INFO: task syz-executor:23352 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22352 pid:23352 tgid:23352 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8fc675fd8e RSP: 002b:00007ffc9ef12fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000055558993a500 RCX: 00007f8fc675fd8e RDX: 0000000000000001 RSI: 00007ffc9ef13070 RDI: 0000000000000005 RBP: 00007f8fc68373e4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc9ef13070 R14: 00007ffc9ef138b0 R15: 0000000000000003 INFO: task syz-executor:23375 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22632 pid:23375 tgid:23375 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 kernfs_fop_write_iter+0x3a4/0x540 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x612/0xba0 fs/read_write.c:687 ksys_write+0x150/0x270 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff8f1f5fd8e RSP: 002b:00007ffd0fdd9a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000055556462c500 RCX: 00007ff8f1f5fd8e RDX: 0000000000000001 RSI: 00007ffd0fdd9a90 RDI: 0000000000000005 RBP: 00007ff8f20373e4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffd0fdd9a90 R14: 00007ffd0fdda2d0 R15: 0000000000000003 Showing all locks held in the system: locks held by kworker/u8:0/12: 4, last CPU#0: #0: ffff88802d86c148 ((wq_completion)krds_cp_wq#11/6){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802d86c148 ((wq_completion)krds_cp_wq#11/6){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802d86c148 ((wq_completion)krds_cp_wq#11/6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802d86c148 ((wq_completion)krds_cp_wq#11/6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90000117c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000117c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000117c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90000117c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88806639e480 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888076b9f060 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888076b9f060 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by pr/ttyS0/32: 1, last CPU#0: #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:493 [inline] #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 locks held by khungtaskd/33: 1, last CPU#0: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:6/500: 4, last CPU#0: #0: ffff88802d868948 ((wq_completion)krds_cp_wq#11/1){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802d868948 ((wq_completion)krds_cp_wq#11/1){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802d868948 ((wq_completion)krds_cp_wq#11/1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802d868948 ((wq_completion)krds_cp_wq#11/1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90002fcfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002fcfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002fcfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90002fcfc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88806639f380 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff88807d143960 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:8/1116: 3, last CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900053d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900053d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900053d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900053d7c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88807c3cc258 (&devlink->lock_key#10){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by getty/5392: 2, on CPU#1: #0: ffff888037aaf0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz-executor/5601: 2, last CPU#0: #0: ffff8880377a0f80 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff8880377a0f80 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1299 #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290 locks held by kworker/1:7/5816: 3, last CPU#1: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffffff8fd59dc0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fd59dc0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2644 [inline] #1: ffffffff8fd59dc0 (rcu_callback){....}-{0:0}, at: rcu_core+0x8b0/0x1230 kernel/rcu/tree.c:2919 #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by kworker/u8:19/8592: 4, last CPU#0: #0: ffff8880764bb148 ((wq_completion)krds_cp_wq#11/0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880764bb148 ((wq_completion)krds_cp_wq#11/0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880764bb148 ((wq_completion)krds_cp_wq#11/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff8880764bb148 ((wq_completion)krds_cp_wq#11/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004e7fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004e7fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004e7fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004e7fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88806639f680 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888076b9b960 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888076b9b960 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/1:9/10416: 1, last CPU#1: #0: ffff888056796548 ((wq_completion)wg-crypt-wg2#6){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888056796548 ((wq_completion)wg-crypt-wg2#6){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888056796548 ((wq_completion)wg-crypt-wg2#6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888056796548 ((wq_completion)wg-crypt-wg2#6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:24/11950: 3, last CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006f47c40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:928 #2: ffff888084800800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6990 [inline] #2: ffff888084800800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:596 locks held by kworker/1:5/18439: 2, last CPU#1: #0: ffff88801c069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005747c40 ((gc_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005747c40 ((gc_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005747c40 ((gc_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005747c40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:2/22478: 1, last CPU#0: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:4/22479: 5, on CPU#0: #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004c5fc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004c5fc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004c5fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004c5fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91268248 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677 #3: ffff88802a921650 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_destruct+0x116/0x310 drivers/net/wireguard/device.c:249 #4: ffffffff8fd601f8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x175/0x610 kernel/rcu/tree.c:4002 locks held by kworker/u8:7/22481: 3, last CPU#0: #0: ffff888033bf7148 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888033bf7148 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888033bf7148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888033bf7148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004a9fc40 ((work_completion)(&(&bat_priv->mcast.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004a9fc40 ((work_completion)(&(&bat_priv->mcast.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004a9fc40 ((work_completion)(&(&bat_priv->mcast.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004a9fc40 ((work_completion)(&(&bat_priv->mcast.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: batadv_mcast_mla_rtr_flags_meshif_get net/batman-adv/multicast.c:170 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: batadv_mcast_mla_rtr_flags_get net/batman-adv/multicast.c:231 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: batadv_mcast_mla_flags_get net/batman-adv/multicast.c:286 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: __batadv_mcast_mla_update net/batman-adv/multicast.c:910 [inline] #2: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: batadv_mcast_mla_update+0x186/0x3750 net/batman-adv/multicast.c:949 locks held by kworker/u8:13/22483: 3, last CPU#0: #0: ffff88802d86e148 ((wq_completion)krds_cp_wq#11/2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802d86e148 ((wq_completion)krds_cp_wq#11/2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802d86e148 ((wq_completion)krds_cp_wq#11/2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802d86e148 ((wq_completion)krds_cp_wq#11/2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000497fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000497fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000497fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000497fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88806639f080 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:21/22537: 2, on CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90002eafc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002eafc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002eafc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90002eafc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:22/22538: 3, last CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90002627c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002627c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002627c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90002627c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88802a024258 (&devlink->lock_key#9){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:25/22539: 5, last CPU#0: #0: ffff88802d86c148 ((wq_completion)krds_cp_wq#11/6){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802d86c148 ((wq_completion)krds_cp_wq#11/6){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802d86c148 ((wq_completion)krds_cp_wq#11/6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802d86c148 ((wq_completion)krds_cp_wq#11/6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900025f7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900025f7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900025f7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900025f7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88806639e480 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffffffff8feaa030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:213 [inline] #3: ffffffff8feaa030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:320 #4: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #4: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #4: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0 mm/page_owner.c:301 locks held by kworker/u8:26/22540: 3, last CPU#0: #0: ffff88802d86d148 ((wq_completion)krds_cp_wq#11/3){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802d86d148 ((wq_completion)krds_cp_wq#11/3){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802d86d148 ((wq_completion)krds_cp_wq#11/3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802d86d148 ((wq_completion)krds_cp_wq#11/3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900025e7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900025e7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900025e7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900025e7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88806639ed80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:27/22541: 2, on CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900025c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900025c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900025c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900025c7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:29/22544: 6, last CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000210fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000210fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000210fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000210fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff8fbe5af0 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0x12/0x20 kernel/jump_label.c:222 #3: ffffffff8fe36540 (jump_label_mutex){+.+.