BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 174s! Showing busy workqueues and worker pools: workqueue events: flags=0x100 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=14 refcnt=15 pending: 3*nsim_dev_hwstats_traffic_work, 2*psi_avgs_work, vmstat_shepherd, 4*ovs_dp_masks_rebalance, free_obj_work, delayed_vfree_work, psi_avgs_work, ima_keys_handler pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=15 refcnt=16 in-flight: 6012:nsim_fib_event_work ,24:drain_vmap_area_work drain_vmap_area_work ,796:nsim_fib_event_work pending: rht_deferred_worker, 4*nsim_dev_hwstats_traffic_work, psi_avgs_work, 2*ovs_dp_masks_rebalance, 2*psi_avgs_work, rht_deferred_worker workqueue events_long: flags=0x100 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=5 refcnt=6 pending: 3*defense_work_handler, br_multicast_gc_work, br_fdb_cleanup pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=4 refcnt=5 pending: 4*defense_work_handler workqueue events_unbound: flags=0x2 pwq 8: cpus=0-1 flags=0x4 nice=0 active=2 refcnt=3 in-flight: 7263:cfg80211_wiphy_work pending: cfg80211_wiphy_work pwq 8: cpus=0-1 flags=0x4 nice=0 active=7 refcnt=8 in-flight: 7271:fsnotify_mark_destroy_workfn fsnotify_mark_destroy_workfn ,7265:fsnotify_connector_destroy_workfn fsnotify_connector_destroy_workfn ,744:toggle_allocation_gate pending: cfg80211_wiphy_work, flush_memcg_stats_dwork workqueue events_freezable: flags=0x104 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: update_balloon_stats_func workqueue events_power_efficient: flags=0x180 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=5 refcnt=6 pending: wg_ratelimiter_gc_entries, neigh_managed_work, neigh_periodic_work, 2*check_lifetime pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=4 refcnt=5 in-flight: 5881:gc_worker pending: do_cache_clean, nf_flow_offload_work_gc, neigh_managed_work workqueue rcu_gp: flags=0x108 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: srcu_invoke_callbacks workqueue kvfree_rcu_reclaim: flags=0xa workqueue mm_percpu_wq: flags=0x108 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: vmstat_update pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: vmstat_update workqueue writeback: flags=0x4a pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2 in-flight: 744:wb_workfn workqueue kblockd: flags=0x18 pwq 3: cpus=0 node=0 flags=0x0 nice=-20 active=1 refcnt=2 pending: blk_mq_timeout_work workqueue mld: flags=0x40108 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: mld_ifc_work pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: mld_ifc_work workqueue bat_events: flags=0x6000a pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=26 in-flight: 7256:batadv_tt_purge inactive: batadv_tt_purge, batadv_purge_orig, 4*batadv_iv_send_outstanding_bat_ogm_packet, 4*batadv_mcast_mla_update, 2*batadv_iv_send_outstanding_bat_ogm_packet, 2*batadv_purge_orig, 2*batadv_iv_send_outstanding_bat_ogm_packet, batadv_purge_orig, 4*batadv_iv_send_outstanding_bat_ogm_packet, batadv_tt_purge workqueue wg-kex-wg0: flags=0x124 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: wg_packet_handshake_receive_worker pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: wg_packet_handshake_receive_worker workqueue wg-crypt-wg0: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=3 refcnt=4 pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker workqueue wg-crypt-wg1: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=3 refcnt=4 pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker workqueue wg-crypt-wg2: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3 pending: wg_packet_encrypt_worker, wg_packet_tx_worker workqueue wg-crypt-wg0: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3 pending: wg_packet_encrypt_worker, wg_packet_tx_worker workqueue