INFO: task kworker/0:2:940 blocked for more than 143 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:2     state:D stack:23344 pid:940   tgid:940   ppid:2      flags:0x00004000
Workqueue: events request_firmware_work_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6826
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 regdb_fw_cb+0x82/0x1c0 net/wireless/reg.c:1017
 request_firmware_work_func+0x1a4/0x280 drivers/base/firmware_loader/main.c:1167
 process_one_work kernel/workqueue.c:3232 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3313
 worker_thread+0x86d/0xd10 kernel/workqueue.c:3390
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz-executor:5226 blocked for more than 143 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:20800 pid:5226  tgid:5226  ppid:1      flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 namespace_unlock+0x29f/0x4d0 fs/namespace.c:1703
 do_umount fs/namespace.c:1931 [inline]
 path_umount+0xeca/0xf70 fs/namespace.c:2013
 ksys_umount fs/namespace.c:2036 [inline]
 __do_sys_umount fs/namespace.c:2041 [inline]
 __se_sys_umount fs/namespace.c:2039 [inline]
 __x64_sys_umount+0x123/0x170 fs/namespace.c:2039
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f463b57b1a7
RSP: 002b:00007ffd2f22bec8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f463b57b1a7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffd2f22bf80
RBP: 00007ffd2f22bf80 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd2f22d000
R13: 00007f463b5e77b4 R14: 00000000000140e7 R15: 00007ffd2f22d040
 </TASK>
INFO: task syz-executor:5231 blocked for more than 143 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:20992 pid:5231  tgid:5231  ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 namespace_unlock+0x29f/0x4d0 fs/namespace.c:1703
 drop_collected_mounts fs/namespace.c:2225 [inline]
 put_mnt_ns+0xdc/0x120 fs/namespace.c:5549
 free_nsproxy+0x4d/0x3c0 kernel/nsproxy.c:193
 do_exit+0xa2a/0x28e0 kernel/exit.c:938
 do_group_exit+0x207/0x2c0 kernel/exit.c:1088
 get_signal+0x176f/0x1810 kernel/signal.c:2936
 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f43579700d7
RSP: 002b:00007ffcf8e15ab0 EFLAGS: 00000293 ORIG_RAX: 000000000000003d
RAX: fffffffffffffe00 RBX: 000000000000000a RCX: 00007f43579700d7
RDX: 0000000040000000 RSI: 00007ffcf8e15b0c RDI: 00000000ffffffff
RBP: 00007ffcf8e15b0c R08: 0000000000000000 R09: 7fffffffffffffff
R10: 0000000000000000 R11: 0000000000000293 R12: 00005555556e55eb
R13: 00005555556e5590 R14: 000000000001207a R15: 00007ffcf8e15b60
 </TASK>
INFO: task syz-executor:5237 blocked for more than 144 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:19088 pid:5237  tgid:5237  ppid:1      flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 namespace_unlock+0x29f/0x4d0 fs/namespace.c:1703
 do_umount fs/namespace.c:1931 [inline]
 path_umount+0xeca/0xf70 fs/namespace.c:2013
 ksys_umount fs/namespace.c:2036 [inline]
 __do_sys_umount fs/namespace.c:2041 [inline]
 __se_sys_umount fs/namespace.c:2039 [inline]
 __x64_sys_umount+0x123/0x170 fs/namespace.c:2039
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fd6c877b1a7
RSP: 002b:00007ffca60487e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd6c877b1a7
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffca60488a0
RBP: 00007ffca60488a0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffca6049920
R13: 00007fd6c87e77b4 R14: 00000000000121bd R15: 00007ffca6049960
 </TASK>
INFO: task syz.0.9:5362 blocked for more than 144 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.9         state:D stack:23736 pid:5362  tgid:5361  ppid:5231   flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6826
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 exp_funnel_lock kernel/rcu/tree_exp.h:328 [inline]
 synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:969
 synchronize_rcu+0x11b/0x360 kernel/rcu/tree.c:4088
 module_remove_driver+0x2d/0x1d0 drivers/base/module.c:106
 bus_remove_driver+0x1fb/0x320 drivers/base/bus.c:745
 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1731
 raw_release+0xf9/0x1e0 drivers/usb/gadget/legacy/raw_gadget.c:462
 __fput+0x24b/0x890 fs/file_table.c:424
 task_work_run+0x24f/0x310 kernel/task_work.c:228
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xa2f/0x28e0 kernel/exit.c:939
 do_group_exit+0x207/0x2c0 kernel/exit.c:1088
 get_signal+0x176f/0x1810 kernel/signal.c:2936
 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f43579abf65
RSP: 002b:00007f4358774f00 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6
RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00007f43579abf65
RDX: 00007f4358774f40 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007f4358775fe0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000007
R13: 0000000800000000 R14: 0000000000000000 R15: 00007f43579f1683
 </TASK>
INFO: task syz.3.15:5385 blocked for more than 144 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.15        state:D stack:24608 pid:5385  tgid:5384  ppid:5230   flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 dev_deactivate_many+0x4a7/0xb10 net/sched/sch_generic.c:1371
 dev_deactivate net/sched/sch_generic.c:1397 [inline]
 dev_qdisc_change_tx_queue_len+0x1da/0x590 net/sched/sch_generic.c:1453
 dev_change_tx_queue_len+0x195/0x2a0 net/core/dev.c:9028
 dev_ifsioc+0x765/0xe70 net/core/dev_ioctl.c:572
