INFO: task hung in hci_connect_cfm

Status: auto-obsoleted due to no activity on 2026/10/08 00:51
Subsystems: bluetooth
Labels: prio:high
[Documentation on labels]
First crash: 101d, last: 101d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
cd59c4bf assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ✅ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ INFO: task hung in hci_connect_cfm 2026/07/12 00:00 2026/07/12 00:00 2026/07/12 01:04 d78ea535

Sample crash report:
INFO: task kworker/u9:1:4908 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:1    state:D stack:23912 pid:4908  tgid:4908  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: hci8 hci_rx_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
 le_conn_complete_evt+0x1034/0x1580 net/bluetooth/hci_event.c:5869
 hci_le_conn_complete_evt+0x187/0x470 net/bluetooth/hci_event.c:5895
 hci_event_func net/bluetooth/hci_event.c:7797 [inline]
 hci_event_packet+0x67a/0xf10 net/bluetooth/hci_event.c:7851
 hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4039
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/u9:6:5610 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:6    state:D stack:26168 pid:5610  tgid:5610  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: hci12 hci_rx_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
 le_conn_complete_evt+0x1034/0x1580 net/bluetooth/hci_event.c:5869
 hci_le_conn_complete_evt+0x187/0x470 net/bluetooth/hci_event.c:5895
 hci_event_func net/bluetooth/hci_event.c:7797 [inline]
 hci_event_packet+0x67a/0xf10 net/bluetooth/hci_event.c:7851
 hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4039
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/u9:0:11451 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:0    state:D stack:26184 pid:11451 tgid:11451 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: hci9 hci_rx_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
 le_conn_complete_evt+0x1034/0x1580 net/bluetooth/hci_event.c:5869
 hci_le_conn_complete_evt+0x187/0x470 net/bluetooth/hci_event.c:5895
 hci_event_func net/bluetooth/hci_event.c:7797 [inline]
 hci_event_packet+0x67a/0xf10 net/bluetooth/hci_event.c:7851
 hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4039
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/u9:2:12253 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:2    state:D stack:27432 pid:12253 tgid:12253 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: hci11 hci_rx_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
 le_conn_complete_evt+0x1034/0x1580 net/bluetooth/hci_event.c:5869
 hci_le_conn_complete_evt+0x187/0x470 net/bluetooth/hci_event.c:5895
 hci_event_func net/bluetooth/hci_event.c:7797 [inline]
 hci_event_packet+0x67a/0xf10 net/bluetooth/hci_event.c:7851
 hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4039
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/u9:3:14059 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:3    state:D stack:26504 pid:14059 tgid:14059 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: hci10 hci_rx_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
 le_conn_complete_evt+0x1034/0x1580 net/bluetooth/hci_event.c:5869
 hci_le_conn_complete_evt+0x187/0x470 net/bluetooth/hci_event.c:5895
 hci_event_func net/bluetooth/hci_event.c:7797 [inline]
 hci_event_packet+0x67a/0xf10 net/bluetooth/hci_event.c:7851
 hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4039
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz-executor:16056 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22600 pid:16056 tgid:16056 ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 rtnl_lock net/core/rtnetlink.c:80 [inline]
 rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7076
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
 __sock_sendmsg net/socket.c:790 [inline]
 __sys_sendto+0x41e/0x5d0 net/socket.c:2252
 __do_sys_sendto net/socket.c:2259 [inline]
 __se_sys_sendto net/socket.c:2255 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2255
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff2a670e68e
RSP: 002b:00007ffda58f5658 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000055556660a500 RCX: 00007ff2a670e68e
RDX: 0000000000000028 RSI: 00007ff2a7504670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffda58f56d4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007ff2a7504670 R15: 0000000000000000
 </TASK>
INFO: task kworker/u9:4:16057 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:4    state:D stack:26312 pid:16057 tgid:16057 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: hci13 hci_rx_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
 le_conn_complete_evt+0x1034/0x1580 net/bluetooth/hci_event.c:5869
 hci_le_conn_complete_evt+0x187/0x470 net/bluetooth/hci_event.c:5895
 hci_event_func net/bluetooth/hci_event.c:7797 [inline]
 hci_event_packet+0x67a/0xf10 net/bluetooth/hci_event.c:7851
 hci_rx_work+0x3ee/0x1020 net/bluetooth/hci_core.c:4039
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz-executor:16115 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22424 pid:16115 tgid:16115 ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 rtnl_lock net/core/rtnetlink.c:80 [inline]
 rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7076
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
 __sock_sendmsg net/socket.c:790 [inline]
 __sys_sendto+0x41e/0x5d0 net/socket.c:2252
 __do_sys_sendto net/socket.c:2259 [inline]
 __se_sys_sendto net/socket.c:2255 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2255
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f45c2e9e68e
RSP: 002b:00007ffc2c0db968 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000055555ced4500 RCX: 00007f45c2e9e68e
RDX: 0000000000000028 RSI: 00007f45c3c94670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffc2c0db9e4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f45c3c94670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:16288 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22488 pid:16288 tgid:16288 ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 rtnl_lock net/core/rtnetlink.c:80 [inline]
 rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7076
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
 __sock_sendmsg net/socket.c:790 [inline]
 __sys_sendto+0x41e/0x5d0 net/socket.c:2252
 __do_sys_sendto net/socket.c:2259 [inline]
 __se_sys_sendto net/socket.c:2255 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2255
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3b7a7de68e