wg-crypt-wg1: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3 pending: wg_packet_tx_worker, wg_packet_encrypt_worker workqueue wg-crypt-wg2: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3 pending: wg_packet_encrypt_worker, wg_packet_tx_worker workqueue wg-kex-wg0: flags=0x124 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: wg_packet_handshake_receive_worker workqueue wg-crypt-wg0: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=3 refcnt=4 pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: wg_packet_tx_worker workqueue wg-kex-wg1: flags=0x124 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: wg_packet_handshake_receive_worker workqueue wg-crypt-wg1: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=3 refcnt=4 pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: wg_packet_tx_worker workqueue wg-kex-wg2: flags=0x124 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2 pending: wg_packet_handshake_receive_worker workqueue wg-crypt-wg2: flags=0x128 pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3 pending: wg_packet_tx_worker, wg_packet_encrypt_worker workqueue hci9: flags=0x20012 pwq 9: cpus=0-1 node=0 flags=0x4 nice=-20 active=1 refcnt=4 pending: hci_rx_work workqueue hci9: flags=0x20012 pwq 9: cpus=0-1 node=0 flags=0x4 nice=-20 active=1 refcnt=4 in-flight: 5835:hci_power_on pool 6: cpus=1 node=0 flags=0x0 nice=0 hung=0s workers=6 idle: 796 6012 5958 5888 pool 8: cpus=0-1 flags=0x4 nice=0 hung=0s workers=25 idle: 7259 49 7261 7263 773 7254 78 13 7252 1159 7277 1110 35 1156 12 7278 1145 7279 7280 7273 pool 9: cpus=0-1 node=0 flags=0x4 nice=-20 hung=0s workers=7 idle: 5828 5839 5834 5825 5830 Showing backtraces of running workers in stalled CPU-bound worker pools: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 10027 Comm: syz.5.1058 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:ktime_get_update_offsets_now+0x3ba/0x3d0 kernel/time/timekeeping.c:2589 Code: 3c 5c 12 00 f3 90 44 8b 3d 83 33 78 18 41 f6 c7 01 75 ec e8 28 5c 12 00 e9 df fc ff ff e8 1e 5c 12 00 4c 89 e8 48 83 c4 40 5b <41> 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 0f 1f 80 00 00 00 00 RSP: 0018:ffffc90000006fb0 EFLAGS: 00000082 RAX: 00000065c1347fd9 RBX: ffff8880b86283e0 RCX: ffff8880273f0000 RDX: 0000000000010100 RSI: 7fffffffffffffff RDI: 00000065c1347fd9 RBP: ffff8880b86284e0 R08: ffffffff81b33e47 R09: ffffffff9a2b7508 R10: ffffc90000006b48 R11: ffffffff816b26b0 R12: 0000006597a1555c R13: 00000065c1347fd9 R14: ffff8880b86284e0 R15: 0000000000014ce4 FS: 00007f2a804856c0(0000) GS:ffff888125463000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055afab9e2950 CR3: 0000000033c8c000 CR4: 00000000003526f0 DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: hrtimer_update_base kernel/time/hrtimer.c:641 [inline] hrtimer_interrupt+0x132/0x1010 kernel/time/hrtimer.c:1893 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline] __sysvec_apic_timer_interrupt+0x102/0x460 arch/x86/kernel/apic/apic.c:1062 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:perf_tp_filter_match kernel/events/core.c:11302 [inline] RIP: 0010:perf_tp_event_match kernel/events/core.c:11319 [inline] RIP: 0010:perf_tp_event+0x339/0x2a90 kernel/events/core.c:11407 Code: 28 00 74 05 e8 08 f9 36 00 4c 8b a3 08 03 00 00 4d 85 e4 4c 0f 44 e3 49 81 c4 88 05 00 00 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 <74> 08 4c 89 e7 e8 dd f8 36 00 49 8b 3c 24 48 85 ff 0f 85 f9 02 00 RSP: 0018:ffffc90000007200 EFLAGS: 00000246 RAX: 1ffff1100fba13d5 RBX: ffff88807dd09920 RCX: ffff8880273f0000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff88807dd09c28 RBP: ffffc900000074a8 R08: ffffc9000000740f R09: 0000000000000000 R10: ffffc90000007400 R11: fffff52000000e82 R12: ffff88807dd09ea8 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880b8633480 