 dev_ioctl+0x719/0x1340 net/core/dev_ioctl.c:784
 sock_do_ioctl+0x240/0x460 net/socket.c:1236
 sock_ioctl+0x629/0x8e0 net/socket.c:1341
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff325779e79
RSP: 002b:00007ff3264ff038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ff325915f80 RCX: 00007ff325779e79
RDX: 0000000020000340 RSI: 0000000000008943 RDI: 0000000000000004
RBP: 00007ff3257e7916 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff325915f80 R15: 00007ffc91d98b68
 </TASK>
INFO: task syz.3.15:5388 blocked for more than 145 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.15        state:D stack:23736 pid:5388  tgid:5384  ppid:5230   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6826
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 tun_detach drivers/net/tun.c:698 [inline]
 tun_chr_close+0x3e/0x1b0 drivers/net/tun.c:3516
 __fput+0x24b/0x890 fs/file_table.c:424
 __do_sys_close fs/open.c:1566 [inline]
 __se_sys_close fs/open.c:1551 [inline]
 __x64_sys_close+0x7f/0x110 fs/open.c:1551
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff325779e79
RSP: 002b:00007ff3264de038 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007ff325916058 RCX: 00007ff325779e79
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00007ff3257e7916 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff325916058 R15: 00007ffc91d98b68
 </TASK>
INFO: task syz-executor:5400 blocked for more than 145 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:24736 pid:5400  tgid:5400  ppid:1      flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6826
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 rtnl_lock net/core/rtnetlink.c:79 [inline]
 rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
 netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357
 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:745
 __sys_sendto+0x3a8/0x500 net/socket.c:2204
 __do_sys_sendto net/socket.c:2216 [inline]
 __se_sys_sendto net/socket.c:2212 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2212
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa3b537bd0c
RSP: 002b:00007fff66eed7d0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fa3b6044620 RCX: 00007fa3b537bd0c
RDX: 0000000000000028 RSI: 00007fa3b6044670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fff66eed824 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fa3b6044670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:5403 blocked for more than 145 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:24736 pid:5403  tgid:5403  ppid:1      flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6826
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 rtnl_lock net/core/rtnetlink.c:79 [inline]
 rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
 netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357
 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:745
 __sys_sendto+0x3a8/0x500 net/socket.c:2204
 __do_sys_sendto net/socket.c:2216 [inline]
 __se_sys_sendto net/socket.c:2212 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2212
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f14f517bd0c
RSP: 002b:00007fffa9687bb0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f14f5e44620 RCX: 00007f14f517bd0c
RDX: 0000000000000028 RSI: 00007f14f5e44670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fffa9687c04 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f14f5e44670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:5407 blocked for more than 145 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:24736 pid:5407  tgid:5407  ppid:1      flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6826
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 rtnl_lock net/core/rtnetlink.c:79 [inline]
 rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
 netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357
 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:745
 __sys_sendto+0x3a8/0x500 net/socket.c:2204
 __do_sys_sendto net/socket.c:2216 [inline]
 __se_sys_sendto net/socket.c:2212 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2212
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f68c197bd0c
RSP: 002b:00007ffce2ce7c10 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f68c2644620 RCX: 00007f68c197bd0c
RDX: 0000000000000028 RSI: 00007f68c2644670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffce2ce7c64 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f68c2644670 R15: 0000000000000000
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings
INFO: task syz-executor:5411 blocked for more than 146 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:24736 pid:5411  tgid:5411  ppid:1      flags:0x00000004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6826
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 rtnl_lock net/core/rtnetlink.c:79 [inline]
 rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
 netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357
 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:745
 __sys_sendto+0x3a8/0x500 net/socket.c:2204
 __do_sys_sendto net/socket.c:2216 [inline]
 __se_sys_sendto net/socket.c:2212 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2212
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f31b157bd0c
RSP: 002b:00007fffeb653ea0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f31b2244620 RCX: 00007f31b157bd0c
