INFO: task kworker/1:10:6159 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:10 state:D stack:20984 pid:6159 tgid:6159 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: wg-kex-wg1 wg_packet_handshake_receive_worker
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x145f/0x5070 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
rt_mutex_schedule+0x77/0xf0 kernel/sched/core.c:7241
rt_mutex_slowlock_block kernel/locking/rtmutex.c:1647 [inline]
__rt_mutex_slowlock kernel/locking/rtmutex.c:1721 [inline]
__rt_mutex_slowlock_locked+0x1dfe/0x25e0 kernel/locking/rtmutex.c:1760
__rwbase_read_lock+0xbc/0x180 kernel/locking/rwbase_rt.c:114
rwbase_read_lock kernel/locking/rwbase_rt.c:147 [inline]
__down_read kernel/locking/rwsem.c:1466 [inline]
down_read+0x127/0x1f0 kernel/locking/rwsem.c:1539
wg_noise_handshake_consume_initiation+0x4bf/0x900 drivers/net/wireguard/noise.c:632
wg_receive_handshake_packet drivers/net/wireguard/receive.c:144 [inline]
wg_packet_handshake_receive_worker+0x67d/0xf90 drivers/net/wireguard/receive.c:213
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
INFO: task syz.3.7704:31861 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.7704 state:D stack:24952 pid:31861 tgid:31861 ppid:27890 task_flags:0x400040 flags:0x00080002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x145f/0x5070 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0x165/0x360 kernel/sched/core.c:6960
schedule_timeout+0x9a/0x270 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common kernel/sched/completion.c:132 [inline]
wait_for_completion+0x2bf/0x5d0 kernel/sched/completion.c:153
__synchronize_srcu+0x2ec/0x380 kernel/rcu/srcutree.c:1518
mmu_notifier_unregister+0x2c1/0x3b0 mm/mmu_notifier.c:831
kvm_destroy_vm virt/kvm/kvm_main.c:1296 [inline]
kvm_put_kvm+0x606/0xa80 virt/kvm/kvm_main.c:1354
kvm_vm_release+0x46/0x50 virt/kvm/kvm_main.c:1377
__fput+0x45b/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:233
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
__exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
exit_to_user_mode_loop+0xef/0x4e0 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x2b7/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f89dd52f749
RSP: 002b:00007fffb9247748 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f89dd787da0 RCX: 00007f89dd52f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f89dd787da0 R08: 000000000001652c R09: 0000000db9247a3f
R10: 00007f89dd787cb0 R11: 0000000000000246 R12: 000000000022ae79
R13: 00007f89dd786090 R14: ffffffffffffffff R15: 00007fffb9247860
</TASK>
Showing all locks held in the system:
4 locks held by ktimers/0/16:
4 locks held by pr/legacy/17:
4 locks held by rcuc/1/28:
#0: ffffffff8d44eac0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#1: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#2: ffffffff8d5aea60 (rcu_callback){....}-{0:0}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#2: ffffffff8d5aea60 (rcu_callback){....}-{0:0}, at: rcu_cpu_kthread+0x211/0x1af0 kernel/rcu/tree.c:2938
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
1 lock held by khungtaskd/38:
#0: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kcompactd0/41:
#0: ffff8880b8933cd0 ((lock)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#0: ffff8880b8933cd0 ((lock)#2){+.+.}-{3:3}, at: lru_add_drain_cpu_zone+0x142/0x410 mm/swap.c:759
#1: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#1: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#1: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#1: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#2: ffff8880b8942cd8 (&pcp->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#2: ffff8880b8942cd8 (&pcp->lock){+.+.}-{3:3}, at: drain_pages_zone+0x99/0x160 mm/page_alloc.c:2618
6 locks held by kworker/u8:3/58:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000124fbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000124fbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88805d953300 (&devlink->lock_key#42){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff888092fd1920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff888092fd1920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff888092fd1920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
4 locks held by kworker/u8:4/69:
4 locks held by kworker/0:2/805:
6 locks held by kworker/u8:9/1410:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000521fbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000521fbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88801eef0300 (&devlink->lock_key#25){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff888049b9c120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff888049b9c120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff888049b9c120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
6 locks held by kworker/u8:10/2136:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900058afbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900058afbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888048c0f300 (&devlink->lock_key#24){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff888049a27520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff888049a27520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff888049a27520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
6 locks held by kworker/u8:11/3285:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000c817bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000c817bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88803391e300 (&devlink->lock_key#41){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff88801e6a2d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff88801e6a2d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff88801e6a2d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
4 locks held by kworker/u8:12/3456:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000ca77bc0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000ca77bc0 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88809b0608b8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6363 [inline]
