INFO: task syz.2.916:9743 blocked for more than 149 seconds.
      Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.916       state:D stack:26984 pid:9743  tgid:9739  ppid:5857   task_flags:0x400140 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5396 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6785
 __schedule_loop kernel/sched/core.c:6863 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6878
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6935
 rwsem_down_write_slowpath+0xbec/0x1030 kernel/locking/rwsem.c:1176
 __down_write_common kernel/locking/rwsem.c:1304 [inline]
 __down_write kernel/locking/rwsem.c:1313 [inline]
 down_write+0x1ab/0x1f0 kernel/locking/rwsem.c:1578
 n_tty_ioctl+0xa7/0x2f0 drivers/tty/n_tty.c:2501
 tty_ioctl+0x9c3/0xde0 drivers/tty/tty_io.c:2811
 vfs_ioctl fs/ioctl.c:51 [inline]
 do_vfs_ioctl+0x1256/0x1990 fs/ioctl.c:861
 __do_sys_ioctl fs/ioctl.c:905 [inline]
 __se_sys_ioctl+0x82/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa33fd8e929
RSP: 002b:00007fa340c9f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa33ffb6080 RCX: 00007fa33fd8e929
RDX: 0000200000000480 RSI: 000000000000541b RDI: 0000000000000003
RBP: 00007fa33fe10ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fa33ffb6080 R15: 00007fa3400dfa28
 </TASK>
INFO: task syz.0.919:9748 blocked for more than 149 seconds.
      Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.919       state:D stack:27816 pid:9748  tgid:9745  ppid:5852   task_flags:0x400040 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5396 [inline]
 __schedule+0x16f5/0x4d00 kernel/sched/core.c:6785
 __schedule_loop kernel/sched/core.c:6863 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6878
 schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
 ___down_common kernel/locking/semaphore.c:268 [inline]
 __down_common+0x319/0x6a0 kernel/locking/semaphore.c:293
 down+0x80/0xd0 kernel/locking/semaphore.c:100
 console_lock+0x145/0x1b0 kernel/printk/printk.c:2849
 con_install+0x9b/0x700 drivers/tty/vt/vt.c:3515
 tty_driver_install_tty drivers/tty/tty_io.c:1304 [inline]
 tty_init_dev+0xd7/0x4d0 drivers/tty/tty_io.c:1416
 tty_open_by_driver drivers/tty/tty_io.c:2082 [inline]
 tty_open+0x5ab/0xd10 drivers/tty/tty_io.c:2129
 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414
 do_dentry_open+0xdf3/0x1970 fs/open.c:964
 vfs_open+0x3b/0x340 fs/open.c:1094
 do_open fs/namei.c:3887 [inline]
 path_openat+0x2ee5/0x3830 fs/namei.c:4046
 do_filp_open+0x1fa/0x410 fs/namei.c:4073
 do_sys_openat2+0x121/0x1c0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f99a038d290
RSP: 002b:00007f999e1f5b70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f99a038d290
RDX: 0000000000000002 RSI: 00007f999e1f5c10 RDI: 00000000ffffff9c
RBP: 00007f999e1f5c10 R08: 0000000000000000 R09: 00007f999e1f5987
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f99a05b6080 R15: 00007f99a06dfa28
 </TASK>

Showing all locks held in the system:
2 locks held by kthreadd/2:
4 locks held by kworker/0:0/9:
4 locks held by kworker/u8:0/12:
1 lock held by khungtaskd/31:
 #0: ffffffff8e13f060 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8e13f060 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
 #0: ffffffff8e13f060 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6770
4 locks held by kworker/u8:2/36:
3 locks held by kworker/1:1/43:
4 locks held by kworker/u8:3/49:
3 locks held by kworker/u8:4/78:
 #0: ffff88814c95b148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88814c95b148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321
 #1: ffffc9000211fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc9000211fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321
 #2: ffffffff8f50ec88 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8f50ec88 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4738
3 locks held by kworker/u8:7/3441:
3 locks held by kworker/u8:9/3480:
8 locks held by kworker/u8:10/3495:
2 locks held by kworker/u8:11/3529:
2 locks held by klogd/5198:
4 locks held by udevd/5209:
1 lock held by dhcpcd/5503:
1 lock held by dhcpcd/5504:
2 locks held by getty/5599:
 #0: ffff8880351220a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 drivers/tty/n_tty.c:2222
4 locks held by kworker/1:3/5831:
2 locks held by syz-executor/5854:
1 lock held by syz-executor/5858:
4 locks held by kworker/0:3/5895:
 #0: ffff88805a58c548 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88805a58c548 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321
 #1: ffffc90004e7fbc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc90004e7fbc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321
 #2: ffff888033d01308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x150/0x900 drivers/net/wireguard/noise.c:598
 #3: ffff888059368338 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x4de/0x900 drivers/net/wireguard/noise.c:632
3 locks held by kworker/0:5/5897:
3 locks held by kworker/1:5/5900:
 #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321
 #1: ffffc90004eafbc0 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc90004eafbc0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321
 #2: ffffffff8f50ec88 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
3 locks held by kworker/1:7/5916:
 #0: ffff88801a481d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88801a481d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321
 #1: ffffc90004f5fbc0 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc90004f5fbc0 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321
