INFO: task kworker/1:2:27251 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:2 state:D stack:30936 pid:27251 tgid:27251 ppid:2 task_flags:0x208040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 kthread+0x260/0x480 kernel/kthread.c:420 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: locks held by kworker/R-mm_pe/14: 1, on CPU#1: #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2942 [inline] #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 kernel/workqueue.c:3831 locks held by khungtaskd/32: 1, last CPU#0: #0: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by getty/5392: 2, on CPU#0: #0: ffff888036a040a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032362e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by kworker/1:29/16591: 2, last CPU#1: #0: ffff88805508f548 ((wq_completion)wg-crypt-wg0#16){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88805508f548 ((wq_completion)wg-crypt-wg0#16){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88805508f548 ((wq_completion)wg-crypt-wg0#16){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88805508f548 ((wq_completion)wg-crypt-wg0#16){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90010327c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90010327c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90010327c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90010327c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/1:33/16597: 3, last CPU#1: #0: ffff88805508d148 ((wq_completion)wg-kex-wg0#32){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88805508d148 ((wq_completion)wg-kex-wg0#32){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88805508d148 ((wq_completion)wg-kex-wg0#32){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88805508d148 ((wq_completion)wg-kex-wg0#32){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90010377c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90010377c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90010377c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90010377c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888065f41480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1a2/0x9b0 drivers/net/wireguard/noise.c:598 locks held by kworker/1:0/4231: 2, last CPU#1: #0: ffff888034663148 ((wq_completion)wg-kex-wg2#32){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888034663148 ((wq_completion)wg-kex-wg2#32){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888034663148 ((wq_completion)wg-kex-wg2#32){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888034663148 ((wq_completion)wg-kex-wg2#32){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006f8fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006f8fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006f8fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90006f8fc40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/R-wg-cr/6734: 2, last CPU#1: #0: ffff88802a30ed48 ((wq_completion)wg-crypt-wg0#11){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802a30ed48 ((wq_completion)wg-crypt-wg0#11){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802a30ed48 ((wq_completion)wg-crypt-wg0#11){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802a30ed48 ((wq_completion)wg-crypt-wg0#11){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004f4fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004f4fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004f4fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004f4fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/R-wg-cr/6738: 1, on CPU#1: #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2884 locks held by kworker/u8:8/8656: 3, on CPU#0: #0: ffff88801d28e148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801d28e148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801d28e148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801d28e148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005217c40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005217c40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005217c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005217c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91684ac8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:679 locks held by kworker/1:9/12550: 2, last CPU#1: #0: ffff888073e7f948 ((wq_completion)wg-crypt-wg2#16){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888073e7f948 ((wq_completion)wg-crypt-wg2#16){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888073e7f948 ((wq_completion)wg-crypt-wg2#16){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888073e7f948 ((wq_completion)wg-crypt-wg2#16){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000e027c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e027c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e027c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000e027c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/1:10/12551: 2, last CPU#1: #0: ffff88808cf2f548 ((wq_completion)wg-crypt-wg1#15){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88808cf2f548 ((wq_completion)wg-crypt-wg1#15){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88808cf2f548 ((wq_completion)wg-crypt-wg1#15){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88808cf2f548 ((wq_completion)wg-crypt-wg1#15){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000e017c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e017c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e017c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000e017c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/R-wg-cr/23353: 1, last CPU#1: #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2942 [inline] #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 kernel/workqueue.c:3831 locks held by kworker/R-wg-cr/25179: 4, on CPU#1: #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2942 [inline] #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xdbe/0x12a0 kernel/workqueue.c:3831 #1: ffffffff9000ea60 (sched_map-wait-type-override){+.+.}-{3:3}, at: sched_submit_work kernel/sched/core.c:7417 [inline] #1: ffffffff9000ea60 (sched_map-wait-type-override){+.+.}-{3:3}, at: schedule+0x90/0x2b0 kernel/sched/core.c:7473 #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: local_lock_acquire include/linux/local_lock_internal.h:46 [inline] #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 net/core/dev.c:6897 #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:249 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:323 locks held by kworker/R-wg-cr/25182: 3, last CPU#1: #0: ffff88802f147148 ((wq_completion)wg-crypt-wg1#17){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802f147148 ((wq_completion)wg-crypt-wg1#17){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802f147148 ((wq_completion)wg-crypt-wg1#17){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802f147148 ((wq_completion)wg-crypt-wg1#17){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005d07c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005d07c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005d07c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005d07c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff909a5f00 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_objects_fill_pool lib/debugobjects.c:779 [inline] #2: ffffffff909a5f00 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_object_assert_init+0x307/0x380 lib/debugobjects.c:1066 locks held by kworker/R-wg-cr/25186: 2, last CPU#1: #0: ffff88807d085948 ((wq_completion)wg-crypt-wg2#18){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807d085948 ((wq_completion)wg-crypt-wg2#18){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807d085948 ((wq_completion)wg-crypt-wg2#18){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807d085948 ((wq_completion)wg-crypt-wg2#18){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006377c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006377c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006377c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90006377c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/R-wg-cr/29000: 1, on CPU#0: #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2884 locks held by kworker/R-wg-cr/29013: 1, on CPU#0: #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2884 locks held by kworker/R-wg-cr/29238: 2, last CPU#1: #0: ffff88803b2bf548 ((wq_completion)wg-crypt-wg1#19){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88803b2bf548 ((wq_completion)wg-crypt-wg1#19){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88803b2bf548 ((wq_completion)wg-crypt-wg1#19){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88803b2bf548 ((wq_completion)wg-crypt-wg1#19){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900052f7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900052f7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900052f7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900052f7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/R-wg-cr/29240: 1, last CPU#1: #0: ffffffff8fff6440 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2884 locks held by dhcpcd-run-hook/29417: 4, last CPU#0: #0: ffff888052f8d1c8 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:339 #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: do_fault_around mm/memory.c:6069 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: do_read_fault mm/memory.c:6103 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: do_fault mm/memory.c:6246 