}-{4:4}, at: jump_label_lock kernel/jump_label.c:27 [inline] #3: ffffffff8fe36540 (jump_label_mutex){+.+.}-{4:4}, at: static_key_enable_cpuslocked+0xcb/0x240 kernel/jump_label.c:207 #4: ffffffff8fbfcb60 (text_mutex){+.+.}-{4:4}, at: arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:145 #5: ffff8880b84400a8 ((local_lock_t *)&pcs->lock){+.+.}-{3:3}, at: __kfree_rcu_sheaf+0x21/0x690 mm/slub.c:6121 locks held by kworker/u8:30/22545: 3, on CPU#0: #0: ffff88801c72c948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c72c948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c72c948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c72c948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900020efc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900020efc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900020efc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900020efc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4795 locks held by kworker/u8:32/22548: 3, last CPU#0: #0: ffff88802d86e948 ((wq_completion)krds_cp_wq#11/7){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802d86e948 ((wq_completion)krds_cp_wq#11/7){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802d86e948 ((wq_completion)krds_cp_wq#11/7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802d86e948 ((wq_completion)krds_cp_wq#11/7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000209fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000209fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000209fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000209fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88806639e180 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:34/22550: 3, on CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000204fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000204fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000204fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000204fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by kworker/u8:35/22551: 4, last CPU#0: #0: ffff88802d869148 ((wq_completion)krds_cp_wq#11/4){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802d869148 ((wq_completion)krds_cp_wq#11/4){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802d869148 ((wq_completion)krds_cp_wq#11/4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802d869148 ((wq_completion)krds_cp_wq#11/4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000324fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000324fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000324fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000324fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88806639ea80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff88807d144720 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff88807d144720 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by syz-executor/23328: 9, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88805d242880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 #4: ffff8880733ff128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff8880733ff128 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline] #4: ffff8880733ff128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369 #5: ffff8880365fe258 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x170 drivers/net/netdevsim/dev.c:1724 #6: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x173/0x800 drivers/net/netdevsim/netdev.c:1201 #7: ffff888045a0ce98 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2883 [inline] #7: ffff888045a0ce98 (&dev->lock){+.+.}-{4:4}, at: netdev_lock_ops_close_many+0x28a/0x540 net/core/dev.c:12608 #8: ffffffff9130f840 (flowtable_lock){+.+.}-{4:4}, at: nf_flow_table_cleanup+0x24/0x100 net/netfilter/nf_flow_table_core.c:763 locks held by syz-executor/23352: 4, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888033533080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 locks held by syz-executor/23375: 4, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888045da3c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 locks held by syz-executor/23450: 4, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880810d0c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 locks held by syz-executor/23496: 4, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff8880659f7480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 locks held by syz-executor/23519: 4, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88807a67c480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 locks held by kworker/1:8/23521: 3, last CPU#1: #0: ffff88807f8f0148 ((wq_completion)wg-crypt-wg2#8){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807f8f0148 ((wq_completion)wg-crypt-wg2#8){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807f8f0148 ((wq_completion)wg-crypt-wg2#8){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807f8f0148 ((wq_completion)wg-crypt-wg2#8){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000389fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000389fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000389fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000389fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff8fd59dc0 (rcu_callback){....}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #2: ffffffff8fd59dc0 (rcu_callback){....}-{0:0}, at: rcu_do_batch kernel/rcu/tree.c:2644 [inline] #2: ffffffff8fd59dc0 (rcu_callback){....