333da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6614 2 locks held by kworker/u8:3/51: #0: ffff888015089148 ( (wq_completion)events_unbound ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3206 [inline] , at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90000bb7d00 ( (reaper_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] (reaper_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 5 locks held by kworker/u9:0/53: #0: ffff888024e46948 ( (wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] (wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90000bd7d00 ( (work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] (work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888060449060 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:309 #3: ffff888060448078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5536 #4: ffffffff8f945ca8 (uevent_sock_mutex ){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] ){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 4 locks held by kworker/0:2/929: #0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff888015080948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003c5fd00 ( (work_completion)(&fw_work->work)){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3207 [inline] , at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8e1dd590 (umhelper_sem){++++}-{3:3}, at: usermodehelper_read_lock_wait+0x14e/0x260 kernel/umh.c:247 #3: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 3 locks held by kworker/u8:6/1050: #0: ffff88802a4f9948 ( (wq_completion)ipv6_addrconf ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3206 [inline] , at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90004067d00 ( (work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] (work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8f5e5448 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xd0/0x16f0 net/ipv6/addrconf.c:4193 5 locks held by kworker/u8:7/1059: #0: ffff8880b953e7d8 ( &rq->__lock ){-.-.}-{2:2} , at: process_one_work kernel/workqueue.c:3206 [inline] , at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90004187d00 ( (work_completion)(&(&kfence_timer)->work) ){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] ){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffffffff8e1ce3f0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_disable+0x12/0x20 kernel/jump_label.c:242 #3: ffffffff8e3e0fc8 ( jump_label_mutex){+.+.}-{3:3} , at: jump_label_lock kernel/jump_label.c:27 [inline] , at: static_key_disable_cpuslocked+0x9b/0x1c0 kernel/jump_label.c:233 #4: ffffffff8e1e34a8 ( text_mutex ){+.+.}-{3:3}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145 1 lock held by dhcpcd/4758: #0: ffffffff8f5e5448 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2ce/0x1bc0 net/ipv4/devinet.c:1101 2 locks held by getty/4844: #0: ffff88802af7e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f0e2f0 ( &ldata->atomic_read_lock ){+.+.}-{3:3}, at: n_tty_read+0x6b5/0x1e10 drivers/tty/n_tty.c:2201 1 lock held by udevd/5088: #0: ffff88801d5442d0 (mapping.invalidate_lock#2){.+.+}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:846 [inline] #0: ffff88801d5442d0 (mapping.invalidate_lock#2){.+.+}-{3:3}, at: page_cache_ra_unbounded+0xf7/0x7f0 mm/readahead.c:225 1 lock held by udevd/5090: #0: ffffffff8e8a42c8 (uuid_mutex){+.+.}-{3:3}, at: btrfs_control_ioctl+0x150/0x3e0 fs/btrfs/super.c:2225 2 locks held by kworker/0:3/5102: 5 locks held by kworker/u9:2/5103: #0: ffff88802c7bc148 ( (wq_completion)hci2){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3206 [inline] , at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003e57d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003e57d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888060415060 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:309 #3: ffff888060414078 (&hdev->lock ){+.