INFO: task udevd:10578 blocked for more than 143 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:21664 pid:10578 tgid:10578 ppid:4677 flags:0x00000002 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 lookup_fast+0x1f6/0x4a0 walk_component fs/namei.c:2049 [inline] link_path_walk+0x672/0xea0 fs/namei.c:2418 path_openat+0x266/0x3590 fs/namei.c:3929 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8c76f169a4 RSP: 002b:00007ffee72c74d0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007f8c76f169a4 RDX: 0000000000080000 RSI: 00007ffee72c7608 RDI: 00000000ffffff9c RBP: 00007ffee72c7608 R08: 0000000000000008 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000 R13: 000055b3299fdb42 R14: 0000000000000001 R15: 000055b329a19160 INFO: task syz-executor:11623 blocked for more than 144 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20600 pid:11623 tgid:11623 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 kernfs_find_and_get include/linux/kernfs.h:604 [inline] sysfs_unmerge_group+0x62/0x130 fs/sysfs/group.c:396 dpm_sysfs_remove+0x5d/0xc0 drivers/base/power/sysfs.c:833 device_del+0x291/0x9b0 drivers/base/core.c:3839 rfkill_unregister+0xc2/0x230 net/rfkill/core.c:1143 hci_unregister_dev+0x366/0x510 net/bluetooth/hci_core.c:2715 vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664 __fput+0x241/0x880 fs/file_table.c:431 task_work_run+0x251/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 get_signal+0x16a3/0x1740 kernel/signal.c:2917 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fdb1017ca3c RSP: 002b:00007ffec14b9dc0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007fdb1017ca3c RDX: 0000000000000028 RSI: 00007ffec14b9e70 RDI: 00000000000000f9 RBP: 00007ffec14b9e1c R08: 0000000000000000 R09: 0079746972756365 R10: 00007fdb103087e0 R11: 0000000000000246 R12: 0000000000000032 R13: 0000000000111922 R14: 000000000011190d R15: 00007ffec14b9e70 INFO: task syz-executor:13494 blocked for more than 145 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21072 pid:13494 tgid:13494 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 kernfs_find_and_get include/linux/kernfs.h:604 [inline] sysfs_unmerge_group+0x62/0x130 fs/sysfs/group.c:396 dpm_sysfs_remove+0x5d/0xc0 drivers/base/power/sysfs.c:833 device_del+0x291/0x9b0 drivers/base/core.c:3839 rfkill_unregister+0xc2/0x230 net/rfkill/core.c:1143 hci_unregister_dev+0x366/0x510 net/bluetooth/hci_core.c:2715 vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664 __fput+0x241/0x880 fs/file_table.c:431 task_work_run+0x251/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 get_signal+0x16a3/0x1740 kernel/signal.c:2917 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f748477ca3c RSP: 002b:00007fff4b18b610 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007f748477ca3c RDX: 0000000000000028 RSI: 00007fff4b18b6c0 RDI: 00000000000000f9 RBP: 00007fff4b18b66c R08: 0000000000000000 R09: 0079746972756365 R10: 00007f74849087e0 R11: 0000000000000246 R12: 000000000000004f R13: 000000000010fc3f R14: 000000000010fc3f R15: 00007fff4b18b6c0 INFO: task syz-executor:13648 blocked for more than 146 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21520 pid:13648 tgid:13648 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 kernfs_find_and_get include/linux/kernfs.h:604 [inline] sysfs_unmerge_group+0x62/0x130 fs/sysfs/group.c:396 dpm_sysfs_remove+0x5d/0xc0 drivers/base/power/sysfs.c:833 device_del+0x291/0x9b0 drivers/base/core.c:3839 device_unregister+0x20/0xc0 drivers/base/core.c:3905 hci_conn_cleanup net/bluetooth/hci_conn.c:174 [inline] hci_conn_del+0x8c4/0xc40 net/bluetooth/hci_conn.c:1160 hci_conn_hash_flush+0x18e/0x240 net/bluetooth/hci_conn.c:2590 hci_dev_close_sync+0x9ef/0x11a0 net/bluetooth/hci_sync.c:5195 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_unregister_dev+0x20b/0x510 net/bluetooth/hci_core.c:2698 vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664 __fput+0x241/0x880 fs/file_table.c:431 task_work_run+0x251/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 get_signal+0x16a3/0x1740 kernel/signal.c:2917 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc6ced7ca3c RSP: 002b:00007ffc72e5cb50 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007fc6ced7ca3c RDX: 0000000000000028 RSI: 00007ffc72e5cc00 RDI: 00000000000000f9 RBP: 00007ffc72e5cbac R08: 0000000000000000 R09: 0079746972756365 R10: 00007fc6cef087e0 R11: 0000000000000246 R12: 0000000000000032 R13: 00000000001129de R14: 000000000011290a R15: 00007ffc72e5cc00 INFO: task syz-executor:13777 blocked for more than 146 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20992 pid:13777 tgid:13777 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 