INFO: task kworker/0:0:8 blocked for more than 143 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:20320 pid:8 tgid:8 ppid:2 flags:0x00004000 Workqueue: events nfc_urelease_event_work Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 nfc_urelease_event_work+0x173/0x310 net/nfc/netlink.c:1847 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:0:25 blocked for more than 143 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:0 state:D stack:21184 pid:25 tgid:25 ppid:2 flags:0x00004000 Workqueue: events nfc_urelease_event_work Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 nfc_urelease_event_work+0xbb/0x310 net/nfc/netlink.c:1841 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:2:783 blocked for more than 143 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:2 state:D stack:23008 pid:783 tgid:783 ppid:2 flags:0x00004000 Workqueue: events rfkill_op_handler Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 device_lock include/linux/device.h:1009 [inline] nfc_dev_down+0x2d/0x2e0 net/nfc/core.c:143 nfc_rfkill_set_block+0x39/0xe0 net/nfc/core.c:179 rfkill_set_block+0x203/0x560 net/rfkill/core.c:346 rfkill_epo+0x8e/0x1d0 net/rfkill/core.c:466 __rfkill_handle_global_op net/rfkill/input.c:60 [inline] rfkill_op_handler+0x262/0x280 net/rfkill/input.c:108 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/0:2:784 blocked for more than 144 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:2 state:D stack:22816 pid:784 tgid:784 ppid:2 flags:0x00004000 Workqueue: events nfc_urelease_event_work Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 nfc_urelease_event_work+0xbb/0x310 net/nfc/netlink.c:1841 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:3:5145 blocked for more than 144 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:3 state:D stack:23104 pid:5145 tgid:5145 ppid:2 flags:0x00004000 Workqueue: events nfc_urelease_event_work Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 nfc_urelease_event_work+0xbb/0x310 net/nfc/netlink.c:1841 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/1:7:5153 blocked for more than 144 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:7 state:D stack:22128 pid:5153 tgid:5153 ppid:2 flags:0x00004000 Workqueue: events rfkill_global_led_trigger_worker Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 rfkill_global_led_trigger_worker+0x1b/0x160 net/rfkill/core.c:182 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task syz.1.1281:9291 blocked for more than 144 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.1281 state:D stack:27104 pid:9291 tgid:9289 ppid:6499 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 rfkill_unregister+0xde/0x2c0 net/rfkill/core.c:1149 nfc_unregister_device+0x94/0x330 net/nfc/core.c:1167 virtual_ncidev_close+0x51/0xb0 drivers/nfc/virtual_ncidev.c:172 __fput+0x408/0xbb0 fs/file_table.c:422 task_work_run+0x14e/0x250 kernel/task_work.c:222 get_signal+0x1ca/0x2770 kernel/signal.c:2689 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f122d975b59 RSP: 002b:00007f122e710048 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffff2 RBX: 00007f122db03f60 RCX: 00007f122d975b59 RDX: 0000000000000064 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007f122d9e4e5d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f122db03f60 R15: 00007ffeec9ab488 INFO: task syz.4.1291:9339 blocked for more than 144 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.1291 state:D stack:26784 pid:9339 tgid:9329 ppid:5092 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 device_lock include/linux/device.h:1009 [inline] nfc_start_poll+0x58/0x330 net/nfc/core.c:208 nfc_genl_start_poll+0x1ac/0x470 net/nfc/netlink.c:828 genl_family_rcv_msg_doit+0x202/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x565/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x544/0x830 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0xab5/0xc90 net/socket.c:2597 ___sys_sendmsg+0x135/0x1e0 net/socket.c:2651 __sys_sendmsg+0x117/0x1f0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb938d75b59 RSP: 002b:00007fb93877b048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fb938f042c0 RCX: 00007fb938d75b59 RDX: 0000000000000000 RSI: 0000000020000440 RDI: 0000000000000005 RBP: 00007fb938de4e5d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007fb938f042c0 R15: 00007ffdc5740028 INFO: task syz.4.1291:9354 blocked for more than 145 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.1291 state:D stack:27920 pid:9354 tgid:9329 ppid:5092 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 rfkill_unregister+0xde/0x2c0 net/rfkill/core.c:1149 nfc_unregister_device+0x94/0x330 net/nfc/core.c:1167 virtual_ncidev_close+0x51/0xb0 drivers/nfc/virtual_ncidev.c:172 __fput+0x408/0xbb0 fs/file_table.c:422 task_work_run+0x14e/0x250 kernel/task_work.c:222 get_signal+0x1ca/0x2770 kernel/signal.c:2689 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb938d75b59 RSP: 002b:00007fb938718048 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: fffffffffffffff2 RBX: 00007fb938f04548 RCX: 00007fb938d75b59 RDX: 0000000000000064 RSI: 0000000020000840 RDI: 0000000000000003 RBP: 00007fb938de4e5d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007fb938f04548 R15: 00007ffdc5740028 INFO: task syz.4.1291:9357 blocked for more than 145 seconds. Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.1291 state:D stack:28368 pid:9357 tgid:9329 ppid:5092 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 genl_lock net/netlink/genetlink.c:35 [inline] genl_op_lock net/netlink/genetlink.c:60 [inline] genl_op_lock net/netlink/genetlink.c:57 [inline] genl_rcv_msg+0x580/0x800 net/netlink/genetlink.c:1209 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x544/0x830 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0xab5/0xc90 net/socket.c:2597 ___sys_sendmsg+0x135/0x1e0 net/socket.c:2651 __sys_sendmsg+0x117/0x1f0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb938d75b59 RSP: 002b:00007fb9386f7048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fb938f04620 RCX: 00007fb938d75b59 RDX: 0000000000000000 RSI: 0000000020000780 RDI: 0000000000000005 RBP: 00007fb938de4e5d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000006e R14: 00007fb938f04620 R15: 00007ffdc5740028 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings Showing all locks held in the system: 4 locks held by kworker/0:0/8: #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc900000d7d80 ((work_completion)(&w->w)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fc43d08 (nfc_devlist_mutex){+.+.}-{3:3}, at: nfc_urelease_event_work+0xbb/0x310 net/nfc/netlink.c:1841 #3: ffff88801a6d0510 (&genl_data->genl_data_mutex){+.+.}-{3:3}, at: nfc_urelease_event_work+0x173/0x310 net/nfc/netlink.c:1847 2 locks held by kworker/u8:1/12: 3 locks held by kworker/1:0/25: #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc900001f7d80 ((work_completion)(&w->w)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fc43d08 (nfc_devlist_mutex){+.+.}-{3:3}, at: nfc_urelease_event_work+0xbb/0x310 net/nfc/netlink.c:1841 1 lock held by khungtaskd/30: #0: ffffffff8dbb15e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:327 [inline] #0: ffffffff8dbb15e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:839 [inline] #0: ffffffff8dbb15e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6613 4 locks held by kworker/1:2/783: #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc90003a6fd80 ((rfkill_op_work).work){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_epo+0x55/0x1d0 net/rfkill/core.c:462 #3: ffff88804af84100 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff88804af84100 (&dev->mutex){....}-{3:3}, at: nfc_dev_down+0x2d/0x2e0 net/nfc/core.c:143 3 locks held by kworker/0:2/784: #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc9000409fd80 ((work_completion)(&w->w)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fc43d08 (nfc_devlist_mutex){+.+.}-{3:3}, at: nfc_urelease_event_work+0xbb/0x310 net/nfc/netlink.c:1841 2 locks held by kworker/u8:8/3933: 2 locks held by getty/4841: #0: ffff88802b2860a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc90002f062f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc8/0x1490 drivers/tty/n_tty.c:2211 3 locks held by kworker/1:3/5145: #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc9000397fd80 ((work_completion)(&w->w)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fc43d08 (nfc_devlist_mutex){+.+.}-{3:3}, at: nfc_urelease_event_work+0xbb/0x310 net/nfc/netlink.c:1841 3 locks held by kworker/1:7/5153: #0: ffff888015480948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc900039cfd80 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_global_led_trigger_worker+0x1b/0x160 net/rfkill/core.c:182 2 locks held by syz.1.1281/9291: #0: ffff88804af84100 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #0: ffff88804af84100 (&dev->mutex){....}-{3:3}, at: nfc_unregister_device+0x60/0x330 net/nfc/core.c:1165 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_unregister+0xde/0x2c0 net/rfkill/core.c:1149 4 locks held by syz.4.1291/9339: #0: ffffffff8f7f6ab0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:35 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:60 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:57 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x580/0x800 net/netlink/genetlink.c:1209 #2: ffff88801a6d0510 (&genl_data->genl_data_mutex){+.+.}-{3:3}, at: nfc_genl_start_poll+0x19e/0x470 net/nfc/netlink.c:826 #3: ffff88801a6d0100 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #3: ffff88801a6d0100 (&dev->mutex){....}-{3:3}, at: nfc_start_poll+0x58/0x330 net/nfc/core.c:208 2 locks held by syz.4.1291/9354: #0: ffff88801a6d0100 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1009 [inline] #0: ffff88801a6d0100 (&dev->mutex){....}-{3:3}, at: nfc_unregister_device+0x60/0x330 net/nfc/core.c:1165 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_unregister+0xde/0x2c0 net/rfkill/core.c:1149 2 locks held by syz.4.1291/9357: #0: ffffffff8f7f6ab0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:35 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:60 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:57 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x580/0x800 net/netlink/genetlink.c:1209 2 locks held by syz.0.1296/9371: #0: ffffffff8f7f6ab0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:35 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:60 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:57 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x580/0x800 net/netlink/genetlink.c:1209 2 locks held by syz.2.1297/9377: #0: ffffffff8f7f6ab0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:35 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:60 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:57 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x580/0x800 net/netlink/genetlink.c:1209 2 locks held by syz.2.1297/9378: #0: ffffffff8f7f6ab0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:35 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:60 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:57 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x580/0x800 net/netlink/genetlink.c:1209 2 locks held by syz.2.1297/9381: #0: ffffffff8f7f6ab0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:35 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:60 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:57 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x580/0x800 net/netlink/genetlink.c:1209 2 locks held by syz.3.1299/9415: #0: ffffffff8f7f6ab0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x19/0x40 net/netlink/genetlink.c:1218 #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:35 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:60 