RSP: 002b:00007ffce29045d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555589c3e500 RCX: 00007f3b7a7de68e
RDX: 0000000000000028 RSI: 00007f3b7b5d4670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffce2904654 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f3b7b5d4670 R15: 0000000000000000
 </TASK>
INFO: task kworker/u9:8:16535 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:8    state:D stack:28280 pid:16535 tgid:16535 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: hci7 hci_cmd_sync_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x16dc/0x5500 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
 rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
 __rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
 __rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
 rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
 __rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
 __mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
 mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
 hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1408
 hci_abort_conn_sync+0xdd0/0x1190 net/bluetooth/hci_sync.c:5805
 hci_cmd_sync_work+0x20b/0x3f0 net/bluetooth/hci_sync.c:332
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings

Showing all locks held in the system:
1 lock held by kworker/R-kvfre/6:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
3 locks held by kworker/u8:0/12:
 #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88813ff5c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc90000117c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc90000117c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
1 lock held by kworker/R-mm_pe/13:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline]
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xbda/0x10b0 kernel/workqueue.c:3657
6 locks held by kworker/u8:1/14:
3 locks held by pr/legacy/17:
3 locks held by rcuc/1/28:
5 locks held by ktimers/1/29:
2 locks held by kworker/1:0/31:
1 lock held by khungtaskd/37:
 #0: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
 #0: ffffffff8e1c3000 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
5 locks held by kworker/u8:2/41:
6 locks held by kworker/u8:5/125:
3 locks held by kworker/1:2/821:
6 locks held by kworker/u8:10/1647:
4 locks held by kworker/u8:11/2166:
4 locks held by kworker/u9:1/4908:
 #0: ffff888061e5b138 ((wq_completion)hci8#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888061e5b138 ((wq_completion)hci8#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9001048fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9001048fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880337300b0 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xa5/0x1580 net/bluetooth/hci_event.c:5736
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
1 lock held by klogd/4948:
2 locks held by getty/5354:
 #0: ffff88803634c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
2 locks held by syz-executor/5579:
1 lock held by syz-executor/5596:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:641 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3506
5 locks held by kworker/1:3/5605:
4 locks held by kworker/u9:6/5610:
 #0: ffff88803b26a938 ((wq_completion)hci12#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88803b26a938 ((wq_completion)hci12#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900046c7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900046c7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880604880b0 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xa5/0x1580 net/bluetooth/hci_event.c:5736
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
1 lock held by kworker/R-wg-cr/5678:
10 locks held by kworker/R-wg-cr/5681:
9 locks held by kworker/R-wg-cr/5684:
1 lock held by kworker/R-wg-cr/5685:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline]
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xbda/0x10b0 kernel/workqueue.c:3657
1 lock held by kworker/R-wg-cr/5687:
1 lock held by kworker/R-wg-cr/5689:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline]
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xbda/0x10b0 kernel/workqueue.c:3657
3 locks held by kworker/1:4/5710:
2 locks held by kworker/0:6/5712:
 #0: ffff88813ff1b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88813ff1b938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc90005207c40 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc90005207c40 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
3 locks held by kworker/1:5/5725:
9 locks held by kworker/1:7/5809:
4 locks held by kworker/u8:12/5813:
5 locks held by kworker/u8:13/5833:
5 locks held by kworker/u8:15/5949:
4 locks held by kworker/u8:16/5950:
2 locks held by kworker/1:8/5954:
11 locks held by kworker/1:9/6776:
3 locks held by kworker/u8:18/6887:
 #0: ffff888032917138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888032917138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9000571fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9000571fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4769
1 lock held by kworker/R-wg-cr/7672:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
6 locks held by kworker/R-wg-cr/7673:
1 lock held by kworker/u8:19/8694:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
1 lock held by kworker/R-wg-cr/10586:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline]
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xbda/0x10b0 kernel/workqueue.c:3657
12 locks held by kworker/R-wg-cr/10587:
1 lock held by kworker/R-wg-cr/10588:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
6 locks held by kworker/1:1/11149:
4 locks held by kworker/u9:0/11451:
 #0: ffff88804edc9138 ((wq_completion)hci9#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88804edc9138 ((wq_completion)hci9#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900043d7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900043d7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88803b7800b0 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xa5/0x1580 net/bluetooth/hci_event.c:5736
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
6 locks held by kworker/u8:6/11551:
4 locks held by syz.4.1518/11729:
1 lock held by syz.6.1534/11781:
 #0: ffff8880623d20d0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock fs/super.c:58 [inline]
 #0: ffff8880623d20d0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline]
 #0: ffff8880623d20d0 (&type->s_umount_key#54){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:509
1 lock held by syz.5.1577/11860:
 #0: ffff8880338ee0d0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock fs/super.c:58 [inline]
 #0: ffff8880338ee0d0 (&type->s_umount_key#54){++++}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline]
 #0: ffff8880338ee0d0 (&type->s_umount_key#54){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:509
3 locks held by kworker/1:6/12231:
12 locks held by kworker/1:10/12252:
4 locks held by kworker/u9:2/12253:
 #0: ffff88809967a138 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88809967a138 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc90005f0fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc90005f0fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff888061a000b0 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xa5/0x1580 net/bluetooth/hci_event.c:5736
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
3 locks held by kworker/1:11/13349:
3 locks held by kworker/1:12/13856:
4 locks held by kworker/u9:3/14059:
 #0: ffff88806199f938 ((wq_completion)hci10#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88806199f938 ((wq_completion)hci10#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9000d9d7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9000d9d7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880637600b0 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xa5/0x1580 net/bluetooth/hci_event.c:5736
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
1 lock held by syz-executor/16056:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
4 locks held by kworker/u9:4/16057:
 #0: ffff888026f20138 ((wq_completion)hci13#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888026f20138 ((wq_completion)hci13#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9002013fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9002013fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88803bd740b0 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xa5/0x1580 net/bluetooth/hci_event.c:5736
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm+0x2c/0x140 include/net/bluetooth/hci_core.h:2134
1 lock held by syz-executor/16115:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
4 locks held by kworker/u9:5/16116:
 #0: ffff8880622da138 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff8880622da138 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9002017fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9002017fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff888021afcf80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
 #3: ffff888021afc0b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5786
3 locks held by kworker/1:13/16246:
1 lock held by syz-executor/16288:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
6 locks held by kworker/u9:7/16289:
 #0: ffff88803af80938 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88803af80938 ((wq_completion)hci6){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9002023fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9002023fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88805fa00f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
 #3: ffff88805fa000b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5786
 #4: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #4: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1408
 #5: ffff88806415fb70 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x520 net/bluetooth/l2cap_core.c:1808
5 locks held by kworker/u9:8/16535:
 #0: ffff888025bbc938 ((wq_completion)hci7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888025bbc938 ((wq_completion)hci7){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9003481fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9003481fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88802bbc0f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
 #3: ffff88802bbc00b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5786
 #4: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #4: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1408
4 locks held by kworker/u9:9/16536:
 #0: ffff88803b26b138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88803b26b138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9003482fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9003482fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880abf4c0b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
4 locks held by kworker/u9:10/16537:
 #0: ffff88803b733938 ((wq_completion)hci14#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88803b733938 ((wq_completion)hci14#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900347ffc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900347ffc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88802cec80b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
4 locks held by syz.0.3976/16722:
1 lock held by kworker/R-bond0/16816:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
1 lock held by kworker/R-bond0/16821:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
1 lock held by kworker/R-bond0/16827:
 #0: ffffffff8e061d78 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
3 locks held by kworker/1:14/16872:
 #0: ffff88813ff1b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88813ff1b938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9000d427c40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9000d427c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
1 lock held by syz-executor/16986:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
4 locks held by kworker/u9:11/16990:
 #0: ffff8880617db938 ((wq_completion)hci16#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff8880617db938 ((wq_completion)hci16#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900370f7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900370f7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880abea80b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
9 locks held by kworker/1:15/17859:
1 lock held by syz-executor/17886:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
1 lock held by syz-executor/17943:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
4 locks held by kworker/u9:13/17945:
 #0: ffff8880644d3138 ((wq_completion)hci17#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff8880644d3138 ((wq_completion)hci17#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9003d1b7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9003d1b7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880abbf40b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
1 lock held by syz-executor/18088:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