RDX: 0000000000000028 RSI: 00007f31b2244670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fffeb653ef4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f31b2244670 R15: 0000000000000000
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings
INFO: task syz-executor:5414 blocked for more than 146 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:24736 pid:5414  tgid:5414  ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6826
 __mutex_lock_common kernel/locking/mutex.c:684 [inline]
 __mutex_lock+0x6a7/0xd70 kernel/locking/mutex.c:752
 rtnl_lock net/core/rtnetlink.c:79 [inline]
 rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline]
 netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1357
 netlink_sendmsg+0x8e4/0xcb0 net/netlink/af_netlink.c:1901
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0x221/0x270 net/socket.c:745
 __sys_sendto+0x3a8/0x500 net/socket.c:2204
 __do_sys_sendto net/socket.c:2216 [inline]
 __se_sys_sendto net/socket.c:2212 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2212
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4c6a77bd0c
RSP: 002b:00007fffc8ed6050 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f4c6b444620 RCX: 00007f4c6a77bd0c
RDX: 0000000000000028 RSI: 00007f4c6b444670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fffc8ed60a4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f4c6b444670 R15: 0000000000000000
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings
INFO: task dhcpcd:5416 blocked for more than 146 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:26736 pid:5416  tgid:5416  ppid:4898   flags:0x00000002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 __unregister_prot_hook+0x402/0x570 net/packet/af_packet.c:380
 packet_do_bind+0x517/0xcb0 net/packet/af_packet.c:3302
 __sys_bind_socket net/socket.c:1833 [inline]
 __sys_bind+0x233/0x2e0 net/socket.c:1857
 __do_sys_bind net/socket.c:1865 [inline]
 __se_sys_bind net/socket.c:1863 [inline]
 __x64_sys_bind+0x7a/0x90 net/socket.c:1863
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff9d9bca677
RSP: 002b:00007fff48aeee38 EFLAGS: 00000217 ORIG_RAX: 0000000000000031
RAX: ffffffffffffffda RBX: 0000562e071d4ca3 RCX: 00007ff9d9bca677
RDX: 0000000000000014 RSI: 00007fff48aeee48 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000562e457206b0 R09: 0000000000200000
R10: 000000000000006d R11: 0000000000000217 R12: 0000562e4571d160
R13: 0000562e457202f8 R14: 00007fff48b0f72c R15: 0000562e457202c4
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings
INFO: task dhcpcd:5417 blocked for more than 147 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:26784 pid:5417  tgid:5417  ppid:4898   flags:0x00000002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 __unregister_prot_hook+0x402/0x570 net/packet/af_packet.c:380
 packet_do_bind+0x517/0xcb0 net/packet/af_packet.c:3302
 __sys_bind_socket net/socket.c:1833 [inline]
 __sys_bind+0x233/0x2e0 net/socket.c:1857
 __do_sys_bind net/socket.c:1865 [inline]
 __se_sys_bind net/socket.c:1863 [inline]
 __x64_sys_bind+0x7a/0x90 net/socket.c:1863
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff9d9bca677
RSP: 002b:00007fff48aeee38 EFLAGS: 00000217 ORIG_RAX: 0000000000000031
RAX: ffffffffffffffda RBX: 0000562e071d4ca3 RCX: 00007ff9d9bca677
RDX: 0000000000000014 RSI: 00007fff48aeee48 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000562e457206b0 R09: 0000000000200000
R10: 000000000000006d R11: 0000000000000217 R12: 0000562e4571d160
R13: 0000562e45720e68 R14: 00007fff48b0f72c R15: 0000562e45720e34
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings
INFO: task dhcpcd:5418 blocked for more than 147 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:26736 pid:5418  tgid:5418  ppid:4898   flags:0x00000002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 __unregister_prot_hook+0x402/0x570 net/packet/af_packet.c:380
 packet_do_bind+0x517/0xcb0 net/packet/af_packet.c:3302
 __sys_bind_socket net/socket.c:1833 [inline]
 __sys_bind+0x233/0x2e0 net/socket.c:1857
 __do_sys_bind net/socket.c:1865 [inline]
 __se_sys_bind net/socket.c:1863 [inline]
 __x64_sys_bind+0x7a/0x90 net/socket.c:1863
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff9d9bca677
RSP: 002b:00007fff48aeee38 EFLAGS: 00000217 ORIG_RAX: 0000000000000031
RAX: ffffffffffffffda RBX: 0000562e071d4ca3 RCX: 00007ff9d9bca677
RDX: 0000000000000014 RSI: 00007fff48aeee48 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000562e457206b0 R09: 0000000000200000
R10: 000000000000006d R11: 0000000000000217 R12: 0000562e4571d160
R13: 0000562e45720fe8 R14: 00007fff48b0f72c R15: 0000562e45720fb4
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings
INFO: task dhcpcd:5419 blocked for more than 147 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:26736 pid:5419  tgid:5419  ppid:4898   flags:0x00000002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 __unregister_prot_hook+0x402/0x570 net/packet/af_packet.c:380
 packet_do_bind+0x517/0xcb0 net/packet/af_packet.c:3302
 __sys_bind_socket net/socket.c:1833 [inline]
 __sys_bind+0x233/0x2e0 net/socket.c:1857
 __do_sys_bind net/socket.c:1865 [inline]
 __se_sys_bind net/socket.c:1863 [inline]
 __x64_sys_bind+0x7a/0x90 net/socket.c:1863
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff9d9bca677
