syzbot

INFO: task kworker/1:8:5963 blocked for more than 143 seconds.
      Not tainted 6.14.0-rc5-syzkaller-00268-g1110ce6a1e34 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:8     state:D stack:23456 pid:5963  tgid:5963  ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6857
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x6bd/0xb10 kernel/locking/mutex.c:730
 usb_lock_port drivers/usb/core/hub.c:3220 [inline]
 hub_event+0x5bf/0x4e10 drivers/usb/core/hub.c:5914
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3400
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/31:
 #0: ffffffff8e1bd0c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff8e1bd0c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8e1bd0c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6746
3 locks held by kswapd0/87:
3 locks held by kworker/u8:5/199:
3 locks held by kworker/u8:6/1157:
3 locks held by kworker/u8:7/1317:
4 locks held by kworker/u8:8/3021:
2 locks held by dhcpcd/5487:
2 locks held by dhcpcd/5488:
2 locks held by getty/5583:
 #0: ffff8880320740a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211
2 locks held by syz-executor/5812:
1 lock held by syz-executor/5822:
4 locks held by syz-executor/5823:
2 locks held by syz-executor/5835:
2 locks held by kworker/0:3/5838:
4 locks held by kworker/0:4/5876:
9 locks held by kworker/1:3/5877:
4 locks held by kworker/1:6/5932:
 #0: ffff888032375548 ((wq_completion)wg-kex-wg2){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3213
 #1: ffffc900030e7d18 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((typeof(*((worker))) *)(( unsigned long)((worker))))); (typeof((typeof(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3214
 #2: ffff88805d531308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c3/0x880 drivers/net/wireguard/noise.c:598
 #3: ffff88805c2bb2b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ae/0x880 drivers/net/wireguard/noise.c:632
4 locks held by kworker/1:8/5963:
 #0: ffff888020aab148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3213
 #1: ffffc90003067d18 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3214
 #2: ffff88802973c190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1030 [inline]
 #2: ffff88802973c190 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c1/0x4e10 drivers/usb/core/hub.c:5861
 #3: ffff88802973f510 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3220 [inline]
 #3: ffff88802973f510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x5bf/0x4e10 drivers/usb/core/hub.c:5914
3 locks held by kworker/u8:9/6050:
1 lock held by syz-executor/6626:
2 locks held by syz.1.657/8544:
3 locks held by kworker/u8:13/12056:
3 locks held by kworker/u8:14/12057:
2 locks held by kworker/u8:15/12058:
3 locks held by kworker/u8:17/12060:
6 locks held by syz.1.1843/12697:
2 locks held by syz-executor/12748:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-rc5-syzkaller-00268-g1110ce6a1e34 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline]
 watchdog+0xf62/0x12b0 kernel/hung_task.c:399
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 3021 Comm: kworker/u8:8 Not tainted 6.14.0-rc5-syzkaller-00268-g1110ce6a1e34 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: bat_events batadv_tt_purge
RIP: 0010:stack_trace_consume_entry+0xa7/0x170 kernel/stacktrace.c:93
Code: 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 98 00 00 00 8b 43 0c 85 c0 75 57 48 b8 00 00 00 00 00 fc ff df 48 89 da <48> c1 ea 03 80 3c 02 00 0f 85 9a 00 00 00 8d 45 01 89 43 10 48 8b
RSP: 0018:ffffc90000006b08 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffffc90000006be8 RCX: 0000000000000000
RDX: ffffc90000006be8 RSI: ffffffff8a007d1f RDI: ffffc90000006bf4
RBP: 0000000000000008 R08: ffffc90000006b5c R09: ffffffff9185412c
R10: ffffc90000006b28 R11: 0000000000082d9e R12: ffffffff81a5abb0
R13: ffffc90000006be8 R14: 0000000000000000 R15: ffff88803151c880
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056354fba2a28 CR3: 000000002e6fe000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 arch_stack_walk+0x86/0x100 arch/x86/kernel/stacktrace.c:27
 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2353 [inline]
 slab_free mm/slub.c:4609 [inline]
 kmem_cache_free+0x2e2/0x4d0 mm/slub.c:4711
 __skb_ext_put+0x102/0x2c0 net/core/skbuff.c:7011
 skb_ext_put include/linux/skbuff.h:4876 [inline]
 skb_ext_put include/linux/skbuff.h:4873 [inline]
 skb_release_head_state+0x1c2/0x290 net/core/skbuff.c:1092
 skb_release_all net/core/skbuff.c:1098 [inline]
 __kfree_skb net/core/skbuff.c:1114 [inline]
 sk_skb_reason_drop+0xeb/0x1a0 net/core/skbuff.c:1152
 kfree_skb_reason include/linux/skbuff.h:1271 [inline]
 kfree_skb include/linux/skbuff.h:1280 [inline]
 ip6_mc_input+0x7af/0xfd0 net/ipv6/ip6_input.c:591
 dst_input include/net/dst.h:469 [inline]
 dst_input include/net/dst.h:467 [inline]
 ip6_rcv_finish+0x3a2/0x5b0 net/ipv6/ip6_input.c:79
 ip_sabotage_in+0x21b/0x290 net/bridge/br_netfilter_hooks.c:993
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626
 nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269
 NF_HOOK include/linux/netfilter.h:312 [inline]
 ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5893
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6006
 netif_receive_skb_internal net/core/dev.c:6092 [inline]
 netif_receive_skb+0x13f/0x7b0 net/core/dev.c:6151
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70
 br_handle_frame_finish+0xecc/0x1c90 net/bridge/br_input.c:226
 br_nf_hook_thresh+0x303/0x410 net/bridge/br_netfilter_hooks.c:1170
 br_nf_pre_routing_finish_ipv6+0x76a/0xfb0 net/bridge/br_netfilter_ipv6.c:154
 NF_HOOK include/linux/netfilter.h:314 [inline]
 br_nf_pre_routing_ipv6+0x3ce/0x8c0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x860/0x15b0 net/bridge/br_netfilter_hooks.c:508
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:282 [inline]
 br_handle_frame+0xad7/0x14a0 net/bridge/br_input.c:433
 __netif_receive_skb_core.constprop.0+0xa20/0x4330 net/core/dev.c:5787
 __netif_receive_skb_one_core+0xb1/0x1e0 net/core/dev.c:5891
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6006
 process_backlog+0x443/0x15f0 net/core/dev.c:6354
 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:7188
 napi_poll net/core/dev.c:7257 [inline]
 net_rx_action+0xa94/0x1010 net/core/dev.c:7379
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
 do_softirq kernel/softirq.c:462 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:449
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:389
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 batadv_tt_local_purge+0x21c/0x3c0 net/batman-adv/translation-table.c:1315
 batadv_tt_purge+0x86/0xb90 net/batman-adv/translation-table.c:3509
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3400
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>