+.}-{3:3} , at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5536 #4: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #4: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 3 locks held by syz-executor.3/5104: #0: ffffffff8ea042c8 (bio_slab_lock){+.+.}-{3:3} , at: bio_put_slab block/bio.c:140 [inline] , at: bioset_exit+0x436/0x650 block/bio.c:1710 #1: ffffffff8e1ce3f0 (cpu_hotplug_lock){++++}-{0:0}, at: kmem_cache_destroy+0x32/0x1b0 mm/slab_common.c:487 #2: ffffffff8e4133e8 ( slab_mutex ){+.+.}-{3:3} , at: kmem_cache_destroy+0x40/0x1b0 mm/slab_common.c:488 5 locks held by kworker/u9:3/5106: #0: ffff88802a4f8948 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88802a4f8948 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003ee7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline] #1: ffffc90003ee7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888011949060 (&hdev->req_lock ){+.+.}-{3:3} , at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:309 #3: ffff888011948078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5536 #4: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 5 locks held by kworker/u9:5/5110: #0: ffff88802c7be948 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3206 [inline] #0: ffff88802c7be948 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x90a/0x1830 kernel/workqueue.c:3312 #1: ffffc90003f67d00 ((work_completion)(&hdev->cmd_sync_work) ){+.+.}-{0:0} , at: process_one_work kernel/workqueue.c:3207 [inline] , at: process_scheduled_works+0x945/0x1830 kernel/workqueue.c:3312 #2: ffff888060419060 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:309 #3: ffff888060418078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5536 #4: ffffffff8f945ca8 ( uevent_sock_mutex ){+.+.}-{3:3} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor.4/5111: #0: ffff88805e9ee0e0 ( &type->s_umount_key#33){++++}-{3:3}, at: __super_lock fs/super.c:56 [inline] &type->s_umount_key#33){++++}-{3:3}, at: __super_lock_excl fs/super.c:71 [inline] &type->s_umount_key#33){++++}-{3:3}, at: deactivate_super+0xb5/0xf0 fs/super.c:505 #1: ffffffff8e3ec0c8 (lock#3){+.+.}-{3:3} , at: __lru_add_drain_all+0x66/0x570 mm/swap.c:857 4 locks held by udevd/5116: #0: ffff88802e03a418 ( &p->lock){+.+.}-{3:3}, at: seq_read_iter+0xb7/0xd60 fs/seq_file.c:182 #1: ffff888079d3b888 ( &of->mutex#2 ){+.+.}-{3:3} , at: kernfs_seq_start+0x53/0x3b0 fs/kernfs/file.c:154 #2: ffff88802c2831e8 ( kn->active#18){.+.+}-{0:0}, at: kernfs_seq_start+0x72/0x3b0 fs/kernfs/file.c:155 #3: ffff888079d58190 ( &dev->mutex ){....}-{3:3} , at: device_lock_interruptible include/linux/device.h:995 [inline] , at: manufacturer_show+0x26/0xa0 drivers/usb/core/sysfs.c:142 7 locks held by kworker/0:4/5147: 4 locks held by kworker/0:6/5149: 2 locks held by syz-executor.2/5227: #0: ffffffff8e8a42c8 (uuid_mutex){+.+.}-{3:3}, at: btrfs_get_tree_super fs/btrfs/super.c:1802 [inline] #0: ffffffff8e8a42c8 (uuid_mutex){+.+.}-{3:3}, at: btrfs_get_tree+0x2dc/0x1920 fs/btrfs/super.c:2081 #1: ffffffff8e3ec0c8 ( lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x66/0x570 mm/swap.c:857 1 lock held by syz-executor.1/5274: #0: ffffffff8e3ec0c8 (lock#3){+.+.}-{3:3}, at: __lru_add_drain_all+0x66/0x570 mm/swap.c:857 3 locks held by syz-executor.0/5276: #0: ffff888057745060 ( &hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:559 [inline] &hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1d3/0x4e0 net/bluetooth/hci_core.c:2778 #1: ffff888057744078 ( &hdev->lock){+.