Extracting prog: 5m39.215253508s
Minimizing prog: 49m58.778789857s
Simplifying prog options: 13m45.542117836s
Extracting C: 3m38.944193898s
Simplifying C: 1h7m34.434054008s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program crashed: INFO: task hung in reg_process_self_managed_hints
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-syz_emit_ethernet
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, 0x0, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x0, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: INFO: task hung in inet_rtm_newaddr
a never seen crash title: INFO: task hung in inet_rtm_newaddr, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program crashed: INFO: task hung in reg_process_self_managed_hints
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: INFO: task hung in linkwatch_event
a never seen crash title: INFO: task hung in linkwatch_event, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program crashed: INFO: task hung in reg_process_self_managed_hints
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: INFO: task hung in reg_process_self_managed_hints
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
failed to symbolize report: failed to start scripts/get_maintainer.pl [scripts/get_maintainer.pl --git-min-percent=15 -f net/wireless/reg.c]: fork/exec scripts/get_maintainer.pl: no such file or directory
program crashed: INFO: task hung in reg_process_self_managed_hints
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: INFO: task hung in crda_timeout_work
a never seen crash title: INFO: task hung in crda_timeout_work, ignore
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
program crashed: INFO: task hung in corrupted
a never seen crash title: INFO: task hung in corrupted, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program crashed: INFO: task hung in reg_process_self_managed_hints
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program crashed: INFO: task hung in crda_timeout_work
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-syz_emit_ethernet
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x2, 0x0, 0x0, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0xa}}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0xd7}}}}}}, 0x0)

program crashed: INFO: task hung in addrconf_dad_work
validation run: crashed=true
reproducing took 2h34m43.206914821s
repro crashed as (corrupted=false):
INFO: task kworker/u8:0:12 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:0    state:D stack:24568 pid:12    tgid:12    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xcca/0x1c10 kernel/locking/mutex.c:821
 rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4255
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/1:0:24 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:0     state:D stack:25896 pid:24    tgid:24    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events reg_todo
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xcca/0x1c10 kernel/locking/mutex.c:821
 class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 reg_process_self_managed_hints+0xa5/0x1a0 net/wireless/reg.c:3263
 reg_todo+0x78c/0xa20 net/wireless/reg.c:3277
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task dhcpcd:5274 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:22920 pid:5274  tgid:5274  ppid:5273   task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xcca/0x1c10 kernel/locking/mutex.c:821
 rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 inet_rtm_newaddr+0x31c/0x18c0 net/ipv4/devinet.c:968
 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7169
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2576
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x668/0x950 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x9ac/0x10c0 net/netlink/af_netlink.c:1920
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0xa99/0xc30 net/socket.c:2715
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2769
 __sys_sendmsg+0x160/0x210 net/socket.c:2801
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6a50242407
RSP: 002b:00007ffc534c9350 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f6a501b8780 RCX: 00007f6a50242407
RDX: 0000000000000000 RSI: 00007ffc534dd530 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffc534ed760
R13: 00007f6a501b8708 R14: 0000000000000044 R15: 00007ffc534dd530
 </TASK>
INFO: task kworker/1:5:5763 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:5     state:D stack:26952 pid:5763  tgid:5763  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_power_efficient crda_timeout_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xcca/0x1c10 kernel/locking/mutex.c:821
 crda_timeout_work+0x1f/0x80 net/wireless/reg.c:530
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
locks held by pool_workqueue_/3: 1, on CPU#1:
 #0: ffffffff8fff89a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311
