INFO: task kworker/u4:4:1241 blocked for more than 143 seconds. Not tainted 5.15.163-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:4 state:D stack:23832 pid: 1241 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5030 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376 schedule+0x11b/0x1f0 kernel/sched/core.c:6459 schedule_timeout+0xac/0x300 kernel/time/timer.c:1890 do_wait_for_common+0x2d9/0x480 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2b9/0x360 kernel/rcu/srcutree.c:930 fsnotify_mark_destroy_workfn+0x142/0x340 fs/notify/mark.c:898 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz-executor:3568 blocked for more than 143 seconds. Not tainted 5.15.163-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20792 pid: 3568 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5030 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376 schedule+0x11b/0x1f0 kernel/sched/core.c:6459 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6518 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1352 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] __sys_sendto+0x564/0x720 net/socket.c:2058 __do_sys_sendto net/socket.c:2070 [inline] __se_sys_sendto net/socket.c:2066 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2066 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f4c542ae02c RSP: 002b:00007ffc2a9f31e0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f4c54f69620 RCX: 00007f4c542ae02c RDX: 0000000000000028 RSI: 00007f4c54f69670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffc2a9f3234 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f4c54f69670 R15: 0000000000000000 INFO: task syz-executor:3569 blocked for more than 144 seconds. Not tainted 5.15.163-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:19256 pid: 3569 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5030 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376 schedule+0x11b/0x1f0 kernel/sched/core.c:6459 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6518 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1352 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] __sys_sendto+0x564/0x720 net/socket.c:2058 __do_sys_sendto net/socket.c:2070 [inline] __se_sys_sendto net/socket.c:2066 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2066 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f677427b02c RSP: 002b:00007ffd46002190 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f6774f36620 RCX: 00007f677427b02c RDX: 000000000000002c RSI: 00007f6774f36670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffd460021e4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f6774f36670 R15: 0000000000000000 INFO: task syz-executor:3570 blocked for more than 144 seconds. Not tainted 5.15.163-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21016 pid: 3570 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5030 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376 schedule+0x11b/0x1f0 kernel/sched/core.c:6459 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6518 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2504 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x7b6/0x980 net/netlink/af_netlink.c:1352 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec net/socket.c:704 [inline] __sock_sendmsg net/socket.c:716 [inline] __sys_sendto+0x564/0x720 net/socket.c:2058 __do_sys_sendto net/socket.c:2070 [inline] __se_sys_sendto net/socket.c:2066 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2066 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fe5d3f2102c RSP: 002b:00007ffd89d9b720 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fe5d4bdc620 RCX: 00007fe5d3f2102c RDX: 0000000000000028 RSI: 00007fe5d4bdc670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffd89d9b774 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fe5d4bdc670 R15: 0000000000000000 INFO: task kworker/0:3:3612 blocked for more than 144 seconds. Not tainted 5.15.163-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:24376 pid: 3612 ppid: 2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5030 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376 schedule+0x11b/0x1f0 kernel/sched/core.c:6459 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6518 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 addrconf_dad_work+0xcc/0x1720 net/ipv6/addrconf.c:4112 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/0:4:3614 blocked for more than 145 seconds. Not tainted 5.15.163-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:4 state:D stack:23928 pid: 3614 ppid: 2 flags:0x00004000 Workqueue: events linkwatch_event Call Trace: context_switch kernel/sched/core.c:5030 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376 schedule+0x11b/0x1f0 kernel/sched/core.c:6459 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6518 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 linkwatch_event+0xa/0x50 net/core/link_watch.c:251 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 process_scheduled_works kernel/workqueue.c:2373 [inline] worker_thread+0xdcf/0x1280 kernel/workqueue.c:2459 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz.3.6:3655 blocked for more than 145 seconds. Not tainted 5.15.163-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.6 state:D stack:26480 pid: 3655 ppid: 3572 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5030 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376 schedule+0x11b/0x1f0 kernel/sched/core.c:6459 synchronize_rcu_expedited+0x5c6/0x740 kernel/rcu/tree_exp.h:861 dev_deactivate_many+0x608/0xbf0 net/sched/sch_generic.c:1310 __dev_close_many+0x26d/0x3c0 net/core/dev.c:1577 dev_close_many+0x22a/0x530 net/core/dev.c:1615 unregister_netdevice_many+0x4b0/0x18f0 net/core/dev.c:11070 unregister_netdevice_queue+0x2e6/0x350 net/core/dev.c:11027 unregister_netdevice include/linux/netdevice.h:3012 [inline] ppp_release+0xec/0x1f0 drivers/net/ppp/ppp_generic.c:407 __fput+0x3fe/0x8e0 fs/file_table.c:280 task_work_run+0x129/0x1a0 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x106/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f15b4dbc299 RSP: 002b:00007fff365ed998 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f15b4f4ca80 RCX: 00007f15b4dbc299 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f15b4f4ca80 R08: 