 #2: ffffffff8f50ec88 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x95/0xf00 net/wireless/reg.c:2483
3 locks held by kworker/1:8/5922:
2 locks held by syz.1.293/6970:
6 locks held by syz.2.916/9741:
2 locks held by syz.2.916/9743:
 #0: ffff88807b36e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffff88807b36e2e8 (&tty->termios_rwsem){++++}-{4:4}, at: n_tty_ioctl+0xa7/0x2f0 drivers/tty/n_tty.c:2501
2 locks held by syz.0.919/9748:
 #0: ffffffff8e99e508 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2046 [inline]
 #0: ffffffff8e99e508 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x200/0xd10 drivers/tty/tty_io.c:2129
 #1: ffff8880309cc1c0 (&tty->legacy_mutex){+.+.}-{4:4}, at: tty_init_dev+0x74/0x4d0 drivers/tty/tty_io.c:1415
4 locks held by syz.1.922/9757:
6 locks held by syz-executor/9764:
4 locks held by kworker/u8:1/9765:
4 locks held by kworker/u8:6/9766:
4 locks held by kworker/1:2/9767:
 #0: ffff88805a58c548 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88805a58c548 ((wq_completion)wg-kex-wg0#4){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 kernel/workqueue.c:3321
 #1: ffffc9000435fbc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc9000435fbc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 kernel/workqueue.c:3321
 #2: ffff888033d01308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x1c7/0xb00 drivers/net/wireguard/noise.c:742
 #3: ffff888059368338 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x267/0xb00 drivers/net/wireguard/noise.c:753
3 locks held by kworker/u8:8/9768:
2 locks held by dhcpcd/9769:
 #0: ffff88802fec4258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1667 [inline]
 #0: ffff88802fec4258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcd0 net/packet/af_packet.c:3252
 #1: ffffffff8e144b78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:304 [inline]
 #1: ffffffff8e144b78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 kernel/rcu/tree_exp.h:998
4 locks held by syz-executor/9770:

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:307 [inline]
 watchdog+0xfee/0x1030 kernel/hung_task.c:470
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 3495 Comm: kworker/u8:10 Not tainted 6.15.0-syzkaller-11802-g1af80d00e1e0 #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
RIP: 0010:synproxy_send_tcp_ipv6+0x1b2/0x680 net/netfilter/nf_synproxy_core.c:828
Code: 03 42 0f b6 04 28 84 c0 0f 85 a3 03 00 00 66 c7 03 10 00 ba 58 00 00 00 48 8d 9c 24 80 00 00 00 48 89 df 31 f6 e8 9e 27 84 f8 <c6> 84 24 92 00 00 00 06 48 8d 7b 38 ba 10 00 00 00 48 8b 74 24 28
RSP: 0018:ffffc90000a07fc0 EFLAGS: 00000246
RAX: ffffc90000a08040 RBX: ffffc90000a08040 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90000a08098
RBP: ffffc90000a08120 R08: ffffc90000a08097 R09: 0000000000000000
R10: ffffc90000a08040 R11: fffff52000141013 R12: ffff888035bb2640
R13: dffffc0000000000 R14: dffffc0000000000 R15: ffff888040e46ee8
FS:  0000000000000000(0000) GS:ffff888125d5c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055bebbf13168 CR3: 000000000df38000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 synproxy_send_client_synack_ipv6+0x80e/0xca0 net/netfilter/nf_synproxy_core.c:897
 nft_synproxy_eval_v6+0x36e/0x560 net/netfilter/nft_synproxy.c:90
 nft_synproxy_do_eval+0x3d7/0x570 net/netfilter/nft_synproxy.c:145
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 nft_do_chain+0x409/0x1920 net/netfilter/nf_tables_core.c:285
 nft_do_chain_inet+0x25d/0x340 net/netfilter/nft_chain_filter.c:161
 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline]
 nf_hook_slow+0xc2/0x220 net/netfilter/core.c:623
 nf_hook include/linux/netfilter.h:272 [inline]
 NF_HOOK+0x206/0x3a0 include/linux/netfilter.h:315
 ip6_input+0x16a/0x270 net/ipv6/ip6_input.c:491
 NF_HOOK+0x309/0x3a0 include/linux/netfilter.h:317
 __netif_receive_skb_one_core net/core/dev.c:5977 [inline]
 __netif_receive_skb+0xd3/0x380 net/core/dev.c:6090
 process_backlog+0x60e/0x14f0 net/core/dev.c:6442
 __napi_poll+0xc7/0x480 net/core/dev.c:7414
 napi_poll net/core/dev.c:7478 [inline]
 net_rx_action+0x707/0xe30 net/core/dev.c:7605
 handle_softirqs+0x283/0x870 kernel/softirq.c:579
 do_softirq+0xec/0x180 kernel/softirq.c:480
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x17d/0x1c0 kernel/softirq.c:407
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline]
 kernel_fpu_end+0xd2/0x120 arch/x86/kernel/fpu/core.c:476
 poly1305_blocks_arch+0x5b/0xe0 arch/x86/lib/crypto/poly1305_glue.c:80
 poly1305_blocks lib/crypto/poly1305.c:36 [inline]
 poly1305_update+0xd6/0x1b0 lib/crypto/poly1305.c:44
 __chacha20poly1305_encrypt+0x26e/0x310 lib/crypto/chacha20poly1305.c:81
 chacha20poly1305_encrypt+0x2f4/0x700 lib/crypto/chacha20poly1305.c:104
 message_encrypt drivers/net/wireguard/noise.c:467 [inline]
 wg_noise_handshake_create_initiation+0x4dd/0x7e0 drivers/net/wireguard/noise.c:566
 wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:34 [inline]
 wg_packet_handshake_send_worker+0x163/0x320 drivers/net/wireguard/send.c:51
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321
 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402
 kthread+0x711/0x8a0 kernel/kthread.c:464
 ret_from_fork+0x3f9/0x770 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
IPVS: lblc: UDP 0.0.0.0:0 - no destination available
IPVS: lblc: UDP 0.0.0.0:0 - no destination available
IPVS: lblc: UDP 0.0.0.0:0 - no destination available