INFO: task syz.0.957:8758 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.957 state:D stack:25544 pid:8758 tgid:8757 ppid:5591 task_flags:0x40054c flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x16df/0x5510 kernel/sched/core.c:7239
__schedule_loop kernel/sched/core.c:7316 [inline]
schedule+0x164/0x2b0 kernel/sched/core.c:7331
schedule_timeout+0xc0/0x2c0 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2ca/0x5e0 kernel/sched/completion.c:153
exit_aio+0x310/0x3e0 fs/aio.c:980
__mmput+0x68/0x3d0 kernel/fork.c:1190
exit_mm+0x186/0x240 kernel/exit.c:615
do_exit+0x6cd/0x2360 kernel/exit.c:997
do_group_exit+0x22d/0x2f0 kernel/exit.c:1152
get_signal+0x121b/0x12c0 kernel/signal.c:3046
arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f10abb8e0d9
RSP: 002b:00007f10a9de60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f10abe15fa8 RCX: 00007f10abb8e0d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f10abe15fa8
RBP: 00007f10abe15fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f10abe16038 R14: 00007ffd9da3ebf0 R15: 00007ffd9da3ecd8
</TASK>
Showing all locks held in the system:
locks held by kworker/u8:0/12: 3, on CPU#0:
#0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc90000117c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff8880646608d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6884 [inline]
#2: ffff8880646608d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:524
locks held by ktimers/1/29: 5, last CPU#1:
#0: ffffffff8e0591a0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#1: ffffffff8e1c3480 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#2: ffff8880b87284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff8880b87284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: hrtimer_cpu_base_lock_expiry kernel/time/hrtimer.c:1677 [inline]
#2: ffff8880b87284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: hrtimer_run_softirq+0x7d/0x2e0 kernel/time/hrtimer.c:2137
#3: ffffffff8e1c3480 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8e1c3480 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8e1c3480 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8e1c3480 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
#4: ffff888032ccf400 (&q->current_entry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#4: ffff888032ccf400 (&q->current_entry_lock){+...}-{3:3}, at: advance_sched+0xc8/0xc90 net/sched/sch_taprio.c:930
locks held by khungtaskd/37: 1, last CPU#0:
#0: ffffffff8e1c3480 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8e1c3480 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8e1c3480 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6793
locks held by kworker/u8:6/773: 3, on CPU#1:
#0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc900053bfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc900053bfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff8880629508d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6884 [inline]
#2: ffff8880629508d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:524
locks held by kworker/u8:9/1379: 3, on CPU#0:
#0: ffff888032103938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff888032103938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc90006a87c40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc90006a87c40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#2: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4769
locks held by kworker/u8:10/1440: 3, on CPU#0:
#0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc90006c27c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc90006c27c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
locks held by kworker/u8:17/3386: 3, on CPU#0:
#0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc9000f9dfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc9000f9dfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff888063b108d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6884 [inline]
#2: ffff888063b108d8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:524
locks held by getty/5341: 2, on CPU#1:
#0: ffff88803597c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003cc62e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
locks held by kworker/u9:2/5595: 5, on CPU#0:
#0: ffff888063feb938 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff888063feb938 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc9000524fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc9000524fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff88804d5b0f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
#3: ffff88804d5b00b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410
locks held by kworker/u9:4/5599: 6, on CPU#0:
#0: ffff88803a098138 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88803a098138 ((wq_completion)hci6){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc9000528fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc9000528fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff888063024f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
#3: ffff8880630240b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410
#5: ffff88806461e370 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x520 net/bluetooth/l2cap_core.c:1808
locks held by kworker/u9:5/5603: 4, on CPU#0:
#0: ffff88802a10e938 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88802a10e938 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc900052cfc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc900052cfc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff88807c8e00b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3714
#3: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#3: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3748
locks held by kworker/u9:7/5606: 5, on CPU#0:
