INFO: task syz.2.198:6770 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.198 state:D stack:26632 pid:6770 tgid:6765 ppid:5804 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xfe4/0x5e10 kernel/sched/core.c:6867
__schedule_loop kernel/sched/core.c:6949 [inline]
schedule+0xdd/0x390 kernel/sched/core.c:6964
schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75
___down_common kernel/locking/semaphore.c:268 [inline]
__down_common+0x396/0x6c0 kernel/locking/semaphore.c:293
down+0x74/0xa0 kernel/locking/semaphore.c:100
console_lock+0x5b/0xa0 kernel/printk/printk.c:2843
do_fb_ioctl+0x1d9/0x7e0 drivers/video/fbdev/core/fb_chrdev.c:86
fb_ioctl+0xe5/0x150 drivers/video/fbdev/core/fb_chrdev.c:169
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f327399aeb9
RSP: 002b:00007f3274877028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f3273c16090 RCX: 00007f327399aeb9
RDX: 0000200000000040 RSI: 0000000000004601 RDI: 0000000000000005
RBP: 00007f3273a08c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3273c16128 R14: 00007f3273c16090 R15: 00007ffd2d937c68
Showing all locks held in the system:
1 lock held by kthreadd/2:
4 locks held by kworker/0:1/10:
#0: ffff8880594fbd48 ((wq_completion)wg-kex-wg2#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900000f7c98 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88805962d308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
#3: ffff888057a36648 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x666/0x860 drivers/net/wireguard/noise.c:643
4 locks held by kworker/u8:0/12:
2 locks held by kworker/u8:1/13:
3 locks held by kworker/1:0/24:
1 lock held by khungtaskd/31:
#0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e5e32e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
4 locks held by kworker/u8:2/36:
2 locks held by kworker/u8:3/37:
3 locks held by kworker/u8:4/65:
4 locks held by kworker/0:2/793:
#0: ffff88807b7fdd48 ((wq_completion)wg-kex-wg0#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90003397c98 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888077249308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
#3: ffff888057a33ea8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632
2 locks held by kworker/1:2/977:
4 locks held by kworker/u8:5/1320:
#0: ffff88803215c948 ((wq_completion)wg-kex-wg2#7){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900044dfc98 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888079595308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
#3: ffff888075fe34c0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
4 locks held by kworker/u8:6/1334:
#0: ffff88807a612948 ((wq_completion)wg-kex-wg2#9){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc900045afc98 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88805979d308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
#3: ffff888075fe6648 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
6 locks held by kworker/R-bat_e/3404:
3 locks held by kworker/u8:7/3539:
1 lock held by klogd/5168:
2 locks held by udevd/5179:
2 locks held by getty/5564:
#0: ffff888030ee30a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211
2 locks held by syz-executor/5792:
1 lock held by syz-executor/5805:
2 locks held by kworker/1:3/5806:
1 lock held by syz-executor/5808:
1 lock held by syz-executor/5816:
5 locks held by kworker/u9:4/5817:
#0: ffff888078e6f948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000449fc98 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88807e3e4ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 net/bluetooth/hci_sync.c:331
#3: ffff88807e3e40c0 (&hdev->lock){+.+.}-{4:4}
, at: hci_abort_conn_sync+0x141/0xb20 net/bluetooth/hci_sync.c:5703
#4: ffffffff9068c228 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline]
#4: ffffffff9068c228 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x119/0x360 net/bluetooth/hci_conn.c:1336
5 locks held by kworker/u9:10/5826:
#0: ffff888078e6d948 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc9000452fc98 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff88807e3e0ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 net/bluetooth/hci_sync.c:331
#3: ffff88807e3e00c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x141/0xb20 net/bluetooth/hci_sync.c:5703
#4: ffffffff8e5efab8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311
3 locks held by kworker/1:5/5866:
3 locks held by kworker/1:6/5873:
4 locks held by kworker/0:3/5880:
4 locks held by kworker/0:4/5898:
#0: ffff8880594ec148 ((wq_completion)wg-kex-wg2#8){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90004f2fc98 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888079595308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