#2: ffff88809b0608b8 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x450 net/wireless/core.c:424
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
3 locks held by kworker/u8:17/4321:
#0: ffff88814d31e938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88814d31e938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000d747bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000d747bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffffffff8e8a5838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#2: ffffffff8e8a5838 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734
1 lock held by klogd/5159:
5 locks held by udevd/5170:
#0: ffffffff8d66d550 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1528 [inline]
#0: ffffffff8d66d550 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x131/0x4b0 kernel/fork.c:1581
#1: ffff8880107cb6b0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:353 [inline]
#1: ffff8880107cb6b0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x125/0x1b40 mm/mmap.c:1726
#2: ffff888053f2dcf0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:343 [inline]
#2: ffff888053f2dcf0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x20d/0x1b40 mm/mmap.c:1733
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#4: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#4: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
2 locks held by getty/5561:
#0: ffff88814046c0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003e8b2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x44f/0x1460 drivers/tty/n_tty.c:2211
4 locks held by kworker/1:10/6159:
#0: ffff88803d1f8538 ((wq_completion)wg-kex-wg1#19){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88803d1f8538 ((wq_completion)wg-kex-wg1#19){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900058dfbc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900058dfbc0 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __ptr = (unsigned long) ((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888034e555f8 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x150/0x900 drivers/net/wireguard/noise.c:598
#3: ffff888010cad8b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x4bf/0x900 drivers/net/wireguard/noise.c:632
2 locks held by kworker/0:15/6525:
6 locks held by kworker/u8:22/6755:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000c7c7bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000c7c7bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888027960300 (&devlink->lock_key#40){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff8880290d9520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff8880290d9520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff8880290d9520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
6 locks held by kworker/u8:7/11287:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900050dfbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900050dfbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888092a13300 (&devlink->lock_key#26){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff88805e089120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff88805e089120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff88805e089120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
6 locks held by kworker/u8:14/11423:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900056ffbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900056ffbc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88804bbe6300 (&devlink->lock_key#43){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff888048c35920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff888048c35920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff888048c35920 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
5 locks held by kworker/u9:3/13157:
#0: ffff8880331d8938 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff8880331d8938 ((wq_completion)hci2#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900057efbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900057efbc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888030be00b0 (&hdev->lock){+.+.}-{4:4}, at: hci_event_packet+0x162/0x1260 net/bluetooth/hci_event.c:7736
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#4: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#4: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
2 locks held by kworker/1:5/15802:
#0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc900051cfbc0 (free_ipc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc900051cfbc0 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
4 locks held by kworker/u8:5/24757:
#0: ffff888023fcf138 ((wq_completion)wg-kex-wg1#20){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888023fcf138 ((wq_completion)wg-kex-wg1#20){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000c4f7bc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000c4f7bc0 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888034e555f8 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x105/0x750 drivers/net/wireguard/noise.c:529
#3: ffff888010cad8b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x116/0x750 drivers/net/wireguard/noise.c:530
6 locks held by kworker/u8:24/26009:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000c8d7bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000c8d7bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88807a0d0300 (&devlink->lock_key#39){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff8880336ed520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff8880336ed520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff8880336ed520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
1 lock held by syz-executor/26061:
#0: ffff88807c9800d0 (&type->s_umount_key#53){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