locks held by kworker/0:0/9: 3, last CPU#0:
 #0: ffff88813ff29d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900000e7d08 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x21a/0x1a10 net/netfilter/nf_conntrack_core.c:1530
locks held by kworker/0:1/10: 2, last CPU#0:
 #0: ffff88803576f548 ((wq_completion)wg-crypt-wg1){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900000f7d08 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
locks held by kworker/u8:0/12: 3, on CPU#1:
 #0: ffff88801fba3948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90000117d08 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 #2: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4255
locks held by kworker/1:0/24: 4, on CPU#1:
 #0: ffff88813ff2ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900001e7d08 (reg_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff922963e0 (cfg80211_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #2: ffffffff922963e0 (cfg80211_mutex){+.+.}-{4:4}, at: reg_todo+0x7b/0xa20 net/wireless/reg.c:3273
 #3: ffff88805b5e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 #3: ffff88805b5e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0xa5/0x1a0 net/wireless/reg.c:3263
locks held by khungtaskd/32: 1, last CPU#1:
 #0: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by kworker/u8:2/43: 3, last CPU#1:
 #0: ffff88813ff64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90000b37d08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88805f200800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 #2: ffff88805f200800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:596
locks held by kworker/u8:3/51: 4, last CPU#0:
 #0: ffff88801dec0948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90000bc7d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff91efb468 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:677
 #3: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0x92/0x890 net/core/dev.c:13453
locks held by kworker/u8:4/62: 4, last CPU#0:
 #0: ffff888035914948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc9000203fd08 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: local_lock_release include/linux/local_lock_internal.h:62 [inline]
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x437/0x1600 net/core/dev.c:6867
 #3: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x98/0x750 include/linux/netfilter.h:249
locks held by kworker/u8:5/200: 3, last CPU#1:
 #0: ffff88813ff64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900024ffd08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88813fe4c258 (&devlink->lock_key){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834
locks held by kworker/u8:6/230: 7, last CPU#1:
 #0: ffff888022687148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900031bfd08 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88803843a0e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_trylock_shared+0x21/0xf0 fs/super.c:670
 #3: ffff888038660cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: do_writepages+0x278/0x600 mm/page-writeback.c:2560
 #4: ffff888038438938 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xfa2/0x1390 fs/jbd2/transaction.c:444
 #5: ffff888075964a98 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_map_blocks+0x45a/0xdd0 fs/ext4/inode.c:822
 #6: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline]
 #6: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:320 [inline]
 #6: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
locks held by kworker/u8:7/1120: 3, last CPU#1:
 #0: ffff88813ff64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90005577d08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88805b5e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 #2: ffff88805b5e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:596
locks held by kworker/u8:9/1167: 4, last CPU#1:
 #0: ffff888029cb1948 ((wq_completion)wg-kex-wg0){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90005667d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff888035c81480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88802b946640 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by kworker/0:3/2340: 3, last CPU#0:
 #0: ffff888079ad0d48 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900078cfd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88802b944888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x30/0xe40 drivers/net/wireguard/noise.c:821
locks held by kworker/1:3/4941: 4, on CPU#1:
 #0: ffff888079ad0d48 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90006ea7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88801df31480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
 #3: ffff88802b944888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632
locks held by udevd/4979: 4, last CPU#1:
 #0: ffffffff9013e810 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline]