00007f15b4f37000 R09: 00007fff365edc7f R10: 00000000003ffd80 R11: 0000000000000246 R12: 000000000000f019 R13: 00007fff365eda90 R14: 00007fff365edab0 R15: ffffffffffffffff Showing all locks held in the system: 3 locks held by kworker/0:1/13: #0: ffff888011c71938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90000d27d20 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x7f/0xb70 net/wireless/reg.c:2436 3 locks held by kworker/1:0/21: #0: ffff888011c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90000db7d20 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: regdb_fw_cb+0x7e/0x1b0 net/wireless/reg.c:1052 1 lock held by khungtaskd/27: #0: ffffffff8c91fb20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 3 locks held by kworker/u4:2/154: 2 locks held by kworker/u4:4/1241: #0: ffff888011c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90005137d20 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 4 locks held by kworker/1:3/3312: 2 locks held by getty/3328: #0: ffff888024ef8098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc900024b32e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0 drivers/tty/n_tty.c:2158 1 lock held by syz-executor/3568: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3569: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3570: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 3 locks held by kworker/0:3/3612: #0: ffff888023d4d538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90003027d20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xcc/0x1720 net/ipv6/addrconf.c:4112 3 locks held by kworker/0:4/3614: #0: ffff888011c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90003047d20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251 2 locks held by syz.3.6/3655: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: ppp_release+0x86/0x1f0 drivers/net/ppp/ppp_generic.c:405 #1: ffffffff8c9240e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #1: ffffffff8c9240e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x280/0x740 kernel/rcu/tree_exp.h:845 1 lock held by syz-executor/3663: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3665: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 2 locks held by dhcpcd/3670: #0: ffff888077fae120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1676 [inline] #0: ffff888077fae120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd50 net/packet/af_packet.c:3161 #1: ffffffff8c9240e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #1: ffffffff8c9240e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x350/0x740 kernel/rcu/tree_exp.h:845 1 lock held by dhcpcd/3671: #0: ffff888014de6120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1676 [inline] #0: ffff888014de6120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd50 net/packet/af_packet.c:3161 1 lock held by dhcpcd/3672: #0: ffff8880645d2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1676 [inline] #0: ffff8880645d2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd50 net/packet/af_packet.c:3161 1 lock held by dhcpcd/3673: #0: ffff88807559c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1676 [inline] #0: ffff88807559c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd50 net/packet/af_packet.c:3161 1 lock held by dhcpcd/3674: #0: ffff8880644d2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1676 [inline] #0: ffff8880644d2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd50 net/packet/af_packet.c:3161 1 lock held by dhcpcd/3675: #0: ffff88801a1d4120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1676 [inline] #0: ffff88801a1d4120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd50 net/packet/af_packet.c:3161 1 lock held by syz-executor/3679: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3682: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3686: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3690: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3693: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3697: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3702: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3705: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3709: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 1 lock held by syz-executor/3712: #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8da30848 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x94c/0xee0 net/core/rtnetlink.c:5626 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.163-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xe72/0xeb0 kernel/hung_task.c:295 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 2662 Comm: kworker/u4:5 Not tainted 5.15.163-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Workqueue: phy6 ieee80211_iface_work RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:567 [inline] RIP: 0010:debug_object_activate+0xbb/0x4e0 lib/debugobjects.c:695 Code: c6 48 85 db 74 3c 48 8d 6b 18 48 89 e8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 ef e8 8f 97 bc fd 4c 39 6d 00 0f 84 f3 00 00 00 <48> 89 d8 48 c1 e8 03 42 80 3c 38 00 74 c3 48 89 df e8 6f 97 bc fd RSP: 0018:ffffc9000ae07300 EFLAGS: 00000087 RAX: 1ffff110039ebd3e RBX: ffff88801cf5e9d8 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc9000ae071e0 RBP: ffff88801cf5e9f0 R08: dffffc0000000000 R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: ffffffff9166b0e0 R13: ffff88807abc7880 R14: 0000000000000002 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055aa73045058 CR3: 0000000023b5c000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: debug_rcu_head_queue kernel/rcu/rcu.h:176 [inline] kvfree_call_rcu+0xb6/0x8a0 kernel/rcu/tree.c:3587 cfg80211_update_known_bss+0x16b/0x9e0 cfg80211_bss_update+0x187/0x21e0 net/wireless/scan.c:1771 cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2492 [inline] cfg80211_inform_bss_frame_data+0xa13/0x20f0 net/wireless/scan.c:2525 ieee80211_bss_info_update+0x7a6/0xc80 net/mac80211/scan.c:190 ieee80211_rx_bss_info net/mac80211/ibss.c:1123 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1614 [inline] ieee80211_ibss_rx_queued_mgmt+0x175e/0x2af0 net/mac80211/ibss.c:1643 ieee80211_iface_process_skb net/mac80211/iface.c:1441 [inline] ieee80211_iface_work+0x78f/0xcc0 net/mac80211/iface.c:1495 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287