#0: ffff88807c9800d0 (&type->s_umount_key#53){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
#0: ffff88807c9800d0 (&type->s_umount_key#53){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
3 locks held by kworker/u8:25/27206:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000ec07bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000ec07bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffffffff8e8a5838 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:303
4 locks held by kworker/u9:0/27745:
#0: ffff888057338138 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff888057338138 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90003f37bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90003f37bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888010920f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331
#3: ffff8880109200b0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x242/0xe30 net/bluetooth/hci_sync.c:5702
7 locks held by kworker/0:0/28484:
#0: ffff88801f2e6538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88801f2e6538 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90004fffbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90004fffbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888144b10188 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
#2: ffff888144b10188 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4f30 drivers/usb/core/hub.c:5899
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#4: ffff8880b8842cd8 (&pcp->lock){+.+.}-{3:3}, at: __free_frozen_pages+0x7e2/0x1170 mm/page_alloc.c:2968
#5: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#5: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#5: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_trylock kernel/locking/spinlock_rt.c:110 [inline]
#5: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10d/0x2b0 kernel/locking/spinlock_rt.c:118
#6: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#6: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_pcppages_bulk+0x61/0x4a0 mm/page_alloc.c:1460
5 locks held by kworker/u9:1/28823:
#0: ffff88803da45938 ((wq_completion)hci6#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88803da45938 ((wq_completion)hci6#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000c477bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000c477bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff888066fa40b0 (&hdev->lock){+.+.}-{4:4}, at: le_conn_complete_evt+0xa6/0x1420 net/bluetooth/hci_event.c:5689
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#4: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#4: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
1 lock held by syz-executor/28860:
#0: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#0: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
6 locks held by kworker/u8:27/29914:
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff69938 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000c6e7bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0[ 2426.391043][ T38] #1: ffffc9000c6e7bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000c6e7bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0[ 2426.391043][ T38] #1: ffffc9000c6e7bc0 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff88802442d300 (&devlink->lock_key#38){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbc0 drivers/net/netdevsim/dev.c:908
#3: ffff88804a73ad20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff88804a73ad20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:861 [inline]
#3: ffff88804a73ad20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbc0 drivers/net/netdevsim/dev.c:921
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1c1/0x3e0 kernel/locking/spinlock_rt.c:57
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue_buddy mm/page_alloc.c:3205 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3377 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: get_page_from_freelist+0xda0/0x2960 mm/page_alloc.c:3912
5 locks held by kworker/1:14/30976:
#0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88813ff55138 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc9000c547bc0 ((work_completion)(&ht->run_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc9000c547bc0 ((work_completion)(&ht->run_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff8880511b5880 (&ht->mutex){+.+.}-{4:4}, at: rht_deferred_worker+0x43/0x22f0 lib/rhashtable.c:421
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#3: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#4: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#4: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
3 locks held by syz.7.7682/31817:
2 locks held by syz.4.7701/31851:
#0: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#0: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#1: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#1: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
3 locks held by syz.4.7701/31857:
#0: ffff888027ca80e8 (&kvm->slots_lock){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
#0: ffff888027ca80e8 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vm_ioctl_set_memory_region+0x67/0xe0 virt/kvm/kvm_main.c:2169
#1: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#1: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#2: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#2: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
5 locks held by syz.1.7705/31864:
6 locks held by syz-executor/31869:
#0: ffffffff8e02f288 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e02f288 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e02f288 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
#1: ffffffff8e8a5838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8e8a5838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#1: ffffffff8e8a5838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8ec/0x1c90 net/core/rtnetlink.c:4071