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_op_lock net/netlink/genetlink.c:57 [inline] #1: ffffffff8f7f6b68 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x580/0x800 net/netlink/genetlink.c:1209 2 locks held by syz-executor/9461: #0: ffff88806a67b118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff88806a67b118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff88806a67b118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9463: #0: ffff888018e8a118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff888018e8a118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff888018e8a118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9466: #0: ffff88802d583918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff88802d583918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff88802d583918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9467: #0: ffff88802abf7118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff88802abf7118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff88802abf7118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9469: #0: ffff88807d814118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff88807d814118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff88807d814118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9475: #0: ffff8880118f2118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff8880118f2118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff8880118f2118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9477: #0: ffff88802aaae918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff88802aaae918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff88802aaae918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9480: #0: ffff88807eb84918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff88807eb84918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff88807eb84918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9481: #0: ffff888065dae118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff888065dae118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff888065dae118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9483: #0: ffff888049f20918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff888049f20918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff888049f20918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9485: #0: ffff88802eab0118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff88802eab0118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff88802eab0118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9487: #0: ffff888077cf5118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff888077cf5118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff888077cf5118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9490: #0: ffff888065781918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff888065781918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff888065781918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9491: #0: ffff88804a3ed118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff88804a3ed118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff88804a3ed118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 2 locks held by syz-executor/9493: #0: ffff8880659f3118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device drivers/bluetooth/hci_vhci.c:471 [inline] #0: ffff8880659f3118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_get_user drivers/bluetooth/hci_vhci.c:529 [inline] #0: ffff8880659f3118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_write+0x2bd/0x480 drivers/bluetooth/hci_vhci.c:609 #1: ffffffff8fbe2aa8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x3a/0xb40 net/rfkill/core.c:1075 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 30 Comm: khungtaskd Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xf86/0x1240 kernel/hung_task.c:379 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 5151 Comm: kworker/0:4 Not tainted 6.10.0-syzkaller-05505-gb1bc554e009e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: events nsim_dev_trap_report_work RIP: 0010:hlock_class+0x2d/0x130 kernel/locking/lockdep.c:222 Code: 00 00 00 00 fc ff df 53 48 89 fb 48 83 c7 20 48 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e da 00 00 00 0f b7 5b 20 <66> 81 e3 ff 1f 0f b7 db be 08 00 00 00 48 89 d8 48 c1 e8 06 48 8d RSP: 0018:ffffc9000399f850 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 000000000000876e RCX: 0000000000000006 RDX: 1ffff11005652caa RSI: ffff88802b296530 RDI: ffff88802b296550 RBP: ffffc9000399f9a0 R08: 0000000000000000 R09: fffffbfff285347d R10: ffffffff9429a3ef R11: 0000000000000004 R12: ffff88802b295a00 R13: 0000000000000040 R14: 0000000000000006 R15: 1ffff92000733f12 FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056397c7d0600 CR3: 000000000d97a000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mark_lock+0xb5/0xc60 kernel/locking/lockdep.c:4655 mark_held_locks+0x9f/0xe0 kernel/locking/lockdep.c:4273 __trace_hardirqs_on_caller kernel/locking/lockdep.c:4299 [inline] lockdep_hardirqs_on_prepare+0x27a/0x420 kernel/locking/lockdep.c:4358 trace_hardirqs_on+0x36/0x40 kernel/trace/trace_preemptirq.c:61 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock_irqrestore+0x52/0x80 kernel/locking/spinlock.c:194 __debug_check_no_obj_freed lib/debugobjects.c:999 [inline] debug_check_no_obj_freed+0x328/0x600 lib/debugobjects.c:1020 slab_free_hook mm/slub.c:2163 [inline] slab_free mm/slub.c:4438 [inline] kmem_cache_free+0x26f/0x3a0 mm/slub.c:4513 kfree_skbmem+0x10e/0x200 net/core/skbuff.c:1146 __kfree_skb net/core/skbuff.c:1203 [inline] consume_skb net/core/skbuff.c:1426 [inline] consume_skb+0xdd/0x170 net/core/skbuff.c:1420 nsim_dev_trap_report drivers/net/netdevsim/dev.c:821 [inline] nsim_dev_trap_report_work+0x878/0xc80 drivers/net/netdevsim/dev.c:850 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244