perf_trace_run_bpf_submit+0xee/0x170 kernel/events/core.c:11337 do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0x345/0x440 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2a4/0x2e0 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2692 [inline] slab_free mm/slub.c:6168 [inline] kmem_cache_free+0x187/0x630 mm/slub.c:6298 skb_kfree_head net/core/skbuff.c:1087 [inline] skb_free_head net/core/skbuff.c:1101 [inline] skb_release_data+0x6c3/0x940 net/core/skbuff.c:1128 skb_release_all net/core/skbuff.c:1203 [inline] __kfree_skb+0x5d/0x210 net/core/skbuff.c:1217 mac80211_hwsim_beacon_tx+0x3e8/0x870 drivers/net/wireless/virtual/mac80211_hwsim.c:2365 __iterate_interfaces+0x2ab/0x590 net/mac80211/util.c:760 ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:796 mac80211_hwsim_beacon+0xbb/0x180 drivers/net/wireless/virtual/mac80211_hwsim.c:2395 __run_hrtimer kernel/time/hrtimer.c:1785 [inline] __hrtimer_run_queues+0x53a/0xcc0 kernel/time/hrtimer.c:1849 hrtimer_run_softirq+0x182/0x5a0 kernel/time/hrtimer.c:1866 handle_softirqs+0x22a/0x870 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:__sanitizer_cov_trace_pc+0x3b/0x70 kernel/kcov.c:220 Code: 8b 15 69 32 56 11 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 94 16 00 00 00 74 2c 8b 91 70 16 00 00 83 fa 02 75 21 <48> 8b 91 78 16 00 00 48 8b 32 48 8d 7e 01 8b 89 74 16 00 00 48 39 RSP: 0018:ffffc90003826f00 EFLAGS: 00000246 RAX: ffffffff81f8eae5 RBX: 0000000000000000 RCX: ffff8880273f0000 RDX: 0000000000000002 RSI: 000000000007ffff RDI: 0000000000080000 RBP: dffffc0000000000 R08: 0000000000000001 R09: ffff8880b8633350 R10: dffffc0000000000 R11: fffff91ffff95605 R12: ffffe8ffffcab000 R13: ffffffff8e62a340 R14: ffff8880b8633350 R15: ffffffff8e62a3a8 perf_trace_run_bpf_submit+0xb5/0x170 kernel/events/core.c:11330 do_perf_trace_lock_acquire include/trace/events/lock.h:24 [inline] perf_trace_lock_acquire+0x345/0x440 include/trace/events/lock.h:24 __do_trace_lock_acquire include/trace/events/lock.h:24 [inline] trace_lock_acquire include/trace/events/lock.h:24 [inline] lock_acquire+0x2a4/0x2e0 kernel/locking/lockdep.c:5831 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xc2/0x23c0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2692 [inline] slab_free mm/slub.c:6168 [inline] kmem_cache_free+0x187/0x630 mm/slub.c:6298 anon_vma_chain_free mm/rmap.c:147 [inline] unlink_anon_vmas+0x368/0x730 mm/rmap.c:507 free_pgtables+0x663/0xb70 mm/memory.c:414 exit_mmap+0x490/0xa10 mm/mmap.c:1314 __mmput+0x118/0x430 kernel/fork.c:1174 copy_process+0x29a7/0x3cf0 kernel/fork.c:2503 kernel_clone+0x248/0x8e0 kernel/fork.c:2654 __do_sys_clone kernel/fork.c:2795 [inline] __se_sys_clone kernel/fork.c:2779 [inline] __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2779 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2a7f59c799 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2a80484fd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007f2a7f816090 RCX: 00007f2a7f59c799 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000011 RBP: 00007f2a7f632c99 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007f2a7f816128 R14: 00007f2a7f816090 R15: 00007ffe70f8d068 ---------------- Code disassembly (best guess): 0: 3c 5c cmp $0x5c,%al 2: 12 00 adc (%rax),%al 4: f3 90 pause 6: 44 8b 3d 83 33 78 18 mov 0x18783383(%rip),%r15d # 0x18783390 d: 41 f6 c7 01 test $0x1,%r15b 11: 75 ec jne 0xffffffff 13: e8 28 5c 12 00 call 0x125c40 18: e9 df fc ff ff jmp 0xfffffcfc 1d: e8 1e 5c 12 00 call 0x125c40 22: 4c 89 e8 mov %r13,%rax 25: 48 83 c4 40 add $0x40,%rsp 29: 5b pop %rbx * 2a: 41 5c pop %r12 <-- trapping instruction 2c: 41 5d pop %r13 2e: 41 5e pop %r14 30: 41 5f pop %r15 32: 5d pop %rbp 33: c3 ret 34: cc int3 35: cc int3 36: cc int3 37: cc int3 38: cc int3 39: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)