kernfs_find_and_get include/linux/kernfs.h:604 [inline] sysfs_unmerge_group+0x62/0x130 fs/sysfs/group.c:396 dpm_sysfs_remove+0x5d/0xc0 drivers/base/power/sysfs.c:833 device_del+0x291/0x9b0 drivers/base/core.c:3839 device_unregister+0x20/0xc0 drivers/base/core.c:3905 hci_conn_cleanup net/bluetooth/hci_conn.c:174 [inline] hci_conn_del+0x8c4/0xc40 net/bluetooth/hci_conn.c:1160 hci_conn_hash_flush+0x18e/0x240 net/bluetooth/hci_conn.c:2590 hci_dev_close_sync+0x9ef/0x11a0 net/bluetooth/hci_sync.c:5195 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_unregister_dev+0x20b/0x510 net/bluetooth/hci_core.c:2698 vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664 __fput+0x241/0x880 fs/file_table.c:431 task_work_run+0x251/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 get_signal+0x16a3/0x1740 kernel/signal.c:2917 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fbd0237ca3c RSP: 002b:00007ffe487838e0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 00007fbd0237ca3c RDX: 0000000000000028 RSI: 00007ffe48783990 RDI: 00000000000000f9 RBP: 00007ffe4878393c R08: 0000000000000000 R09: 0079746972756365 R10: 00007fbd025087e0 R11: 0000000000000246 R12: 0000000000000024 R13: 0000000000111948 R14: 000000000010f7dd R15: 00007ffe48783990 INFO: task syz.5.1448:13907 blocked for more than 147 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.1448 state:D stack:25648 pid:13907 tgid:13907 ppid:11418 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 kernfs_find_and_get include/linux/kernfs.h:604 [inline] sysfs_unmerge_group+0x62/0x130 fs/sysfs/group.c:396 dpm_sysfs_remove+0x5d/0xc0 drivers/base/power/sysfs.c:833 device_del+0x291/0x9b0 drivers/base/core.c:3839 rfkill_unregister+0xc2/0x230 net/rfkill/core.c:1143 hci_unregister_dev+0x366/0x510 net/bluetooth/hci_core.c:2715 vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664 __fput+0x241/0x880 fs/file_table.c:431 task_work_run+0x251/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 get_signal+0x16a3/0x1740 kernel/signal.c:2917 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] irqentry_exit_to_user_mode+0x79/0x280 kernel/entry/common.c:231 exc_page_fault+0x590/0x8c0 arch/x86/mm/fault.c:1542 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x7f00d9044984 RSP: 002b:00007f00d9f59ff0 EFLAGS: 00010217 RAX: 0000000000000000 RBX: 00007f00d9335f80 RCX: 00007f00d917dff9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007f00d91f0296 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f00d9335f80 R15: 00007fffaf73b168 INFO: task syz-executor:13913 blocked for more than 148 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20432 pid:13913 tgid:13913 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 kernfs_find_and_get include/linux/kernfs.h:604 [inline] sysfs_unmerge_group+0x62/0x130 fs/sysfs/group.c:396 dpm_sysfs_remove+0x5d/0xc0 drivers/base/power/sysfs.c:833 device_del+0x291/0x9b0 drivers/base/core.c:3839 device_unregister+0x20/0xc0 drivers/base/core.c:3905 hci_conn_cleanup net/bluetooth/hci_conn.c:174 [inline] hci_conn_del+0x8c4/0xc40 net/bluetooth/hci_conn.c:1160 hci_conn_hash_flush+0x18e/0x240 net/bluetooth/hci_conn.c:2590 hci_dev_close_sync+0x9ef/0x11a0 net/bluetooth/hci_sync.c:5195 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_unregister_dev+0x20b/0x510 net/bluetooth/hci_core.c:2698 vhci_release+0x80/0xd0 drivers/bluetooth/hci_vhci.c:664 __fput+0x241/0x880 fs/file_table.c:431 task_work_run+0x251/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 get_signal+0x16a3/0x1740 kernel/signal.c:2917 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa5b05b00e5 RSP: 002b:00007ffc8eeb9f30 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 RAX: 0000000000000000 RBX: 000000000000001a RCX: 00007fa5b05b00e5 RDX: 00007ffc8eeb9f70 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007ffc8eeb9fcc R08: 0000000000000000 R09: 7fffffffffffffff R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000002d R13: 000000000010f67a R14: 000000000010f67a R15: 00007ffc8eeba020 INFO: task syz.2.1562:14354 blocked for more than 149 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.1562 state:D stack:23808 pid:14354 tgid:14354 ppid:13913 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_write_slowpath+0xeee/0x13b0 kernel/locking/rwsem.c:1176 __down_write_common kernel/locking/rwsem.c:1304 [inline] __down_write kernel/locking/rwsem.c:1313 [inline] down_write+0x1d7/0x220 kernel/locking/rwsem.c:1578 kernfs_remove_by_name_ns+0x7a/0x160 fs/kernfs/dir.c:1689 module_remove_driver+0x5e/0x1d0 drivers/base/module.c:108 bus_remove_driver+0x1fb/0x320 drivers/base/bus.c:745 usb_gadget_unregister_driver+0x4e/0x70 drivers/usb/gadget/udc/core.c:1731 