INFO: task kworker/1:3:977 blocked for more than 144 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:3 state:D stack:23096 pid:977 tgid:977 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events reg_todo Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 class_wiphy_constructor include/net/cfg80211.h:6360 [inline] reg_process_self_managed_hints+0x8f/0x190 net/wireless/reg.c:3179 reg_todo+0x8fa/0xa50 net/wireless/reg.c:3192 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 worker_thread+0xda6/0x1360 kernel/workqueue.c:3421 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 INFO: task syz.2.224:6588 blocked for more than 144 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.224 state:D stack:24096 pid:6588 tgid:6586 ppid:5822 task_flags:0x440140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_timeout+0xc3/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2cc/0x5e0 kernel/sched/completion.c:153 xfs_buf_iowait+0xc2/0x440 fs/xfs/xfs_buf.c:1379 _xfs_buf_read fs/xfs/xfs_buf.c:643 [inline] xfs_buf_read_map+0x325/0xa20 fs/xfs/xfs_buf.c:709 xfs_trans_read_buf_map+0x1db/0x8a0 fs/xfs/xfs_trans_buf.c:304 xfs_trans_read_buf fs/xfs/xfs_trans.h:210 [inline] xfs_btree_read_buf_block+0x2b0/0x490 fs/xfs/libxfs/xfs_btree.c:1402 xfs_btree_lookup_get_block+0x297/0x510 fs/xfs/libxfs/xfs_btree.c:1907 xfs_btree_lookup+0x45a/0x1350 fs/xfs/libxfs/xfs_btree.c:2018 xfs_inobt_lookup fs/xfs/libxfs/xfs_ialloc.c:47 [inline] xfs_dialloc_ag_finobt_near+0x13f/0x670 fs/xfs/libxfs/xfs_ialloc.c:1385 xfs_dialloc_ag fs/xfs/libxfs/xfs_ialloc.c:1607 [inline] xfs_dialloc_try_ag fs/xfs/libxfs/xfs_ialloc.c:1836 [inline] xfs_dialloc+0xecf/0x19e0 fs/xfs/libxfs/xfs_ialloc.c:1946 xfs_qm_qino_alloc+0x231/0x730 fs/xfs/xfs_qm.c:960 xfs_qm_init_quotainos+0x7bd/0xa00 fs/xfs/xfs_qm.c:1779 xfs_qm_init_quotainfo+0x188/0x1170 fs/xfs/xfs_qm.c:788 xfs_qm_mount_quotas+0xa6/0x670 fs/xfs/xfs_qm.c:1633 xfs_mountfs+0x1b16/0x22e0 fs/xfs/xfs_mount.c:1187 xfs_fs_fill_super+0x11f1/0x1640 fs/xfs/xfs_super.c:1960 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1691 vfs_get_tree+0x92/0x2a0 fs/super.c:1751 fc_mount fs/namespace.c:1199 [inline] do_new_mount_fc fs/namespace.c:3636 [inline] do_new_mount+0x329/0xa50 fs/namespace.c:3712 do_mount fs/namespace.c:4035 [inline] __do_sys_mount fs/namespace.c:4224 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4201 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9dc6f9c14a RSP: 002b:00007f9dc7e68e58 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f9dc7e68ee0 RCX: 00007f9dc6f9c14a RDX: 0000200000009700 RSI: 0000200000009740 RDI: 00007f9dc7e68ea0 RBP: 0000200000009700 R08: 00007f9dc7e68ee0 R09: 0000000004000000 R10: 0000000004000000 R11: 0000000000000246 R12: 0000200000009740 R13: 00007f9dc7e68ea0 R14: 000000000000975c R15: 0000200000000800 INFO: task ext4lazyinit:6614 blocked for more than 144 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:ext4lazyinit state:D stack:27384 pid:6614 tgid:6614 ppid:2 task_flags:0x200040 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 io_schedule+0x7f/0xd0 kernel/sched/core.c:7791 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:250 __wait_on_bit+0xb9/0x310 kernel/sched/wait_bit.c:52 out_of_line_wait_on_bit+0x13b/0x190 kernel/sched/wait_bit.c:67 wait_on_buffer include/linux/buffer_head.h:420 [inline] ext4_commit_super+0x330/0x430 fs/ext4/super.c:6277 ext4_handle_error+0x65e/0x950 fs/ext4/super.c:718 __ext4_error+0x29f/0x3c0 fs/ext4/super.c:829 ext4_validate_block_bitmap+0x64e/0x6c0 fs/ext4/balloc.c:-1 ext4_read_block_bitmap_nowait+0x5f9/0x9d0 fs/ext4/balloc.c:557 ext4_mb_prefetch+0x21c/0x3a0 fs/ext4/mballoc.c:2862 ext4_run_li_request fs/ext4/super.c:3700 [inline] ext4_lazyinit_thread+0x551/0x1830 fs/ext4/super.c:3827 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 INFO: task syz.0.232:6631 blocked for more than 144 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.232 state:D stack:28184 pid:6631 tgid:6624 ppid:5819 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5260 [inline] __schedule+0x14ea/0x5050 kernel/sched/core.c:6867 __schedule_loop kernel/sched/core.c:6949 [inline] schedule+0x164/0x360 kernel/sched/core.c:6964 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021 __mutex_lock_common kernel/locking/mutex.c:692 [inline] __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776 tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] tty_open+0x22d/0xd70 drivers/tty/tty_io.c:2120 chrdev_open+0x4cd/0x5e0 fs/char_dev.c:414 do_dentry_open+0x7ce/0x1420 fs/open.c:962 vfs_open+0x3b/0x340 fs/open.c:1094 do_open fs/namei.c:4637 [inline] path_openat+0x3486/0x3e20 fs/namei.c:4796 do_filp_open+0x22d/0x490 fs/namei.c:4823 do_sys_openat2+0x12f/0x220 fs/open.c:1430 do_sys_open fs/open.c:1436 [inline] __do_sys_openat fs/open.c:1452 [inline] __se_sys_openat fs/open.c:1447 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1447 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7efeef95b78e RSP: 002b:00007efeedbf5b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007efeedbf66c0 RCX: 00007efeef95b78e RDX: 0000000000000002 RSI: 00007efeedbf5c00 RDI: ffffffffffffff9c RBP: 00007efeefa08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efeefc16128 R14: 00007efeefc16090 R15: 00007ffd4187c868 Showing all locks held in the system: 2 locks held by kthreadd/2: 3 locks held by kworker/u8:0/12: 3 locks held by kworker/u8:1/13: 2 locks held by kworker/1:0/24: 3 locks held by kworker/1:0H/25: #0: ffff88801b6ec148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88801b6ec148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900001f7bc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900001f7bc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline] #2: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:956 2 locks held by kworker/1:1/30: 1 lock held by khungtaskd/32: #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e55a360 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775 3 locks held by kworker/u8:2/37: 2 locks held by kworker/R-kbloc/40: #0: ffff88801b6ec148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88801b6ec148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90000b17b80 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90000b17b80 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 3 locks held by kworker/u8:3/50: 3 locks held by kworker/u8:4/70: 2 locks held by kworker/0:1H/120: #0: ffff88801b6ec148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88801b6ec148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90002dc7bc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90002dc7bc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 4 locks held by kworker/1:3/977: #0: ffff88813fe51948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88813fe51948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000372fbc0 (reg_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000372fbc0 (reg_work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: reg_todo+0x1c/0xa50 net/wireless/reg.c:3189 #3: ffff888051b98788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6360 [inline] #3: ffff888051b98788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_process_self_managed_hints+0x8f/0x190 net/wireless/reg.c:3179 3 locks held by kworker/u8:5/1142: 3 locks held by kworker/u8:6/2938: 3 locks held by kworker/R-ipv6_/3178: #0: ffff88814c994948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88814c994948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9000b367b80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9000b367b80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4734 5 locks held by kworker/R-bat_e/3403: 1 lock held by klogd/5177: 2 locks held by udevd/5188: 2 locks held by dhcpcd/5483: 2 locks held by crond/5562: 2 locks held by getty/5583: #0: ffff88814dbb60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900036bb2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211 2 locks held by syz-executor/5806: 3 locks held by syz-executor/5821: 2 locks held by syz-executor/5823: #0: ffff88807aa220e0 (&type->s_umount_key#82){++++}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff88807aa220e0 (&type->s_umount_key#82){++++}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff88807aa220e0 (&type->s_umount_key#82){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 #1: ffff88807aa22948 (&s->s_sync_lock){+.