#0: ffff888063a8d138 ((wq_completion)hci8){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff888063a8d138 ((wq_completion)hci8){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc900052ffc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc900052ffc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff888032f88f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
#3: ffff888032f880b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410
locks held by syz.4.956/8752: 3, on CPU#0:
#0: ffff88803d721db8 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: inode_lock include/linux/fs.h:1025 [inline]
#0: ffff88803d721db8 (&sb->s_type->i_mutex_key#12){+.+.}-{4:4}, at: __sock_release+0x7a/0x1f0 net/socket.c:734
#1: ffffffff8f61db20 ((netlink_chain).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x54/0x90 kernel/notifier.c:379
#2: ffff888031e14cc8 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nft_rcv_nl_event+0x148/0xe60 net/netfilter/nf_tables_api.c:12094
locks held by syz-executor/8763: 2, on CPU#0:
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
locks held by syz-executor/8768: 2, on CPU#0:
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
locks held by syz-executor/8772: 2, on CPU#0:
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
locks held by syz-executor/8773: 2, on CPU#0:
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8ed12e68 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
locks held by syz-executor/8835: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by dhcpcd/8842: 1, on CPU#0:
#0: ffff888064da4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff888064da4358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229
locks held by dhcpcd/8843: 1, on CPU#0:
#0: ffff88802a2a0358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff88802a2a0358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229
locks held by dhcpcd/8844: 1, on CPU#0:
#0: ffff88803548e358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff88803548e358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229
locks held by dhcpcd/8845: 1, on CPU#0:
#0: ffff88803c85e358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff88803c85e358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229
locks held by dhcpcd/8846: 1, on CPU#0:
#0: ffff88805f940358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff88805f940358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229
locks held by dhcpcd/8847: 1, on CPU#0:
#0: ffff888035534358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
#0: ffff888035534358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3229
locks held by syz-executor/8850: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by syz-executor/8852: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by syz-executor/8864: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by syz-executor/8865: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by syz-executor/8873: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by syz-executor/8880: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by syz-executor/8889: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by syz-executor/8891: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by kworker/u9:0/8893: 5, on CPU#0:
#0: ffff888063a8b938 ((wq_completion)hci7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff888063a8b938 ((wq_completion)hci7){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc9001dae7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc9001dae7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff888032f3cf80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
#3: ffff888032f3c0b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410
locks held by syz-executor/8899: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by syz-executor/8905: 1, on CPU#0:
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f5ae878 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
locks held by kworker/u9:3/8907: 5, on CPU#0:
#0: ffff88803a2bb138 ((wq_completion)hci9){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#0: ffff88803a2bb138 ((wq_completion)hci9){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#1: ffffc9001d9c7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
#1: ffffc9001d9c7c40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa1a/0x14c0 kernel/workqueue.c:3405
#2: ffff888078e94f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
#3: ffff888078e940b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5894
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2136 [inline]
#4: ffffffff8f737058 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1410
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:check_wait_context kernel/locking/lockdep.c:-1 [inline]
RIP: 0010:__lock_acquire+0x59b/0x2ce0 kernel/locking/lockdep.c:5203
Code: c9 0f b6 81 c4 00 00 00 84 c0 0f 84 77 ff ff ff 41 0f b6 f4 0f b6 d0 40 38 c6 0f 42 d6 80 b9 c6 00 00 00 02 0f 84 60 ff ff ff <89> d0 e9 59 ff ff ff 48 c7 c7 10 09 09 8e 4c 89 fe e8 ff 5a 60 03
RSP: 0018:ffffc90000a3f838 EFLAGS: 00000097
RAX: 0000000000000003 RBX: ffff88801d2b4a30 RCX: ffffffff93465118
RDX: 0000000000000003 RSI: 0000000000000005 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffffffff8954f2c8 R09: 0000000000000000
R10: 0000000000000000 R11: ffff888032ccf400 R12: ffffffffffffff05
R13: ffff88801d2b4ab0 R14: ffff88801d2b3e00 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888125d32000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffedefeb128 CR3: 000000000dfb0000 CR4: 00000000003526f0
Call Trace:
<TASK>
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5886
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock include/linux/spinlock_rt.h:45 [inline]
advance_sched+0xc8/0xc90 net/sched/sch_taprio.c:930
__run_hrtimer kernel/time/hrtimer.c:2067 [inline]
__hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124
hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141
handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
run_ktimerd+0x6a/0x100 kernel/softirq.c:1183
smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>