}-{0:0}, at: rcu_core+0x8b0/0x1230 kernel/rcu/tree.c:2919 locks held by syz-executor/23541: 4, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888062213880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 locks held by syz-executor/23601: 4, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff888098f8f080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 locks held by kworker/1:10/23637: 2, last CPU#1: #0: ffff88804a413148 ((wq_completion)wg-crypt-wg1#15){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88804a413148 ((wq_completion)wg-crypt-wg1#15){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88804a413148 ((wq_completion)wg-crypt-wg1#15){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88804a413148 ((wq_completion)wg-crypt-wg1#15){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900050a7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900050a7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900050a7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900050a7c40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by syz-executor/23643: 4, on CPU#0: #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2758 [inline] #0: ffff888037b08460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0 fs/read_write.c:683 #1: ffff88803e429880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540 fs/kernfs/file.c:336 #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff88802a4fbe18 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540 fs/kernfs/file.c:337 #3: ffffffff90ad4960 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:233 locks held by syz-executor/23657: 1, last CPU#0: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by syz-executor/23670: 1, last CPU#0: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by syz-executor/23677: 1, last CPU#0: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by syz-executor/23743: 1, on CPU#0: #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 net/core/rtnetlink.c:4251 locks held by syz-executor/23751: 1, on CPU#0: #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 net/core/rtnetlink.c:4251 locks held by syz-executor/23761: 1, on CPU#0: #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 net/core/rtnetlink.c:4251 locks held by syz-executor/23774: 1, on CPU#0: #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91276f20 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by udevd/23776: 2, last CPU#0: #0: ffff88805631e540 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline] #0: ffff88805631e540 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323 #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by udevd/23778: 2, last CPU#0: #0: ffff88805631f180 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline] #0: ffff88805631f180 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323 #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 locks held by udevd/23779: 2, last CPU#0: #0: ffff88805631d900 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline] #0: ffff88805631d900 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323 #1: ffffffff90593040 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_objects_fill_pool lib/debugobjects.c:779 [inline] #1: ffffffff90593040 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_object_activate+0x364/0x420 lib/debugobjects.c:869 locks held by modprobe/23788: 2, last CPU#0: #0: ffff88801c094cc0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:544 [inline] #0: ffff88801c094cc0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x2d8/0x9f0 mm/mmap.c:1323 #1: ffff8880b8424708 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x57/0x7d0 kernel/sched/psi.c:928 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd2/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 23521 Comm: kworker/1:8 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: wg-crypt-wg1 wg_packet_tx_worker RIP: 0010:vlan_get_protocol_and_depth include/linux/if_vlan.h:677 [inline] RIP: 0010:skb_network_protocol+0x203/0x400 net/core/dev.c:3765 Code: c0 0f 85 17 01 00 00 41 89 dc 45 2b 65 00 44 89 ff 44 89 e6 e8 4e 13 0a f8 45 89 fd 45 29 e5 77 59 e8 31 11 0a f8 48 8b 1c 24 <48> 85 db 74 30 e8 23 11 0a f8 48 89 d8 48 c1 e8 03 48 b9 00 00 00 RSP: 0018:ffffc90000a07b40 EFLAGS: 00000246 RAX: ffffffff89be54ef RBX: 0000000000000000 RCX: ffff88802d479f40 RDX: 8000000000000300 RSI: 0000000000000100 RDI: 0000000000000000 RBP: 0000000000000008 R08: 0000000000000100 R09: 0000000000000002 R10: 000000000000a888 R11: 8000000000000300 R12: 0000000000000036 R13: 00000000ffffffca R14: ffff88802ffc9780 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888123b6b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc3db5cdff CR3: 000000000fb48000 CR4: 00000000003526f0 Call Trace: harmonize_features net/core/dev.c:3831 [inline] __netif_skb_features+0x9ad/0x1060 net/core/dev.c:3995 netif_skb_features include/linux/netdevice.h:5528 [inline] validate_xmit_skb+0xa5/0x1a00 net/core/dev.c:4199 validate_xmit_skb_list+0x84/0x130 net/core/dev.c:4265 sch_direct_xmit+0xde/0x4c0 net/sched/sch_generic.c:357 qdisc_restart net/sched/sch_generic.c:437 [inline] __qdisc_run+0xb11/0x1620 net/sched/sch_generic.c:445 qdisc_run include/net/pkt_sched.h:121 [inline] __dev_xmit_skb net/core/dev.c:4468 [inline] __dev_queue_xmit+0x1c2c/0x3920 net/core/dev.c:5024 dev_queue_xmit include/linux/netdevice.h:3483 [inline] neigh_hh_output include/net/neighbour.h:538 [inline] neigh_output include/net/neighbour.h:552 [inline] ip_finish_output2+0xbda/0x10b0 net/ipv4/ip_output.c:236 NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip_output+0x29f/0x450 net/ipv4/ip_output.c:437 synproxy_send_client_synack+0x89b/0xde0 net/netfilter/nf_synproxy_core.c:487 nft_synproxy_eval_v4+0x362/0x4e0 net/netfilter/nft_synproxy.c:59 nft_synproxy_do_eval+0x389/0x5d0 net/netfilter/nft_synproxy.c:142 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x48d/0x1b10 net/netfilter/nf_tables_core.c:285 nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:633 nf_hook include/linux/netfilter.h:280 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:323 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325 __netif_receive_skb_one_core net/core/dev.c:6405 [inline] __netif_receive_skb net/core/dev.c:6518 [inline] process_backlog+0xa6b/0x18b0 net/core/dev.c:6869 __napi_poll+0xaa/0x330 net/core/dev.c:7938 napi_poll net/core/dev.c:8001 [inline] net_rx_action+0x61d/0xf50 net/core/dev.c:8158 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 do_softirq+0x77/0xd0 kernel/softirq.c:569 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 wg_socket_send_skb_to_peer+0x16b/0x1d0 drivers/net/wireguard/socket.c:183 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline] wg_packet_tx_worker+0x1c3/0x7d0 drivers/net/wireguard/send.c:276 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245