INFO: task syz.2.19:4395 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.19 state:D stack:26896 pid: 4395 ppid: 4324 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efd3c5801d9 RSP: 002b:00007ffd87a03378 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007efd3c807fa0 RCX: 00007efd3c5801d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007efd3c617888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efd3c807fac R14: 00007efd3c807fa0 R15: 00007efd3c807fa0 INFO: task syz.1.18:4396 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.18 state:D stack:27088 pid: 4396 ppid: 4319 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc806d361d9 RSP: 002b:00007fffe3656918 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fc806fbdfa0 RCX: 00007fc806d361d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fc806dcd888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc806fbdfac R14: 00007fc806fbdfa0 R15: 00007fc806fbdfa0 INFO: task syz.4.21:4397 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.21 state:D stack:27472 pid: 4397 ppid: 4331 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fca1513e1d9 RSP: 002b:00007ffd23de2e68 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fca153c5fa0 RCX: 00007fca1513e1d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fca151d5888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fca153c5fac R14: 00007fca153c5fa0 R15: 00007fca153c5fa0 INFO: task syz.3.20:4398 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.20 state:D stack:27088 pid: 4398 ppid: 4326 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 trace_array_get kernel/trace/trace.c:451 [inline] tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 do_dentry_open+0x7f7/0xf90 fs/open.c:826 do_open fs/namei.c:3659 [inline] path_openat+0x2718/0x2fb0 fs/namei.c:3793 do_filp_open+0x1df/0x400 fs/namei.c:3820 do_sys_openat2+0x14b/0x500 fs/open.c:1255 do_sys_open fs/open.c:1271 [inline] __do_sys_openat fs/open.c:1287 [inline] __se_sys_openat fs/open.c:1282 [inline] __x64_sys_openat+0x135/0x160 fs/open.c:1282 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fa3d2af61d9 RSP: 002b:00007ffefa871d38 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fa3d2d7dfa0 RCX: 00007fa3d2af61d9 RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c RBP: 00007fa3d2b8d888 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fa3d2d7dfac R14: 00007fa3d2d7dfa0 R15: 00007fa3d2d7dfa0 Showing all locks held in the system: 3 locks held by kworker/1:1/23: #0: ffff88802c568138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90000ddfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128 1 lock held by khungtaskd/27: #0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 3 locks held by kworker/u4:1/144: 2 locks held by getty/3947: #0: ffff88814c7ac098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc90002cf62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158 2 locks held by kworker/1:3/4248: #0: ffff888017872138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90002f4fd00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 3 locks held by kworker/0:16/4312: #0: ffff88802c568138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000312fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e24d5c8 (rtnl_mutex ){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128 5 locks held by syz.0.17/4363: 3 locks held by kworker/u4:6/4384: 1 lock held by syz.2.19/4395: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.1.18/4396: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.21/4397: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3} , at: trace_array_get kernel/trace/trace.c:451 [inline] , at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] , at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.20/4398: #0: ffffffff8d1615a8 ( trace_types_lock ){+.+.}-{3:3} , at: trace_array_get kernel/trace/trace.c:451 [inline] , at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] , at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.5.22/4421: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.6.23/4465: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.9.26/4503: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.7.24/4504: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.8.25/4505: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.2.32/4562: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.44/4608: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.1.43/4609: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.45/4632: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.5.65/4648: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.6.88/4743: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.9.89/4744: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.7.98/4777: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.8.104/4782: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.3.130/4847: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.2.129/4851: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz.4.144/4886: #0: ffffffff8d1615a8 ( trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 1 lock held by syz-executor/4887: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz.1.141/4888: #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline] #0: ffffffff8d1615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105 3 locks held by syz-executor/4892: #0: ffffffff8e24d5c8 (rtnl_mutex ){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] ){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 #1: ffff88805926d3e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x223/0x420 drivers/net/wireguard/device.c:49 #2: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #2: ffffffff8d123a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845 1 lock held by syz-executor/4946: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4948: #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e24d5c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe1b/0xe60 kernel/hung_task.c:369 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4302 Comm: kworker/0:6 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Workqueue: events hci_cmd_timeout RIP: 0010:format_decode+0x146/0x1330 lib/vsprintf.c:2545 Code: 48 c1 e8 03 0f b6 04 18 84 c0 75 2b 45 0f b6 3e 4c 89 ff 48 c7 c6 40 fa 74 8d e8 65 bd 6c fd 45 85 ff 74 2d 41 83 ff 25 74 20 f5 b8 6c fd 49 ff c6 48 ff c5 eb c6 89 e9 80 e1 07 38 c1 7c cc RSP: 0018:ffffc900030af450 EFLAGS: 00000202 RAX: 0000000000000002 RBX: dffffc0000000000 RCX: 0000000000000001 RDX: ffffffff840c6a5b RSI: ffffffff8d74fa40 RDI: 000000000000005d RBP: ffffffff8a2be344 R08: ffff88802d439dc0 R09: 0000000000000002 R10: 0000000000000025 R11: 0000000000000000 R12: ffffffff8a2be344 R13: ffff0a0000000604 R14: ffffffff8a2be344 R15: 000000000000005d FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055557f736a38 CR3: 000000002bd78000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vsnprintf+0xef/0x1c20 lib/vsprintf.c:2763 sprintf+0xe4/0x140 lib/vsprintf.c:3013 print_caller kernel/printk/printk.c:1285 [inline] info_print_prefix+0x20c/0x360 kernel/printk/printk.c:1302 record_print_text kernel/printk/printk.c:1349 [inline] console_unlock+0x650/0x10f0 kernel/printk/printk.c:2725 vprintk_emit+0xc0/0x150 kernel/printk/printk.c:2274 _printk+0xda/0x130 kernel/printk/printk.c:2299 bt_err+0x11e/0x180 net/bluetooth/lib.c:180 hci_cmd_timeout+0x10a/0x220 net/bluetooth/hci_core.c:2797 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287