 #0: ffffffff9013e810 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline]
 #0: ffffffff9013e810 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x79fc/0x84c0 kernel/fork.c:2321
 #1: ffff88807c980340 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
 #1: ffff88807c980340 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716
 #2: ffff888077408340 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
 #2: ffff888077408340 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723
 #3: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline]
 #3: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:320 [inline]
 #3: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
locks held by dhcpcd/5274: 1, on CPU#0:
 #0: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 #0: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x31c/0x18c0 net/ipv4/devinet.c:968
locks held by getty/5370: 2, on CPU#0:
 #0: ffff8880398c70a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1540 drivers/tty/n_tty.c:2211
locks held by kworker/1:4/5673: 2, last CPU#1:
 #0: ffff88805e785148 ((wq_completion)wg-crypt-wg0){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900038e7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
locks held by syz-executor/5746: 1, on CPU#0:
 #0: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline]
 #0: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3598
locks held by kworker/1:5/5763: 3, on CPU#1:
 #0: ffff88813ff29d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90003fafd08 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff922963e0 (cfg80211_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x1f/0x80 net/wireless/reg.c:530
locks held by syz-executor/5854: 1, last CPU#1:
 #0: ffff888073e37948 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x11d/0x590 mm/mmap_lock.c:310
locks held by kworker/0:6/5855: 3, last CPU#0:
 #0: ffff88805e789548 ((wq_completion)wg-kex-wg0#2){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900036e7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff888035c81480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
locks held by kworker/1:6/5857: 2, last CPU#1:
 #0: ffff88803576f948 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90003eefd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
locks held by kworker/u8:13/5858: 2, last CPU#1:
 #0: ffff88813ff63948 ((wq_completion)events_dfl_long){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90003edfd08 ((work_completion)(&(&ipvs->defense_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 62 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Workqueue: bat_events batadv_dat_purge
RIP: 0010:check_preemption_disabled+0x0/0xe0 lib/smp_processor_id.c:13
Code: c0 75 0f 65 8b 05 74 3a d3 09 85 c0 74 04 90 0f 0b 90 e9 53 fc ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 54 55 53 48 83 ec 08 65 8b 15 79 f5 d2 09 65 8b 2d 82 f5 d2 09
RSP: 0018:ffffc90000007280 EFLAGS: 00000046
RAX: 0000000000000004 RBX: ffffffff8ffec4a0 RCX: ffffc90000007294
RDX: 0000000000000004 RSI: ffffffff8e5ec134 RDI: ffffffff8c829780
RBP: ffffffff81bb1d4e R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000200 R11: 000000000001766b R12: ffff888023aa8000
R13: ffffc90000007340 R14: 0000000000000202 R15: 0000000000000005
FS:  0000000000000000(0000) GS:ffff8881224c2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc87f15d008 CR3: 0000000073529000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline]
 lock_release kernel/locking/lockdep.c:5966 [inline]
 lock_release+0x170/0x310 kernel/locking/lockdep.c:5950
 rcu_lock_release include/linux/rcupdate.h:319 [inline]
 rcu_read_unlock include/linux/rcupdate.h:880 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1216 [inline]
 unwind_next_frame+0x3c3/0x2090 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_node_track_caller_noprof+0x33d/0x870 mm/slub.c:5545
 __do_krealloc mm/slub.c:6947 [inline]
 krealloc_node_align_noprof+0x321/0x3e0 mm/slub.c:6968
 nf_ct_ext_add+0x1b0/0x3c0 net/netfilter/nf_conntrack_extend.c:115
 nf_ct_labels_ext_add include/net/netfilter/nf_conntrack_labels.h:45 [inline]
 init_conntrack.isra.0+0x6bf/0x1390 net/netfilter/nf_conntrack_core.c:1791
 resolve_normal_ct net/netfilter/nf_conntrack_core.c:1896 [inline]
 nf_conntrack_in+0xeb3/0x1680 net/netfilter/nf_conntrack_core.c:2038
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xbf/0x220 net/netfilter/core.c:633
 nf_hook.constprop.0+0x2a6/0x750 include/linux/netfilter.h:280
 NF_HOOK include/linux/netfilter.h:323 [inline]
 ip_rcv+0x7d/0x3c0 net/ipv4/ip_input.c:612
 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6405
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6518
 process_backlog+0x487/0x1600 net/core/dev.c:6869
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7938
 napi_poll net/core/dev.c:8001 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:8158