#3: ffff888075fe34c0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632
4 locks held by kworker/0:5/5922:
#0: ffff8880594fa148 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90004f0fc98 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888059629308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598
#3: ffff888057a35c60 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632
3 locks held by kworker/1:7/5958:
4 locks held by kworker/1:8/5959:
4 locks held by kworker/1:9/5964:
3 locks held by kworker/0:6/6773:
#0: ffff88805977d148 ((wq_completion)wg-kex-wg2#10){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
#1: ffffc90005297c98 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
#2: ffff888075fe6648 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_begin_session+0x30/0xe40 drivers/net/wireguard/noise.c:822
4 locks held by kworker/u8:8/6774:
4 locks held by kworker/u8:9/6776:
3 locks held by kworker/0:7/6777:
2 locks held by syz-executor/6779:
2 locks held by dhcpcd/6780:
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x141/0x190 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 36 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
RIP: 0010:trace_lock_acquire include/trace/events/lock.h:24 [inline]
RIP: 0010:lock_acquire+0x4a/0x330 kernel/locking/lockdep.c:5831
Code: 65 4c 8b 3d 60 32 01 12 4c 89 7c 24 30 4d 89 cf 66 90 65 8b 05 7b 32 01 12 83 f8 07 0f 87 a4 02 00 00 48 0f a3 05 06 2c d4 0e <0f> 82 6f 02 00 00 8b 35 fe 5e d4 0e 85 f6 0f 85 8a 00 00 00 48 8b
RSP: 0018:ffffc90000a07808 EFLAGS: 00000297
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8e5e32e0
RBP: ffffffff8e5e32e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000200 R11: 0000000000058ae8 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881246db000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f50d0036ff8 CR3: 0000000020697000 CR4: 00000000003526f0
Call Trace:
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:867 [inline]
class_rcu_constructor include/linux/rcupdate.h:1195 [inline]
unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kmem_cache_free+0x143/0x720 mm/slub.c:6785
__skb_ext_put+0x102/0x2d0 net/core/skbuff.c:7204
__skb_ext_del+0xf8/0x360 net/core/skbuff.c:7171
skb_ext_del include/linux/skbuff.h:5057 [inline]
nf_bridge_info_free net/bridge/br_netfilter_hooks.c:156 [inline]
br_nf_dev_queue_xmit+0x7ab/0x2a20 net/bridge/br_netfilter_hooks.c:919
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
br_nf_post_routing+0xcbb/0x16a0 net/bridge/br_netfilter_hooks.c:966
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK include/linux/netfilter.h:316 [inline]
br_forward_finish+0x261/0x4d0 net/bridge/br_forward.c:66
br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167
br_nf_forward_finish+0x693/0xb30 net/bridge/br_netfilter_hooks.c:662
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
br_nf_forward_ip.part.0+0x61e/0x820 net/bridge/br_netfilter_hooks.c:716
br_nf_forward_ip net/bridge/br_netfilter_hooks.c:676 [inline]
br_nf_forward+0xfe5/0x19f0 net/bridge/br_netfilter_hooks.c:773
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK include/linux/netfilter.h:316 [inline]
__br_forward+0x2f6/0x970 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
br_flood+0x37f/0x650 net/bridge/br_forward.c:250
br_handle_frame_finish+0xf57/0x1f00 net/bridge/br_input.c:229
br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167
br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154
NF_HOOK include/linux/netfilter.h:318 [inline]
br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184
br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
br_handle_frame+0xcdd/0x1520 net/bridge/br_input.c:442
__netif_receive_skb_core.constprop.0+0x6d7/0x3460 net/core/dev.c:6039
__netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6150
__netif_receive_skb+0x1f/0x120 net/core/dev.c:6265
process_backlog+0x37a/0x1580 net/core/dev.c:6617
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7681
napi_poll net/core/dev.c:7744 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:7896
handle_softirqs+0x1ea/0x910 kernel/softirq.c:622
do_softirq kernel/softirq.c:523 [inline]
do_softirq+0xac/0xe0 kernel/softirq.c:510
__local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
wg_packet_send_handshake_initiation+0x22f/0x360 drivers/net/wireguard/send.c:42
wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51
process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
process_scheduled_works kernel/workqueue.c:3340 [inline]
worker_thread+0x5da/0xe40 kernel/workqueue.c:3421
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246