+.}-{4:4}, at: wait_sb_inodes fs/fs-writeback.c:2722 [inline] #1: ffff88807aa22948 (&s->s_sync_lock){+.+.}-{4:4}, at: sync_inodes_sb+0x285/0xbd0 fs/fs-writeback.c:2910 1 lock held by syz-executor/5824: #0: ffff8880271a20e0 (&type->s_umount_key#31){++++}-{4:4}, at: __super_lock fs/super.c:57 [inline] #0: ffff8880271a20e0 (&type->s_umount_key#31){++++}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline] #0: ffff8880271a20e0 (&type->s_umount_key#31){++++}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506 2 locks held by kworker/0:3/5826: 5 locks held by kworker/u9:6/5838: #0: ffff8880275ea948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff8880275ea948 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900040dfbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900040dfbc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff888059100ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff8880591000c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5703 #4: ffffffff8fb38928 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8fb38928 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 1 lock held by udevd/5839: #0: ffff888023234ca8 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1042 [inline] #0: ffff888023234ca8 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 block/fops.c:855 7 locks held by kworker/u9:9/5843: #0: ffff8880275e8148 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff8880275e8148 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc90002e77bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc90002e77bc0 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffff88802758cec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1d3/0x400 net/bluetooth/hci_sync.c:331 #3: ffff88802758c0c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5703 #4: ffffffff8fb38928 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline] #4: ffffffff8fb38928 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x165/0x340 net/bluetooth/hci_conn.c:1336 #5: ffff88802850d338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5b0 net/bluetooth/l2cap_core.c:1763 #6: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline] #6: ffffffff8e560c78 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:956 3 locks held by kworker/1:5/5915: #0: ffff88813fe52948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88813fe52948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc900048ffbc0 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc900048ffbc0 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 #2: ffffffff8f9ac148 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xa5/0xf40 net/wireless/reg.c:2453 3 locks held by kworker/u8:7/5944: 3 locks held by kworker/u8:8/5947: 3 locks held by kworker/1:7/5980: 1 lock held by udevd/6474: #0: ffff888023235828 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:1042 [inline] #0: ffff888023235828 (&sb->s_type->i_mutex_key#10){++++}-{4:4}, at: blkdev_read_iter+0x2f8/0x440 block/fops.c:855 2 locks held by syz.2.224/6588: #0: ffff88803037a0e0 (&type->s_umount_key#66/1){+.+.}-{4:4}, at: alloc_super+0x28c/0xaa0 fs/super.c:344 #1: ffff88803037a610 (sb_internal#4){.+.+}-{0:0}, at: xfs_trans_alloc+0xd7/0x960 fs/xfs/xfs_trans.c:256 1 lock held by syz.1.225/6591: #0: ffff8880512320e0 (&type->s_umount_key#66/1){+.+.}-{4:4}, at: alloc_super+0x28c/0xaa0 fs/super.c:344 2 locks held by ext4lazyinit/6614: #0: ffff8880271a20e0 (&type->s_umount_key#31){++++}-{4:4}, at: ext4_lazyinit_thread+0x1b7/0x1830 fs/ext4/super.c:3818 #1: ffff8880271a2420 (sb_writers#4){.+.