RSP: 002b:00007fff48aeee38 EFLAGS: 00000217 ORIG_RAX: 0000000000000031
RAX: ffffffffffffffda RBX: 0000562e071d4ca3 RCX: 00007ff9d9bca677
RDX: 0000000000000014 RSI: 00007fff48aeee48 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000562e457211b0 R09: 0000000000200000
R10: 000000000000006d R11: 0000000000000217 R12: 0000562e4571d160
R13: 0000562e45720718 R14: 00007fff48b0f72c R15: 0000562e457206e4
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings
INFO: task dhcpcd:5420 blocked for more than 147 seconds.
      Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:26736 pid:5420  tgid:5420  ppid:4898   flags:0x00000002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5311 [inline]
 __schedule+0x184a/0x4b30 kernel/sched/core.c:6677
 __schedule_loop kernel/sched/core.c:6754 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6769
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 synchronize_rcu_expedited+0x70a/0x830 kernel/rcu/tree_exp.h:969
 __unregister_prot_hook+0x402/0x570 net/packet/af_packet.c:380
 packet_do_bind+0x517/0xcb0 net/packet/af_packet.c:3302
 __sys_bind_socket net/socket.c:1833 [inline]
 __sys_bind+0x233/0x2e0 net/socket.c:1857
 __do_sys_bind net/socket.c:1865 [inline]
 __se_sys_bind net/socket.c:1863 [inline]
 __x64_sys_bind+0x7a/0x90 net/socket.c:1863
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ff9d9bca677
RSP: 002b:00007fff48aeee38 EFLAGS: 00000217 ORIG_RAX: 0000000000000031
RAX: ffffffffffffffda RBX: 0000562e071d4ca3 RCX: 00007ff9d9bca677
RDX: 0000000000000014 RSI: 00007fff48aeee48 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000562e457211b0 R09: 0000000000200000
R10: 000000000000006d R11: 0000000000000217 R12: 0000562e4571d160
R13: 0000562e45720898 R14: 00007fff48b0f72c R15: 0000562e45720864
 </TASK>
Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings

Showing all locks held in the system:
3 locks held by kworker/0:1/9:
 #0: ffff888015881948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888015881948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc900000e7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc900000e7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x99/0xfd0 net/wireless/reg.c:2480
1 lock held by khungtaskd/30:
 #0: ffffffff8e939760 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff8e939760 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8e939760 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6645
5 locks held by kworker/u9:0/54:
 #0: ffff888021925948 ((wq_completion)#3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888021925948 ((wq_completion)#3){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90000be7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90000be7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff888012588d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff888012588078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
3 locks held by kworker/0:2/940:
 #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888015880948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90003aafd00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90003aafd00 ((work_completion)(&fw_work->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: regdb_fw_cb+0x82/0x1c0 net/wireless/reg.c:1017
3 locks held by kworker/u8:5/1094:
 #0: ffff88802adeb948 ((wq_completion)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff88802adeb948 ((wq_completion)){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90003d77d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90003d77d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4736
2 locks held by kworker/u8:8/3002:
 #0: ffff8880b903ea58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xb0/0x140 kernel/sched/core.c:595
 #1: ffff8880b9028948 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x3a7/0x770 kernel/sched/psi.c:977
5 locks held by kworker/u9:1/4622:
 #0: ffff888011c97148 ((wq_completion)#27){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888011c97148 ((wq_completion)#27){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc9000daffd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc9000daffd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88807bb78d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff88807bb78078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
2 locks held by getty/4982:
 #0: ffff88802b9ac0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900031332f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6ac/0x1e00 drivers/tty/n_tty.c:2211
4 locks held by kworker/u9:2/5228:
 #0: ffff888047e54148 ((wq_completion)#42){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888047e54148 ((wq_completion)#42){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90003d27d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90003d27d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88807dcec078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaf0 net/bluetooth/hci_event.c:3687
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x4c3/0xaf0 net/bluetooth/hci_event.c:3721
5 locks held by kworker/u9:3/5234:
 #0: ffff8880557a7148 ((wq_completion)#21){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff8880557a7148 ((wq_completion)#21){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90003fc7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90003fc7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88805c3c8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff88805c3c8078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