 handle_softirqs+0x216/0xa20 kernel/softirq.c:669
 do_softirq kernel/softirq.c:569 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:556
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 __batadv_dat_purge.part.0+0x294/0x3c0 net/batman-adv/distributed-arp-table.c:252
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:233 [inline]
 batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:271
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

final repro crashed as (corrupted=false):
INFO: task kworker/u8:0:12 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:0    state:D stack:24568 pid:12    tgid:12    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xcca/0x1c10 kernel/locking/mutex.c:821
 rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4255
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/1:0:24 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:0     state:D stack:25896 pid:24    tgid:24    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events reg_todo
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xcca/0x1c10 kernel/locking/mutex.c:821
 class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 reg_process_self_managed_hints+0xa5/0x1a0 net/wireless/reg.c:3263
 reg_todo+0x78c/0xa20 net/wireless/reg.c:3277
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task dhcpcd:5274 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:22920 pid:5274  tgid:5274  ppid:5273   task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xcca/0x1c10 kernel/locking/mutex.c:821
 rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 inet_rtm_newaddr+0x31c/0x18c0 net/ipv4/devinet.c:968
 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7169
 netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2576
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x668/0x950 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x9ac/0x10c0 net/netlink/af_netlink.c:1920
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:818 [inline]
 ____sys_sendmsg+0xa99/0xc30 net/socket.c:2715
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2769
 __sys_sendmsg+0x160/0x210 net/socket.c:2801
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6a50242407
RSP: 002b:00007ffc534c9350 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f6a501b8780 RCX: 00007f6a50242407
RDX: 0000000000000000 RSI: 00007ffc534dd530 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffc534ed760
R13: 00007f6a501b8708 R14: 0000000000000044 R15: 00007ffc534dd530
 </TASK>
INFO: task kworker/1:5:5763 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:5     state:D stack:26952 pid:5763  tgid:5763  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_power_efficient crda_timeout_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5583 [inline]
 __schedule+0x125e/0x6990 kernel/sched/core.c:7382
 __schedule_loop kernel/sched/core.c:7459 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7474
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0xcca/0x1c10 kernel/locking/mutex.c:821
 crda_timeout_work+0x1f/0x80 net/wireless/reg.c:530
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
locks held by pool_workqueue_/3: 1, on CPU#1:
 #0: ffffffff8fff89a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311
locks held by kworker/0:0/9: 3, last CPU#0:
 #0: ffff88813ff29d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900000e7d08 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x21a/0x1a10 net/netfilter/nf_conntrack_core.c:1530
locks held by kworker/0:1/10: 2, last CPU#0:
 #0: ffff88803576f548 ((wq_completion)wg-crypt-wg1){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900000f7d08 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
locks held by kworker/u8:0/12: 3, on CPU#1:
 #0: ffff88801fba3948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90000117d08 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 #2: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4255
locks held by kworker/1:0/24: 4, on CPU#1:
 #0: ffff88813ff2ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900001e7d08 (reg_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff922963e0 (cfg80211_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #2: ffffffff922963e0 (cfg80211_mutex){+.+.}-{4:4}, at: reg_todo+0x7b/0xa20 net/wireless/reg.c:3273
 #3: ffff88805b5e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 #3: ffff88805b5e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0xa5/0x1a0 net/wireless/reg.c:3263
locks held by khungtaskd/32: 1, last CPU#1:
 #0: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #0: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6871
locks held by kworker/u8:2/43: 3, last CPU#1:
 #0: ffff88813ff64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90000b37d08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88805f200800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 #2: ffff88805f200800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:596