+.}-{3:3} , at: hci_dev_close_sync+0x48b/0x1050 net/bluetooth/hci_sync.c:5134 #2: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 3 locks held by syz-executor.2/5286: #0: ffff888054779060 ( &hdev->req_lock ){+.+.}-{3:3} , at: hci_dev_do_close net/bluetooth/hci_core.c:559 [inline] , at: hci_unregister_dev+0x1d3/0x4e0 net/bluetooth/hci_core.c:2778 #1: ffff888054778078 ( &hdev->lock ){+.+.}-{3:3}, at: hci_dev_close_sync+0x48b/0x1050 net/bluetooth/hci_sync.c:5134 #2: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 8 locks held by syz-executor.1/5301: #0: ffff88802a9c6420 ( sb_writers #8 ){.+.+}-{0:0} , at: file_start_write include/linux/fs.h:2853 [inline] , at: vfs_write+0x227/0xc90 fs/read_write.c:586 #1: ffff88802c990c88 ( &of->mutex ){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1eb/0x500 fs/kernfs/file.c:325 #2: ffff8880230c2f08 (kn->active#50){.+.+}-{0:0} , at: kernfs_fop_write_iter+0x20f/0x500 fs/kernfs/file.c:326 #3: ffffffff8eef4628 (nsim_bus_dev_list_lock){+.+.}-{3:3} , at: del_device_store+0xfc/0x480 drivers/net/netdevsim/bus.c:216 #4: ffff88805e11b0e8 ( &dev->mutex ){....}-{3:3} , at: device_lock include/linux/device.h:990 [inline] , at: __device_driver_lock drivers/base/dd.c:1093 [inline] , at: device_release_driver_internal+0xce/0x7c0 drivers/base/dd.c:1290 #5: ffff88805e11c250 ( &devlink->lock_key #4){+.+.}-{3:3} , at: nsim_drv_remove+0x50/0x160 drivers/net/netdevsim/dev.c:1672 #6: ffffffff8f5e5448 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x69/0x400 drivers/net/netdevsim/netdev.c:586 #7: ffffffff8e1ce3f0 (cpu_hotplug_lock ){++++}-{0:0} , at: flush_all_backlogs net/core/dev.c:5984 [inline] , at: unregister_netdevice_many_notify+0x607/0x16e0 net/core/dev.c:11202 2 locks held by syz-executor.0/5319: #0: ffff88805000a918 ( &data->open_mutex ){+.+.}-{3:3} , at: vhci_create_device+0x33/0x720 drivers/bluetooth/hci_vhci.c:479 #1: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] #1: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor.2/5327: #0: ffff8880598e5918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x33/0x720 drivers/bluetooth/hci_vhci.c:479 #1: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor.1/5418: #0: ffff88805da2c118 ( &data->open_mutex ){+.+.}-{3:3} , at: vhci_create_device+0x33/0x720 drivers/bluetooth/hci_vhci.c:479 #1: ffffffff8f945ca8 ( uevent_sock_mutex ){+.+.}-{3:3} , at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] , at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 2 locks held by syz-executor.0/5420: #0: ffff88804e086118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x33/0x720 drivers/bluetooth/hci_vhci.c:479 #1: ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline] ffffffff8f945ca8 (uevent_sock_mutex){+.+.}-{3:3}, at: kobject_uevent_net_broadcast+0x280/0x580 lib/kobject_uevent.c:410 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 30 Comm: khungtaskd Not tainted 6.9.0-rc7-next-20240506-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xfde/0x1020 kernel/hung_task.c:379 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: yealink 1-1:36.0: urb_irq_callback - urb status -71 NMI backtrace for cpu 0 CPU: 0 PID: 5149 Comm: kworker/0:6 Not tainted 6.9.0-rc7-next-20240506-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Workqueue: events kfree_rcu_monitor RIP: 0010:io_serial_in+0x76/0xb0 drivers/tty/serial/8250/8250_port.c:406 Code: 10 b6 57 fc 89 e9 41 d3 e6 48 83 c3 40 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 61 6b bd fc 44 03 33 44 89 f2 ec <0f> b6 c0 5b 41 5e 41 5f 5d c3 cc cc cc cc 89 e9 80 e1 07 38 c1 