4 locks held by kworker/u9:14/18089:
 #0: ffff88804f161938 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88804f161938 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900401ffc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900401ffc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880abc400b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
1 lock held by syz-executor/19100:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
4 locks held by kworker/u9:15/19102:
 #0: ffff88802c17f138 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88802c17f138 ((wq_completion)hci19#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc90043257c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc90043257c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880263900b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
3 locks held by kworker/1:3H/19204:
1 lock held by syz-executor/20117:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
4 locks held by kworker/u9:16/20118:
 #0: ffff888063c69138 ((wq_completion)hci4#3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888063c69138 ((wq_completion)hci4#3){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc90006c6fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc90006c6fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88808ed940b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
1 lock held by syz-executor/20123:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
4 locks held by kworker/u9:17/20124:
 #0: ffff888029c2e938 ((wq_completion)hci20#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888029c2e938 ((wq_completion)hci20#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9000611fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9000611fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff888089e5c0b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
1 lock held by syz-executor/20221:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
4 locks held by kworker/u9:18/20223:
 #0: ffff888060478138 ((wq_completion)hci21#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888060478138 ((wq_completion)hci21#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900060dfc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900060dfc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880ac2c00b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #3: ffffffff8f734738 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
1 lock held by syz-executor/21017:
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff8f5b0738 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0 net/ipv4/devinet.c:978
1 lock held by dhcpcd/21753:
 #0: ffff888084960358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff888084960358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3204
1 lock held by dhcpcd/21842:
 #0: ffff88806881c358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff88806881c358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3204
1 lock held by dhcpcd/21870:
 #0: ffff88802c7b8358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff88802c7b8358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3204
1 lock held by dhcpcd/21901:
 #0: ffff88803ffba358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff88803ffba358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3204
4 locks held by syz.2.6510/21904:
1 lock held by dhcpcd/21905:
 #0: ffff888063684358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff888063684358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3204
1 lock held by dhcpcd/21908:
 #0: ffff8880603ac358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1713 [inline]
 #0: ffff8880603ac358 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90 net/packet/af_packet.c:3204

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xfd7/0x1030 kernel/hung_task.c:561
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 5687 Comm: kworker/R-wg-cr Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue:  0x0 (wg-crypt-wg1)
RIP: 0010:match_held_lock+0x78/0xb0 kernel/locking/lockdep.c:5337
Code: 00 00 48 c7 c2 d0 14 46 93 48 29 d0 48 c1 f8 03 48 ba 29 5c 8f c2 f5 28 5c 8f 48 0f af d0 bb 01 00 00 00 48 39 ca 74 02 31 db <89> d8 5b 41 5e c3 cc cc cc cc cc 90 e8 d7 cb 7c f9 85 c0 74 1c 83
RSP: 0018:ffffc900050278d0 EFLAGS: 00000046
RAX: 0000000000000002 RBX: 0000000000000001 RCX: 0000000000000002
RDX: 0000000000000001 RSI: ffff8880b873b920 RDI: ffff888031f38c30
RBP: 00000000ffffffff R08: ffff888031f380a7 R09: 0000000000000001
R10: ffff888031f38098 R11: ffffffff8199c830 R12: 0000000000000046
R13: ffff888031f38000 R14: ffff8880b873b920 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888125d4a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000001480 CR3: 000000000dfb0000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __lock_is_held kernel/locking/lockdep.c:5601 [inline]
 lock_is_held_type+0x89/0x150 kernel/locking/lockdep.c:5940
 lock_is_held include/linux/lockdep.h:249 [inline]
 lockdep_assert_rq_held kernel/sched/sched.h:1641 [inline]
 rq_clock_task kernel/sched/sched.h:1805 [inline]
 set_next_task_rt+0x93/0x5b0 kernel/sched/rt.c:1661
 __pick_next_task+0x372/0x3c0 kernel/sched/core.c:6164
 pick_next_task kernel/sched/core.c:-1 [inline]
 __schedule+0x864/0x5500 kernel/sched/core.c:7149
 preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7556
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x14f/0x8f0 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:__list_del_entry_valid_or_report+0x31/0x190 lib/list_debug.c:49
Code: 56 41 55 41 54 53 48 89 fb 49 bd 00 00 00 00 00 fc ff df 48 83 c7 08 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 af 7b 61 fd <4c> 8b 7b 08 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8
RSP: 0018:ffffc90005027cc0 EFLAGS: 00000246
RAX: 1ffff1100695d1ce RBX: ffff888034ae8e68 RCX: ffff888031f38000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888034ae8e70
RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1f5ef7f R12: ffff888034ae8e68
R13: dffffc0000000000 R14: ffff888034ae8e60 R15: 1ffff1100695d1cc
 __list_del_entry_valid include/linux/list.h:132 [inline]
 __list_del_entry include/linux/list.h:246 [inline]
 list_del include/linux/list.h:260 [inline]
 detach_worker kernel/workqueue.c:2777 [inline]
 worker_detach_from_pool kernel/workqueue.c:2796 [inline]
 rescuer_thread+0xc48/0x10b0 kernel/workqueue.c:3657
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/10 00:50 upstream 2c7c88a412aa 4167ee25 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in hci_connect_cfm
* Struck through repros no longer work on HEAD.