locks held by kworker/u8:3/51: 4, last CPU#0:
 #0: ffff88801dec0948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90000bc7d08 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff91efb468 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xb8/0x920 net/core/net_namespace.c:677
 #3: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: default_device_exit_batch+0x92/0x890 net/core/dev.c:13453
locks held by kworker/u8:4/62: 4, last CPU#0:
 #0: ffff888035914948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc9000203fd08 ((work_completion)(&(&bat_priv->dat.work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: local_lock_release include/linux/local_lock_internal.h:62 [inline]
 #2: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x437/0x1600 net/core/dev.c:6867
 #3: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 #3: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #3: ffffffff8ffec4a0 (rcu_read_lock){....}-{1:3}, at: nf_hook.constprop.0+0x98/0x750 include/linux/netfilter.h:249
locks held by kworker/u8:5/200: 3, last CPU#1:
 #0: ffff88813ff64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900024ffd08 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88813fe4c258 (&devlink->lock_key){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x56/0xd20 drivers/net/netdevsim/dev.c:834
locks held by kworker/u8:6/230: 7, last CPU#1:
 #0: ffff888022687148 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900031bfd08 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88803843a0e8 (&type->s_umount_key#57){++++}-{4:4}, at: super_trylock_shared+0x21/0xf0 fs/super.c:670
 #3: ffff888038660cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: do_writepages+0x278/0x600 mm/page-writeback.c:2560
 #4: ffff888038438938 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xfa2/0x1390 fs/jbd2/transaction.c:444
 #5: ffff888075964a98 (&ei->i_data_sem#2){++++}-{4:4}, at: ext4_map_blocks+0x45a/0xdd0 fs/ext4/inode.c:822
 #6: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline]
 #6: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:320 [inline]
 #6: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
locks held by kworker/u8:7/1120: 3, last CPU#1:
 #0: ffff88813ff64148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90005577d08 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88805b5e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6989 [inline]
 #2: ffff88805b5e0800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x92/0x550 net/wireless/core.c:596
locks held by kworker/u8:9/1167: 4, last CPU#1:
 #0: ffff888029cb1948 ((wq_completion)wg-kex-wg0){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90005667d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff888035c81480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
 #3: ffff88802b946640 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
locks held by kworker/0:3/2340: 3, last CPU#0:
 #0: ffff888079ad0d48 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900078cfd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88802b944888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x30/0xe40 drivers/net/wireguard/noise.c:821
locks held by kworker/1:3/4941: 4, on CPU#1:
 #0: ffff888079ad0d48 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90006ea7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff88801df31480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
 #3: ffff88802b944888 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632
locks held by udevd/4979: 4, last CPU#1:
 #0: ffffffff9013e810 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline]
 #0: ffffffff9013e810 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm kernel/fork.c:1595 [inline]
 #0: ffffffff9013e810 (dup_mmap_sem){.+.+}-{0:0}, at: copy_process+0x79fc/0x84c0 kernel/fork.c:2321
 #1: ffff88807c980340 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
 #1: ffff88807c980340 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x127/0x2370 mm/mmap.c:1716
 #2: ffff888077408340 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline]
 #2: ffff888077408340 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x1c9/0x2370 mm/mmap.c:1723
 #3: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline]
 #3: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:320 [inline]
 #3: ffffffff901fe018 (remove_cache_srcu){.+.+}-{0:0}, at: kasan_quarantine_reduce+0x8a/0x1f0 mm/kasan/quarantine.c:259
locks held by dhcpcd/5274: 1, on CPU#0:
 #0: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
 #0: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x31c/0x18c0 net/ipv4/devinet.c:968
locks held by getty/5370: 2, on CPU#0:
 #0: ffff8880398c70a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1540 drivers/tty/n_tty.c:2211
locks held by kworker/1:4/5673: 2, last CPU#1:
 #0: ffff88805e785148 ((wq_completion)wg-crypt-wg0){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900038e7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
locks held by syz-executor/5746: 1, on CPU#0:
 #0: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline]
 #0: ffffffff91f146a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3598
locks held by kworker/1:5/5763: 3, on CPU#1:
 #0: ffff88813ff29d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90003fafd08 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffffffff922963e0 (cfg80211_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x1f/0x80 net/wireless/reg.c:530
locks held by syz-executor/5854: 1, last CPU#1:
 #0: ffff888073e37948 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x11d/0x590 mm/mmap_lock.c:310
locks held by kworker/0:6/5855: 3, last CPU#0:
 #0: ffff88805e789548 ((wq_completion)wg-kex-wg0#2){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc900036e7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
 #2: ffff888035c81480 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
locks held by kworker/1:6/5857: 2, last CPU#1:
 #0: ffff88803576f948 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90003eefd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471
locks held by kworker/u8:13/5858: 2, last CPU#1:
 #0: ffff88813ff63948 ((wq_completion)events_dfl_long){+.+.}-{0:0}, at: process_one_work+0x1461/0x1b10 kernel/workqueue.c:3470
 #1: ffffc90003edfd08 ((work_completion)(&(&ipvs->defense_work)->work)){+.+.}-{0:0}, at: process_one_work+0xa2c/0x1b10 kernel/workqueue.c:3471

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:123
 nmi_trigger_cpumask_backtrace+0x21f/0x2a0 lib/nmi_backtrace.c:66
 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xcb1/0x1030 kernel/hung_task.c:561
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 62 Comm: kworker/u8:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Workqueue: bat_events batadv_dat_purge
RIP: 0010:check_preemption_disabled+0x0/0xe0 lib/smp_processor_id.c:13
Code: c0 75 0f 65 8b 05 74 3a d3 09 85 c0 74 04 90 0f 0b 90 e9 53 fc ff ff 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 54 55 53 48 83 ec 08 65 8b 15 79 f5 d2 09 65 8b 2d 82 f5 d2 09
RSP: 0018:ffffc90000007280 EFLAGS: 00000046
RAX: 0000000000000004 RBX: ffffffff8ffec4a0 RCX: ffffc90000007294
RDX: 0000000000000004 RSI: ffffffff8e5ec134 RDI: ffffffff8c829780
RBP: ffffffff81bb1d4e R08: 0000000000000001 R09: 0000000000000007
R10: 0000000000000200 R11: 000000000001766b R12: ffff888023aa8000
R13: ffffc90000007340 R14: 0000000000000202 R15: 0000000000000005
FS:  0000000000000000(0000) GS:ffff8881224c2000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fc87f15d008 CR3: 0000000073529000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline]
 lock_release kernel/locking/lockdep.c:5966 [inline]
 lock_release+0x170/0x310 kernel/locking/lockdep.c:5950
 rcu_lock_release include/linux/rcupdate.h:319 [inline]
 rcu_read_unlock include/linux/rcupdate.h:880 [inline]
 class_rcu_destructor include/linux/rcupdate.h:1216 [inline]
 unwind_next_frame+0x3c3/0x2090 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:409 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kmalloc_node_track_caller_noprof+0x33d/0x870 mm/slub.c:5545
 __do_krealloc mm/slub.c:6947 [inline]
 krealloc_node_align_noprof+0x321/0x3e0 mm/slub.c:6968
 nf_ct_ext_add+0x1b0/0x3c0 net/netfilter/nf_conntrack_extend.c:115
 nf_ct_labels_ext_add include/net/netfilter/nf_conntrack_labels.h:45 [inline]
 init_conntrack.isra.0+0x6bf/0x1390 net/netfilter/nf_conntrack_core.c:1791
 resolve_normal_ct net/netfilter/nf_conntrack_core.c:1896 [inline]
 nf_conntrack_in+0xeb3/0x1680 net/netfilter/nf_conntrack_core.c:2038
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xbf/0x220 net/netfilter/core.c:633
 nf_hook.constprop.0+0x2a6/0x750 include/linux/netfilter.h:280
 NF_HOOK include/linux/netfilter.h:323 [inline]
 ip_rcv+0x7d/0x3c0 net/ipv4/ip_input.c:612
 __netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6405
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6518
 process_backlog+0x487/0x1600 net/core/dev.c:6869
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7938
 napi_poll net/core/dev.c:8001 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:8158
 handle_softirqs+0x216/0xa20 kernel/softirq.c:669
 do_softirq kernel/softirq.c:569 [inline]
 do_softirq+0xaf/0xf0 kernel/softirq.c:556
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 __batadv_dat_purge.part.0+0x294/0x3c0 net/batman-adv/distributed-arp-table.c:252
 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:233 [inline]
 batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:271
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3495
 process_scheduled_works kernel/workqueue.c:3578 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3659
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>