INFO: task syz-executor:14318 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22216 pid:14318 tgid:14318 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1500b6034e RSP: 002b:00007ffe45dc4dc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555570afb500 RCX: 00007f1500b6034e RDX: 0000000000000001 RSI: 00007ffe45dc4e50 RDI: 0000000000000005 RBP: 00007f1500c38447 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffe45dc4e50 R14: 00007ffe45dc5690 R15: 0000000000000003 INFO: task syz-executor:14322 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22432 pid:14322 tgid:14322 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fae8fb6034e RSP: 002b:00007ffeb43e4668 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000555557750500 RCX: 00007fae8fb6034e RDX: 0000000000000001 RSI: 00007ffeb43e46f0 RDI: 0000000000000005 RBP: 00007fae8fc38447 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffeb43e46f0 R14: 00007ffeb43e4f30 R15: 0000000000000003 INFO: task syz-executor:14328 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22120 pid:14328 tgid:14328 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fd5f876034e RSP: 002b:00007ffc5c170158 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000055557f2a7500 RCX: 00007fd5f876034e RDX: 0000000000000001 RSI: 00007ffc5c1701e0 RDI: 0000000000000005 RBP: 00007fd5f8838447 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc5c1701e0 R14: 00007ffc5c170a20 R15: 0000000000000003 Showing all locks held in the system: locks held by khungtaskd/31: 1, last CPU#1: #0: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by getty/5385: 2, on CPU#1: #0: ffff888036b9d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz-executor/5616: 2, last CPU#1: #0: ffff888078a6d900 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:616 [inline] #0: ffff888078a6d900 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x19c/0xa40 mm/mmap.c:1299 #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302 locks held by kworker/u9:3/5640: 3, on CPU#1: #0: ffff88802a168148 ((wq_completion)hci4){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802a168148 ((wq_completion)hci4){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802a168148 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802a168148 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90003ac7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003ac7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003ac7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90003ac7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888090d0cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x242/0x430 net/bluetooth/hci_sync.c:337 locks held by kworker/0:4/5731: 2, last CPU#0: #0: ffff88807caf9548 ((wq_completion)wg-kex-wg1#14){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807caf9548 ((wq_completion)wg-kex-wg1#14){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807caf9548 ((wq_completion)wg-kex-wg1#14){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807caf9548 ((wq_completion)wg-kex-wg1#14){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90003e87c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003e87c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003e87c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90003e87c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:10/5943: 6, on CPU#1: #0: ffff88801d28e148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801d28e148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801d28e148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801d28e148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004affc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004affc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004affc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004affc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91684ac8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:679 #3: ffff888056580128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #3: ffff888056580128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff888056580128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x122/0x560 net/devlink/core.c:581 #4: ffff8880546cf258 (&devlink->lock_key#6){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:314 [inline] #4: ffff8880546cf258 (&devlink->lock_key#6){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff8880546cf258 (&devlink->lock_key#6){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x138/0x560 net/devlink/core.c:581 #5: ffffffff901607f8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x175/0x610 kernel/rcu/tree.c:4002 locks held by kworker/u8:14/5949: 3, last CPU#1: #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004b4fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004b4fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004b4fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004b4fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88809d2ed258 (&devlink->lock_key#8){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:20/5955: 6, last CPU#1: #0: ffff888033848148 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888033848148 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888033848148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888033848148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004c3fc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004c3fc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004c3fc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004c3fc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88802b6049c8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule+0xd4/0xfc0 net/batman-adv/bat_iv_ogm.c:1010 #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:968 