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: do_pte_missing+0x139f/0x3570 mm/memory.c:4778 #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: filemap_map_pages+0x1d1/0x2170 mm/filemap.c:3939 #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 25179 Comm: kworker/R-wg-cr Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 Workqueue: 0x0 (wg-crypt-wg0) RIP: 0010:in_exception_stack arch/x86/kernel/dumpstack_64.c:108 [inline] RIP: 0010:get_stack_info_noinstr+0x4f/0x130 arch/x86/kernel/dumpstack_64.c:179 Code: 65 48 8b 05 5b 21 dc 08 49 39 c7 74 07 31 c0 e9 d4 00 00 00 48 c7 c7 0f 62 71 8e e8 5b 56 00 00 b0 01 65 4c 8b 25 31 63 dc 08 <4d> 85 e4 74 3a 4d 39 f4 0f 97 c1 49 8d 94 24 00 f0 01 00 4c 39 f2 RSP: 0018:ffffc90000a07df8 EFLAGS: 00000202 RAX: 0000000000000001 RBX: ffffc90000a07ea8 RCX: 0000000000000101 RDX: ffffc90000a07ea8 RSI: ffffffff8e71620f RDI: ffffffff8c8ea180 RBP: ffffc90000a07ed0 R08: ffffc90000a07f00 R09: 0000000000000000 R10: ffffc90000a07ea8 R11: fffff52000140fe1 R12: fffffe000004f000 R13: dffffc0000000000 R14: ffffc90000a07e50 R15: ffff888027123e80 FS: 0000000000000000(0000) GS:ffff88812350a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000080 CR3: 000000000ff48000 CR4: 00000000003526f0 Call Trace: get_stack_info+0x3a/0xf0 arch/x86/kernel/dumpstack_64.c:199 __unwind_start+0x3c5/0x660 arch/x86/kernel/unwind_orc.c:756 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xe3/0x150 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:351 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:377 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4720 [inline] slab_alloc_node mm/slub.c:5033 [inline] kmem_cache_alloc_node_noprof+0x34f/0x600 mm/slub.c:5105 __alloc_skb+0x1db/0x7a0 net/core/skbuff.c:707 alloc_skb include/linux/skbuff.h:1395 [inline] synproxy_send_client_synack+0x175/0xde0 net/netfilter/nf_synproxy_core.c:463 nft_synproxy_eval_v4+0x362/0x4e0 net/netfilter/nft_synproxy.c:59 nft_synproxy_do_eval+0x389/0x5d0 net/netfilter/nft_synproxy.c:142 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x48d/0x1b10 net/netfilter/nf_tables_core.c:285 nft_do_chain_ipv4+0x195/0x290 net/netfilter/nft_chain_filter.c:24 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:633 nf_hook include/linux/netfilter.h:280 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:323 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325 __netif_receive_skb_one_core net/core/dev.c:6437 [inline] __netif_receive_skb net/core/dev.c:6550 [inline] process_backlog+0xa6b/0x18b0 net/core/dev.c:6901 __napi_poll+0xaa/0x330 net/core/dev.c:7987 napi_poll net/core/dev.c:8050 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:8207 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 __do_softirq kernel/softirq.c:703 [inline] invoke_softirq kernel/softirq.c:542 [inline] __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:native_irq_enable arch/x86/include/asm/irqflags.h:-1 [inline] RIP: 0010:arch_local_irq_enable arch/x86/include/asm/irqflags.h:119 [inline] RIP: 0010:raw_spin_rq_unlock_irq kernel/sched/sched.h:1719 [inline] RIP: 0010:__schedule+0x1dcb/0x5830 kernel/sched/core.c:7387 Code: 31 f6 e8 88 54 90 f5 4c 89 ff e8 40 65 91 f5 0f 1f 44 00 00 49 83 c7 48 4c 89 ff e8 df c5 01 00 e8 2a ea ca f5 fb 4c 8b 24 24 15 fa ff ff 90 0f 0b 90 f7 c6 01 01 00 00 0f 85 fd e7 ff ff e9 RSP: 0018:ffffc90002f6f7c0 EFLAGS: 00000206 RAX: 000000000063391b RBX: 1ffff920005edf1c RCX: 8000000000000001 RDX: 0000000000000006 RSI: ffffffff8e6a8ac6 RDI: ffffffff8c8ea180 RBP: ffffc90002f6f9b8 R08: ffffffff91bdf9bf R09: 1ffffffff237bf37 R10: dffffc0000000000 R11: fffffbfff237bf38 R12: ffff888027123e80 R13: dffffc0000000000 R14: ffff888027123e80 R15: ffff8880b833c5c8 preempt_schedule_irq+0x4b/0x90 kernel/sched/core.c:7662 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:543 [inline] irqentry_exit+0x14f/0x9b0 kernel/entry/common.c:154 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947 Code: ff ff ff e8 30 5e 61 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 32 48 3d 13 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 4f 71 64 0a cc 48 8d 3d 07 1c 1d RSP: 0018:ffffc90002f6fae0 EFLAGS: 00000292 RAX: 4103e2d38b924000 RBX: 0000000000000001 RCX: 0000000000000046 RDX: 000000006de0c825 RSI: ffffffff8e934743 RDI: ffffffff8c8ea180 RBP: ffff888027123e80 R08: ffffffff8c06b2e0 R09: 0000000000000000 R10: dffffc0000000000 R11: fffffbfff237bf38 R12: ffffffff9000ea60 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000246 sched_submit_work kernel/sched/core.c:7417 [inline] schedule+0xb0/0x2b0 kernel/sched/core.c:7473 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 worker_detach_from_pool kernel/workqueue.c:2942 [inline] rescuer_thread+0xdbe/0x12a0 kernel/workqueue.c:3831 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245