raw_release+0xf6/0x1e0 drivers/usb/gadget/legacy/raw_gadget.c:462 __fput+0x241/0x880 fs/file_table.c:431 task_work_run+0x251/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:939 do_group_exit+0x207/0x2c0 kernel/exit.c:1088 get_signal+0x16a3/0x1740 kernel/signal.c:2917 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa5b057dff9 RSP: 002b:00007ffc8eeb9d68 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffff92 RBX: 00007ffc8eeb9e90 RCX: 00007fa5b057dff9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa5b0735f8c RBP: 00007fa5b0735f8c R08: 7fffffffffffffff R09: 00007ffc8eeba05f R10: 00007ffc8eeb9e70 R11: 0000000000000246 R12: 000000000011026f R13: 00007ffc8eeb9e70 R14: 0000000000000bea R15: 000000000010f685 INFO: task syz-executor:14371 blocked for more than 149 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22688 pid:14371 tgid:14371 ppid:5214 flags:0x00000000 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 lookup_fast+0x1f6/0x4a0 walk_component fs/namei.c:2049 [inline] link_path_walk+0x672/0xea0 fs/namei.c:2418 path_openat+0x266/0x3590 fs/namei.c:3929 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcfe417c911 RSP: 002b:00007ffeb27718e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fcfe417c911 RDX: 0000000000000002 RSI: 00007fcfe41f033b RDI: 00000000ffffff9c RBP: 00007fcfe41f033b R08: 00000000000000d8 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 INFO: task syz-executor:14373 blocked for more than 150 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23392 pid:14373 tgid:14373 ppid:5214 flags:0x00000000 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 lookup_fast+0x1f6/0x4a0 walk_component fs/namei.c:2049 [inline] link_path_walk+0x672/0xea0 fs/namei.c:2418 path_openat+0x266/0x3590 fs/namei.c:3929 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5d6957c911 RSP: 002b:00007ffe6d537a70 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f5d6957c911 RDX: 0000000000000002 RSI: 00007f5d695f033b RDI: 00000000ffffff9c RBP: 00007f5d695f033b R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings INFO: task syz-executor:14374 blocked for more than 151 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23120 pid:14374 tgid:14374 ppid:5214 flags:0x00000000 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 lookup_fast+0x1f6/0x4a0 walk_component fs/namei.c:2049 [inline] link_path_walk+0x672/0xea0 fs/namei.c:2418 path_openat+0x266/0x3590 fs/namei.c:3929 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fece877c911 RSP: 002b:00007fff04fbc4c0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fece877c911 RDX: 0000000000000002 RSI: 00007fece87f033b RDI: 00000000ffffff9c RBP: 00007fece87f033b R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings INFO: task syz-executor:14376 blocked for more than 151 seconds. Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:24128 pid:14376 tgid:14376 ppid:5214 flags:0x00000000 Call Trace: context_switch kernel/sched/core.c:5322 [inline] __schedule+0x1895/0x4b30 kernel/sched/core.c:6682 __schedule_loop kernel/sched/core.c:6759 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6831 rwsem_down_read_slowpath kernel/locking/rwsem.c:1084 [inline] __down_read_common kernel/locking/rwsem.c:1248 [inline] __down_read kernel/locking/rwsem.c:1261 [inline] down_read+0x705/0xa40 kernel/locking/rwsem.c:1526 kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 lookup_fast+0x1f6/0x4a0 walk_component fs/namei.c:2049 [inline] link_path_walk+0x672/0xea0 fs/namei.c:2418 path_openat+0x266/0x3590 fs/namei.c:3929 do_filp_open+0x235/0x490 fs/namei.c:3960 do_sys_openat2+0x13e/0x1d0 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x247/0x2a0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7dd457c911 RSP: 002b:00007fff8ce94030 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f7dd457c911 RDX: 0000000000000002 RSI: 00007f7dd45f033b RDI: 00000000ffffff9c RBP: 00007f7dd45f033b R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings Showing all locks held in the system: 1 lock held by khungtaskd/30: #0: ffffffff8e937de0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e937de0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8e937de0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6720 2 locks held by getty/4985: #0: ffff8880321fa0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900031332f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a6/0x1e00 drivers/tty/n_tty.c:2211 3 locks held by kworker/1:4/5295: 10 locks held by kworker/1:8/5340: 4 locks held by kworker/u8:9/5561: #0: ffff88801bae5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3204 [inline] #0: ffff88801bae5948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x93b/0x1850 