5 locks held by kworker/u9:4/5236:
 #0: ffff88802269b148 ((wq_completion)#10){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff88802269b148 ((wq_completion)#10){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90003fd7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90003fd7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88802edb8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff88802edb8078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
5 locks held by kworker/u9:5/5238:
 #0: ffff888022699148 ((wq_completion)#5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888022699148 ((wq_completion)#5){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90003fe7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90003fe7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff888025348d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff888025348078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
4 locks held by kworker/u9:6/5240:
 #0: ffff888011839148 ((wq_completion)#40){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888011839148 ((wq_completion)#40){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90003ff7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90003ff7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88805d8e8078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaf0 net/bluetooth/hci_event.c:3687
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x4c3/0xaf0 net/bluetooth/hci_event.c:3721
5 locks held by kworker/u9:7/5243:
 #0: ffff888021927148 ((wq_completion)#6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888021927148 ((wq_completion)#6){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90004027d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90004027d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88802534cd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff88802534c078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
5 locks held by kworker/u9:8/5244:
 #0: ffff88802269c948 ((wq_completion)#9){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff88802269c948 ((wq_completion)#9){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90004037d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90004037d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88802edbcd80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff88802edbc078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
5 locks held by kworker/u9:9/5245:
 #0: ffff88802ed35948 ((wq_completion)#25){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff88802ed35948 ((wq_completion)#25){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90004047d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90004047d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff888023e24d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff888023e24078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
5 locks held by kworker/u9:10/5246:
 #0: ffff88805e1c6948 ((wq_completion)#19){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff88805e1c6948 ((wq_completion)#19){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc90004067d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc90004067d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88805c4d8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff88805c4d8078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
1 lock held by syz.0.9/5362:
 #0: ffffffff8e93ecf8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:328 [inline]
 #0: ffffffff8e93ecf8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x451/0x830 kernel/rcu/tree_exp.h:969
2 locks held by syz.1.11/5365:
1 lock held by syz.3.15/5385:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x706/0x1340 net/core/dev_ioctl.c:783
1 lock held by syz.3.15/5388:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3e/0x1b0 drivers/net/tun.c:3516
1 lock held by syz-executor/5400:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5403:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5407:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5411:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5414:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by dhcpcd/5416:
 #0: ffff88807d5ac258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1607 [inline]
 #0: ffff88807d5ac258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 net/packet/af_packet.c:3266
1 lock held by dhcpcd/5417:
 #0: ffff8880613a6258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1607 [inline]
 #0: ffff8880613a6258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 net/packet/af_packet.c:3266
1 lock held by dhcpcd/5418:
 #0: ffff88805cd56258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1607 [inline]
 #0: ffff88805cd56258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 net/packet/af_packet.c:3266
1 lock held by dhcpcd/5419:
 #0: ffff88805cd52258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1607 [inline]
 #0: ffff88805cd52258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 net/packet/af_packet.c:3266
1 lock held by dhcpcd/5420:
 #0: ffff88805d70a258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1607 [inline]