7c RSP: 0000:ffffc90000005618 EFLAGS: 00000002 RAX: 1ffffffff295a200 RBX: ffffffff94ad1180 RCX: 0000000000000000 RDX: 00000000000003fd RSI: 0000000000017188 RDI: 0000000000017189 RBP: 0000000000000000 R08: ffffffff853e6316 R09: 1ffff11003f08046 R10: dffffc0000000000 R11: ffffffff853e62d0 R12: dffffc0000000000 R13: 000000000000267d R14: 00000000000003fd R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7010c72095 CR3: 0000000079422000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: serial_in drivers/tty/serial/8250/8250.h:117 [inline] serial_lsr_in drivers/tty/serial/8250/8250.h:139 [inline] wait_for_lsr drivers/tty/serial/8250/8250_port.c:2068 [inline] serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:3315 [inline] serial8250_console_write+0x1099/0x1770 drivers/tty/serial/8250/8250_port.c:3393 console_emit_next_record kernel/printk/printk.c:2928 [inline] console_flush_all+0x865/0xfd0 kernel/printk/printk.c:2994 console_unlock+0x13b/0x4d0 kernel/printk/printk.c:3063 vprintk_emit+0x5a6/0x770 kernel/printk/printk.c:2345 dev_vprintk_emit+0x2ae/0x330 drivers/base/core.c:4942 dev_printk_emit+0xdd/0x120 drivers/base/core.c:4953 _dev_err+0x122/0x170 drivers/base/core.c:5008 urb_irq_callback+0x37e/0x5b0 drivers/input/misc/yealink.c:416 __usb_hcd_giveback_urb+0x373/0x530 drivers/usb/core/hcd.c:1648 dummy_timer+0x830/0x45d0 drivers/usb/gadget/udc/dummy_hcd.c:1987 __run_hrtimer kernel/time/hrtimer.c:1687 [inline] __hrtimer_run_queues+0x5a5/0xd50 kernel/time/hrtimer.c:1751 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1813 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x110/0x3f0 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__refcount_add include/linux/refcount.h:191 [inline] RIP: 0010:refcount_add include/linux/refcount.h:213 [inline] RIP: 0010:inc_stack_record_count mm/page_owner.c:216 [inline] RIP: 0010:__set_page_owner+0x655/0x800 mm/page_owner.c:329 Code: 6c 24 0c 4c 8b 74 24 20 4c 89 ff be 04 00 00 00 e8 d0 ce f5 ff 44 89 eb f0 41 0f c1 1f 31 ff 89 de e8 ef 1a 90 ff 85 db 74 6d <41> 01 dd 44 89 ee 09 de bf ff ff ff ff e8 d9 1a 90 ff 41 09 dd 78 RSP: 0000:ffffc90000006640 EFLAGS: 00000202 RAX: 0000000080000302 RBX: 0000000000000419 RCX: ffffffff82060270 RDX: ffff88802a58bc00 RSI: 0000000000000419 RDI: 0000000000000000 RBP: ffffc90000006740 R08: ffffffff82060281 R09: 1ffff1100f6aa837 R10: dffffc0000000000 R11: ffffed100f6aa838 R12: ffff88807b5541a0 R13: 0000000000000008 R14: 1ffff92000000cd4 R15: ffff88807b5541bc set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468 prep_new_page mm/page_alloc.c:1476 [inline] get_page_from_freelist+0x2ce2/0x2d90 mm/page_alloc.c:3438 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4696 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2264 allocate_slab+0x5a/0x2e0 mm/slub.c:2427 new_slab mm/slub.c:2480 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3666 __slab_alloc+0x58/0xa0 mm/slub.c:3756 __slab_alloc_node mm/slub.c:3809 [inline] slab_alloc_node mm/slub.c:3988 [inline] __do_kmalloc_node mm/slub.c:4120 [inline] __kmalloc_noprof+0x25e/0x410 mm/slub.c:4134 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] ieee802_11_parse_elems_full+0xd5/0x2870 net/mac80211/parse.c:880 ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2330 [inline] ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2337 [inline] ieee80211_inform_bss+0x15f/0x1080 net/mac80211/scan.c:79 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline] cfg80211_inform_single_bss_data+0x1049/0x2330 net/wireless/scan.c:2277 cfg80211_inform_bss_data+0x3dd/0x5a70 net/wireless/scan.c:3101 cfg80211_inform_bss_frame_data+0x3bc/0x720 net/wireless/scan.c:3191