kernel/workqueue.c:3310 #1: ffffc900020dfd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3205 [inline] #1: ffffc900020dfd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x976/0x1850 kernel/workqueue.c:3310 #2: ffffffff8fcc52d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x16a/0xcc0 net/core/net_namespace.c:580 #3: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_remove_by_name_ns+0x7a/0x160 fs/kernfs/dir.c:1689 1 lock held by udevd/10578: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 3 locks held by kworker/u8:14/11101: 1 lock held by syz-executor/11623: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 1 lock held by syz-executor/13494: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 3 locks held by syz-executor/13648: #0: ffff888068f14d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff888068f14d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2698 #1: ffff888068f14078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 net/bluetooth/hci_sync.c:5183 #2: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 3 locks held by syz-executor/13777: #0: ffff8880543f0d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff8880543f0d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2698 #1: ffff8880543f0078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 net/bluetooth/hci_sync.c:5183 #2: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 1 lock held by syz.5.1448/13907: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 3 locks held by syz-executor/13913: #0: ffff88805bae8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff88805bae8d80 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2698 #1: ffff88805bae8078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x572/0x11a0 net/bluetooth/hci_sync.c:5183 #2: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_find_and_get_ns+0x71/0x110 fs/kernfs/dir.c:918 1 lock held by syz.2.1562/14354: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_remove_by_name_ns+0x7a/0x160 fs/kernfs/dir.c:1689 1 lock held by syz-executor/14370: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 1 lock held by syz-executor/14371: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 1 lock held by syz-executor/14372: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 1 lock held by syz-executor/14373: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 1 lock held by syz-executor/14374: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 1 lock held by syz-executor/14376: #0: ffff88801bae6948 (&root->kernfs_rwsem){++++}-{3:3}, at: kernfs_dop_revalidate+0xd4/0x560 fs/kernfs/dir.c:1159 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 nmi_cpu_backtrace+0x49c/0x4d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xff4/0x1040 kernel/hung_task.c:379 kthread+0x2f2/0x390 kernel/kthread.c:389 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5295 Comm: kworker/1:4 Not tainted 6.12.0-rc2-syzkaller-00074-gd3d1556696c1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: events_power_efficient neigh_periodic_work RIP: 0010:lookup_object lib/debugobjects.c:195 [inline] RIP: 0010:lookup_object_or_alloc lib/debugobjects.c:564 [inline] RIP: 0010:debug_object_activate+0x1b0/0x510 lib/debugobjects.c:710 Code: 3c fd 4c 89 7c 24 30 4d 8b 3f 45 31 e4 eb 06 4d 8b 3f 41 ff c4 4d 85 ff 74 40 49 8d 5f 18 48 89 d8 48 c1 e8 03 42 80 3c 30 00 <74> 08 48 89 df e8 a6 36 3c fd 48 8b 44 24 10 48 39 03 0f 84 1a 01 RSP: 0018:ffffc90000a17ee0 EFLAGS: 00000046 RAX: 1ffff11004679e65 RBX: ffff8880233cf328 RCX: 0000000000000001 RDX: dffffc0000000000 RSI: 0000000000000004 RDI: ffffc90000a17dc0 RBP: ffffc90000a17ff0 R08: 0000000000000003 R09: fffff52000142fb8 R10: dffffc0000000000 R11: fffff52000142fb8 R12: 0000000000000000 R13: 1ffff92000142fe4 R14: dffffc0000000000 R15: ffff8880233cf310 FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fbd0323af98 CR3: 000000000e734000 CR4: 0000000000350ef0 Call Trace: debug_rcu_head_queue kernel/rcu/rcu.h:224 [inline] __call_rcu_common kernel/rcu/tree.c:3071 [inline] call_rcu+0x97/0xa70 kernel/rcu/tree.c:3190 refdst_drop include/net/dst.h:263 [inline] skb_dst_drop include/net/dst.h:275 [inline] skb_release_head_state+0x73/0x250 net/core/skbuff.c:1174 skb_release_all net/core/skbuff.c:1188 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] consume_skb+0x60/0xf0 net/core/skbuff.c:1436 nft_synproxy_eval_v4+0x3d2/0x610 net/netfilter/nft_synproxy.c:60 nft_synproxy_do_eval+0x362/0xa60 net/netfilter/nft_synproxy.c:141 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4af/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x418/0x6b0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312