 #0: ffff88805d70a258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 net/packet/af_packet.c:3266
1 lock held by dhcpcd/5421:
 #0: ffff888060332258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1607 [inline]
 #0: ffff888060332258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcb0 net/packet/af_packet.c:3266
1 lock held by syz-executor/5423:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5427:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5431:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5434:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5438:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5441:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5445:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
1 lock held by syz-executor/5449:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
4 locks held by kworker/u9:11/5452:
 #0: ffff888038a03148 ((wq_completion)#46){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888038a03148 ((wq_completion)#46){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc900047cfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc900047cfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88802fdf4078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaf0 net/bluetooth/hci_event.c:3687
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x4c3/0xaf0 net/bluetooth/hci_event.c:3721
1 lock held by syz-executor/5453:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644
4 locks held by kworker/u9:12/5454:
 #0: ffff888038ef4148 ((wq_completion)#44){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888038ef4148 ((wq_completion)#44){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc900047ffd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc900047ffd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff88805c954078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaf0 net/bluetooth/hci_event.c:3687
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x4c3/0xaf0 net/bluetooth/hci_event.c:3721
5 locks held by kworker/u9:13/5456:
 #0: ffff888061ec3948 ((wq_completion)#23){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888061ec3948 ((wq_completion)#23){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc9000480fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc9000480fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff888023e20d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1ec/0x400 net/bluetooth/hci_sync.c:327
 #3: ffff888023e20078 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1ea/0xde0 net/bluetooth/hci_sync.c:5526
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #4: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x185/0x340 net/bluetooth/hci_conn.c:1265
4 locks held by kworker/u9:14/5458:
 #0: ffff888035cba948 ((wq_completion)#48){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3207 [inline]
 #0: ffff888035cba948 ((wq_completion)#48){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3313
 #1: ffffc900047efd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3208 [inline]
 #1: ffffc900047efd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3313
 #2: ffff888034e18078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x97/0xaf0 net/bluetooth/hci_event.c:3687
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1962 [inline]
 #3: ffffffff8fdfc5a8 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x4c3/0xaf0 net/bluetooth/hci_event.c:3721
1 lock held by syz-executor/5460:
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fc90508 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6644

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline]
 watchdog+0xff4/0x1040 kernel/hung_task.c:379
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 5464 Comm: kworker/1:5 Not tainted 6.11.0-rc4-next-20240820-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: events nsim_dev_trap_report_work
RIP: 0010:mark_lock+0x12c/0x350 kernel/locking/lockdep.c:4658
Code: c7 c7 e0 cc 0a 8c 48 c7 c6 80 cf 0a 8c e8 cc 1d e5 ff 90 0f 0b 90 90 90 31 db 48 83 c3 60 48 89 d8 48 c1 e8 03 42 80 3c 28 00 <74> 08 48 89 df e8 1a b9 8b 00 41 bc 01 00 00 00 44 85 33 74 16 44
RSP: 0018:ffffc9000485f918 EFLAGS: 00000046
RAX: 1ffffffff26918ae RBX: ffffffff9348c570 RCX: ffffffff81708bea
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff9375e8e8
RBP: 0000000000000002 R08: ffffffff9375e8ef R09: 1ffffffff26ebd1d
R10: dffffc0000000000 R11: fffffbfff26ebd1e R12: ffff88801abae578
R13: dffffc0000000000 R14: 0000000000000004 R15: ffff88801abae558
FS:  0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562288c87040 CR3: 000000000e736000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 mark_held_locks kernel/locking/lockdep.c:4276 [inline]
 __trace_hardirqs_on_caller kernel/locking/lockdep.c:4294 [inline]
 lockdep_hardirqs_on_prepare+0x282/0x780 kernel/locking/lockdep.c:4361
 trace_hardirqs_on+0x28/0x40 kernel/trace/trace_preemptirq.c:61
 __local_bh_enable_ip+0x168/0x200 kernel/softirq.c:387
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 nsim_dev_trap_report drivers/net/netdevsim/dev.c:820 [inline]
 nsim_dev_trap_report_work+0x75d/0xaa0 drivers/net/netdevsim/dev.c:850
 process_one_work kernel/workqueue.c:3232 [inline]
 process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3313
 worker_thread+0x86d/0xd10 kernel/workqueue.c:3390
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>