+}-{0:0}, at: kthread+0x726/0x8b0 kernel/kthread.c:463 4 locks held by syz.0.232/6626: 1 lock held by syz.0.232/6631: #0: ffffffff8edd7888 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8edd7888 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x22d/0xd70 drivers/tty/tty_io.c:2120 3 locks held by kworker/u8:9/6636: 3 locks held by kworker/u8:10/6637: 3 locks held by kworker/u8:11/6639: 2 locks held by kworker/1:2H/6640: #0: ffff88801b6ec148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3232 [inline] #0: ffff88801b6ec148 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_scheduled_works+0x9d4/0x17a0 kernel/workqueue.c:3340 #1: ffffc9001cd9fbc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3233 [inline] #1: ffffc9001cd9fbc0 ((work_completion)(&q->timeout_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa0f/0x17a0 kernel/workqueue.c:3340 2 locks held by kworker/u8:12/6643: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xf90/0xfe0 kernel/hung_task.c:515 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 3403 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline] RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:114 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:128 [inline] RIP: 0010:lock_is_held_type+0x4d/0x150 kernel/locking/lockdep.c:5936 Code: 39 f4 5b 07 85 c0 0f 85 d5 00 00 00 65 4c 8b 2d 81 ae 5b 07 41 83 bd 2c 0b 00 00 00 0f 85 bf 00 00 00 89 f5 49 89 fe 9c 41 5c 48 c7 c7 6e 27 ce 8d e8 a6 18 00 00 65 ff 05 ff f3 5b 07 41 83 RSP: 0018:ffffc90000a078a8 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 00000000ffffffff RCX: 0000000080000102 RDX: ffff888030798000 RSI: 00000000ffffffff RDI: ffffffff8e55a360 RBP: 00000000ffffffff R08: ffffc90000a07b60 R09: ffffc90000a07b70 R10: dffffc0000000000 R11: fffff52000140f3a R12: 0000000000000246 R13: ffff888030798000 R14: ffffffff8e55a360 R15: ffffc90000a07b38 FS: 0000000000000000(0000) GS:ffff8881257f5000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd1da87068 CR3: 00000000763cf000 CR4: 0000000000350ef0 Call Trace: __find_rr_leaf+0x353/0x760 net/ipv6/route.c:833 find_rr_leaf net/ipv6/route.c:889 [inline] rt6_select net/ipv6/route.c:933 [inline] fib6_table_lookup+0x3b4/0xa80 net/ipv6/route.c:2244 ip6_pol_route+0x228/0x13d0 net/ipv6/route.c:2280 pol_lookup_func include/net/ip6_fib.h:617 [inline] fib6_rule_lookup+0x556/0x730 net/ipv6/fib6_rules.c:120 ip6_route_input_lookup net/ipv6/route.c:2349 [inline] ip6_route_input+0x730/0xad0 net/ipv6/route.c:2652 ip6_rcv_finish+0x141/0x2e0 net/ipv6/ip6_input.c:77 ip_sabotage_in+0x1e1/0x270 net/bridge/br_netfilter_hooks.c:990 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316 __netif_receive_skb_one_core net/core/dev.c:6152 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] netif_receive_skb_internal net/core/dev.c:6351 [inline] netif_receive_skb+0x278/0xbb0 net/core/dev.c:6410 NF_HOOK+0xa4/0x3a0 include/linux/netfilter.h:319 br_handle_frame_finish+0x14b2/0x1b40 net/bridge/br_input.c:-1 br_nf_hook_thresh+0x3dd/0x4c0 net/bridge/br_netfilter_hooks.c:-1 br_nf_pre_routing_finish_ipv6+0xa3a/0xd70 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:318 [inline] br_nf_pre_routing_ipv6+0x374/0x6f0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_bridge_pre net/bridge/br_input.c:291 [inline] br_handle_frame+0x1277/0x1510 net/bridge/br_input.c:442 __netif_receive_skb_core+0x98f/0x30a0 net/core/dev.c:6039 __netif_receive_skb_one_core net/core/dev.c:6150 [inline] __netif_receive_skb net/core/dev.c:6265 [inline] process_backlog+0x76d/0x1950 net/core/dev.c:6617 __napi_poll+0xae/0x340 net/core/dev.c:7681 napi_poll net/core/dev.c:7744 [inline] net_rx_action+0x627/0xf70 net/core/dev.c:7896 handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2250 [inline] batadv_tt_purge+0x4d1/0x9e0 net/batman-adv/translation-table.c:3510 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340 rescuer_thread+0xcba/0x1390 kernel/workqueue.c:3528 kthread+0x726/0x8b0 kernel/kthread.c:463 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246