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule+0x869/0xfc0 net/batman-adv/bat_iv_ogm.c:1011 #4: ffffffff909a5f00 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_objects_fill_pool lib/debugobjects.c:779 [inline] #4: ffffffff909a5f00 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: __debug_object_init+0x2ea/0x3c0 lib/debugobjects.c:792 #5: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #5: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #5: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #5: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by kworker/u8:28/5966: 2, on CPU#1: #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004d1fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004d1fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004d1fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004d1fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:32/5974: 3, last CPU#1: #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000538fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000538fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000538fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000538fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88807f665258 (&devlink->lock_key#3 ){+.+.}-{4:4}, at: lock_timer_base kernel/time/timer.c:1005 [inline] ){+.+.}-{4:4}, at: __mod_timer+0x1a9/0xed0 kernel/time/timer.c:1086 locks held by kworker/0:10/11217: 5, last CPU#0: #0: ffff88813fe0ed48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe0ed48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe0ed48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe0ed48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006d27c40 ((work_completion)(&data->dm_alert_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006d27c40 ((work_completion)(&data->dm_alert_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006d27c40 ((work_completion)(&data->dm_alert_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90006d27c40 ((work_completion)(&data->dm_alert_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: local_lock_acquire include/linux/local_lock_internal.h:46 [inline] #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x3de/0x18b0 net/core/dev.c:6897 #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:249 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:323 #4: ffffffff9015a360 (rcu_read_lock_sched){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #4: ffffffff9015a360 (rcu_read_lock_sched){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #4: ffffffff9015a360 (rcu_read_lock_sched){....}-{1:2}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #4: ffffffff9015a360 (rcu_read_lock_sched){....}-{1:2}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by kworker/0:12/11654: 2, last CPU#0: #0: ffff8880368be948 ((wq_completion)wg-crypt-wg1#3){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880368be948 ((wq_completion)wg-crypt-wg1#3){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880368be948 ((wq_completion)wg-crypt-wg1#3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff8880368be948 ((wq_completion)wg-crypt-wg1#3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004747c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004747c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004747c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004747c40 ((work_completion)(&({ do { const void __attribute__((btf_type_tag("percpu"))) *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by syz-executor/14285: 7, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88803e20c880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 #4: ffff88803d20f128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1109 [inline] #4: ffff88803d20f128 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1046 [inline] #4: ffff88803d20f128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa9/0x7d0 drivers/base/dd.c:1377 #5: ffff88801d775258 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x170 drivers/net/netdevsim/dev.c:1726 #6: ffffffff901607f8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x175/0x610 kernel/rcu/tree.c:4002 locks held by syz-executor/14318: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880941ee880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/14322: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88805627f480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/14328: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888039023880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/14844: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888039d6b880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15127: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888094c43480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15187: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888043e2d080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15189: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888047d81080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15211: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88809309a080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15902: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804ecdb480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15959: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880368ea080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15968: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88808b65cc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15970: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88804db75c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by syz-executor/15977: 4, on CPU#1: #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2762 [inline] #0: ffff8880376fa478 