#2: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#2: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#3: ffff8880b8942cd8 (&pcp->lock){+.+.}-{3:3}, at: free_frozen_page_commit+0x828/0x18d0 mm/page_alloc.c:2888
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: __rt_spin_trylock kernel/locking/spinlock_rt.c:110 [inline]
#4: ffffffff8d5ae940 (rcu_read_lock){....}-{1:3}, at: rt_spin_trylock+0x10d/0x2b0 kernel/locking/spinlock_rt.c:118
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#5: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_pcppages_bulk+0x61/0x4a0 mm/page_alloc.c:1460
1 lock held by syz-executor/31877:
#0: ffffffff8e8a5838 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8e8a5838 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0 net/ipv4/devinet.c:978
4 locks held by kworker/u9:4/31880:
#0: ffff88802c108138 ((wq_completion)hci7#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline]
#0: ffff88802c108138 ((wq_completion)hci7#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 kernel/workqueue.c:3340
#1: ffffc90011c27bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline]
#1: ffffc90011c27bc0 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 kernel/workqueue.c:3340
#2: ffff8880537200b0 (&hdev->lock){+.+.}-{4:4}, at: hci_conn_complete_evt+0xbb/0x1190 net/bluetooth/hci_event.c:3088
#3: ffffffff8ec22b98 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
#3: ffffffff8ec22b98 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x281/0x560 lib/kobject_uevent.c:410
3 locks held by syz-executor/31881:
#0: ffffffff8dc71898 (tomoyo_ss){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#0: ffffffff8dc71898 (tomoyo_ss){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:277 [inline]
#0: ffffffff8dc71898 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_read_lock security/tomoyo/common.h:1110 [inline]
#0: ffffffff8dc71898 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_number_perm+0x1bc/0x5a0 security/tomoyo/file.c:722
#1: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#1: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#2: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#2: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
3 locks held by syz-executor/31885:
#0: ffffffff8d6fb800 (namespace_sem){++++}-{4:4}, at: namespace_lock fs/namespace.c:1725 [inline]
#0: ffffffff8d6fb800 (namespace_sem){++++}-{4:4}, at: class_namespace_excl_constructor fs/namespace.c:96 [inline]
#0: ffffffff8d6fb800 (namespace_sem){++++}-{4:4}, at: copy_mnt_ns+0xc3/0x7c0 fs/namespace.c:4117
#1: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#1: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#2: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#2: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
4 locks held by syz-executor/31886:
#0: ffff88801087d988 (&data->open_mutex){+.+.}-{4:4}, at: vhci_create_device+0x34/0x660 drivers/bluetooth/hci_vhci.c:478
#1: ffffffff8ec22b98 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
#1: ffffffff8ec22b98 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x281/0x560 lib/kobject_uevent.c:410
#2: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#2: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
4 locks held by syz-executor/31887:
#0: ffff88805cfa4d08 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1a7/0x4a0 mm/mmap_lock.c:259
#1: ffff88803a6b03b0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock+0x1f/0x80 include/linux/mmap_lock.h:410
#2: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:185 [inline]
#2: ffffffff8d6d4830 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:277
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:44 [inline]
#3: ffff88813fffc5d8 (&zone->lock){+.+.}-{3:3}, at: free_one_page+0x43/0x250 mm/page_alloc.c:1542
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xf95/0xfe0 kernel/hung_task.c:515
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:lookup_chain_cache kernel/locking/lockdep.c:3802 [inline]
RIP: 0010:lookup_chain_cache_add kernel/locking/lockdep.c:3821 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3876 [inline]
RIP: 0010:__lock_acquire+0xc4d/0x2cf0 kernel/locking/lockdep.c:5237
Code: 48 ff cb f7 c1 00 60 00 00 74 c3 e9 90 00 00 00 48 c7 c7 70 e3 47 8d 4c 89 fe e8 ee f3 19 03 48 8b 54 24 18 eb c3 48 8b 48 18 <48> 39 e9 0f 84 b9 00 00 00 48 8b 40 08 48 85 c0 0f 84 ca fe ff ff
RSP: 0018:ffffc900001574a0 EFLAGS: 00000097
RAX: ffffffff9305b9f0 RBX: 000000000006d162 RCX: bf4e01c51708890f
RDX: 0000000039914400 RSI: 0000000005d6ab72 RDI: ffff88801b6e5ac0
RBP: bf4e01c51708890f R08: ffffffff8ad3df8a R09: ffffffff8d604178
R10: dffffc0000000000 R11: fffffbfff1db668f R12: ffff88801b6e6768
R13: ffff88801b6e6768 R14: ffff88801b6e5ac0 R15: 0000000000000007
FS: 0000000000000000(0000) GS:ffff888126cef000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33d09ff8 CR3: 0000000010802000 CR4: 00000000003526f0
Call Trace:
<TASK>
lock_acquire+0x107/0x340 kernel/locking/lockdep.c:5868
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:162
rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]
rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
__rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
rt_spin_lock+0x14a/0x3e0 kernel/locking/spinlock_rt.c:57
spin_lock include/linux/spinlock_rt.h:44 [inline]
kcov_remote_start+0x12d/0x710 kernel/kcov.c:886
kcov_remote_start_usb include/linux/kcov.h:55 [inline]
kcov_remote_start_usb_softirq include/linux/kcov.h:68 [inline]
__usb_hcd_giveback_urb+0x38a/0x5e0 drivers/usb/core/hcd.c:1660
dummy_timer+0x8a0/0x46f0 drivers/usb/gadget/udc/dummy_hcd.c:1995
__run_hrtimer kernel/time/hrtimer.c:1777 [inline]
__hrtimer_run_queues+0x542/0xd00 kernel/time/hrtimer.c:1841
hrtimer_run_softirq+0x1a3/0x2e0 kernel/time/hrtimer.c:1858
handle_softirqs+0x1df/0x650 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
run_ktimerd+0x69/0x100 kernel/softirq.c:1138
smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>