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888055158880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a01d008 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90eec780 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234 locks held by modprobe/16189: 4, last CPU#1: #0: ffff8880885aa948 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:339 #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: do_fault_around mm/memory.c:6069 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: do_read_fault mm/memory.c:6103 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: do_fault mm/memory.c:6246 [inline] #1: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: do_pte_missing+0x139f/0x3570 mm/memory.c:4778 #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: filemap_map_pages+0x1d1/0x2170 mm/filemap.c:3939 #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff9015a2a0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:302 locks held by cmp/16190: 1, last CPU#1: #0: ffff888073728340 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:566 [inline] #0: ffff888073728340 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1ed/0x520 mm/util.c:579 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 5731 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Workqueue: wg-kex-wg1 wg_packet_handshake_receive_worker RIP: 0010:unwind_next_frame+0x11df/0x2550 arch/x86/kernel/unwind_orc.c:670 Code: 89 3b 43 0f b6 44 25 00 84 c0 0f 85 29 11 00 00 49 8d 46 36 c6 00 00 49 8d 5e 50 4c 8b 6c 24 18 48 8b 44 24 30 42 0f b6 04 20 <84> c0 4c 8b 04 24 0f 85 46 0e 00 00 42 0f b6 44 25 00 84 c0 0f 85 RSP: 0018:ffffc90000006e00 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffffc90000006ef8 RCX: 0000000000000000 RDX: ffffffff9257d2f8 RSI: 0000000000000000 RDI: ffffc90000006f08 RBP: 1ffffffff24afa5f R08: ffffc90000006f07 R09: 0000000000000000 R10: ffffc90000006ef8 R11: fffff52000000de1 R12: dffffc0000000000 R13: ffffffff9257d2f4 R14: ffffc90000006ea8 R15: ffffc90000006ef0 FS: 0000000000000000(0000) GS:ffff88812340a000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7d0164f068 CR3: 000000000ff48000 CR4: 00000000003526f0 Call Trace: arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:351 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:377 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4720 [inline] slab_alloc_node mm/slub.c:5033 [inline] kmem_cache_alloc_node_noprof+0x34f/0x600 mm/slub.c:5105 kmalloc_reserve net/core/skbuff.c:618 [inline] __alloc_skb+0x27a/0x7a0 net/core/skbuff.c:718 alloc_skb include/linux/skbuff.h:1395 [inline] synproxy_send_client_synack+0x175/0xde0 net/netfilter/nf_synproxy_core.c:463 nft_synproxy_eval_v4+0x362/0x4e0 net/netfilter/nft_synproxy.c:59 nft_synproxy_do_eval+0x389/0x5d0 net/netfilter/nft_synproxy.c:142 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x48d/0x1b10 net/netfilter/nf_tables_core.c:285 nft_do_chain_ipv4+0x195/0x290 net/netfilter/nft_chain_filter.c:24 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:633 nf_hook include/linux/netfilter.h:280 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:323 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325 __netif_receive_skb_one_core net/core/dev.c:6437 [inline] __netif_receive_skb net/core/dev.c:6550 [inline] process_backlog+0xa6b/0x18b0 net/core/dev.c:6901 __napi_poll+0xaa/0x330 net/core/dev.c:7987 napi_poll net/core/dev.c:8050 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:8207 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 __do_softirq kernel/softirq.c:703 [inline] invoke_softirq kernel/softirq.c:542 [inline] __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:native_irq_enable arch/x86/include/asm/irqflags.h:-1 [inline] RIP: 0010:arch_local_irq_enable arch/x86/include/asm/irqflags.h:119 [inline] RIP: 0010:raw_spin_rq_unlock_irq kernel/sched/sched.h:1719 [inline] RIP: 0010:__schedule+0x1dcb/0x5830 kernel/sched/core.c:7387 Code: 31 f6 e8 88 54 90 f5 4c 89 ff e8 40 65 91 f5 0f 1f 44 00 00 49 83 c7 48 4c 89 ff e8 df c5 01 00 e8 2a ea ca f5 fb 4c 8b 24 24 15 fa ff ff 90 0f 0b 90 f7 c6 01 01 00 00 0f 85 fd e7 ff ff e9 RSP: 0018:ffffc90003e872c0 EFLAGS: 00000202 RAX: 0000000001d0514f RBX: 1ffff920007d0e7c RCX: 8000000000000001 RDX: 0000000000000006 RSI: ffffffff8e6a8ac6 RDI: ffffffff8c8ea180 RBP: ffffc90003e874b8 R08: ffffffff91bdf9bf R09: 1ffffffff237bf37 R10: dffffc0000000000 R11: fffffbfff237bf38 R12: ffff88807eeb3e80 R13: dffffc0000000000 R14: ffff88807eeb3e80 R15: ffff8880b823c5c8 preempt_schedule_irq+0x4b/0x90 kernel/sched/core.c:7662 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:543 [inline] irqentry_exit+0x14f/0x9b0 kernel/entry/common.c:154 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:lock_acquire+0x232/0x350 kernel/locking/lockdep.c:5947 Code: ff ff ff e8 30 5e 61 0a f7 44 24 10 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 32 48 3d 13 48 3b 44 24 50 75 33 fb 48 83 c4 58 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 4f 71 64 0a cc 48 8d 3d 07 1c 1d RSP: 0018:ffffc90003e875e0 EFLAGS: 00000292 RAX: a1f7f3df62253300 RBX: 0000000000000001 RCX: 0000000000000046 RDX: 0000000059a5d5cc RSI: ffffffff8e934743 RDI: ffffffff8c8ea180 RBP: ffff88807eeb3e80 R08: ffffffff86bc66f6 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1013ae56c7 R12: ffff88809d72b4b8 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000246 down_write+0x91/0x200 kernel/locking/rwsem.c:1631 wg_noise_handshake_begin_session+0x36/0xbf0 drivers/net/wireguard/noise.c:821 wg_packet_send_handshake_response+0x137/0x2d0 drivers/net/wireguard/send.c:96 wg_receive_handshake_packet drivers/net/wireguard/receive.c:154 [inline] wg_packet_handshake_receive_worker+0x6a9/0x10b0 drivers/net/wireguard/receive.c:213 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245