INFO: task syz.2.18:6073 blocked for more than 143 seconds. Not tainted 6.14.0-rc6-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.18 state:D stack:28304 pid:6073 tgid:6071 ppid:5954 task_flags:0x400040 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5378 [inline] __schedule+0xf43/0x5890 kernel/sched/core.c:6765 __schedule_loop kernel/sched/core.c:6842 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6857 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914 __mutex_lock_common kernel/locking/mutex.c:662 [inline] __mutex_lock+0x6bd/0xb10 kernel/locking/mutex.c:730 blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 sg_ioctl_common drivers/scsi/sg.c:1122 [inline] sg_ioctl+0x9a1/0x2760 drivers/scsi/sg.c:1156 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x190/0x200 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fce26d8d169 RSP: 002b:00007fce27b1a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fce26fa6080 RCX: 00007fce26d8d169 RDX: 0000000000000000 RSI: 0000000000001276 RDI: 0000000000000003 RBP: 00007fce26e0e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007fce26fa6080 R15: 00007ffd125c2328 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8e1bd0c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #0: ffffffff8e1bd0c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8e1bd0c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6746 3 locks held by kworker/u8:2/36: #0: ffff8880310a1148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3213 #1: ffffc90000ac7d18 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3214 #2: ffffffff8fef7ee8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline] #2: ffffffff8fef7ee8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x121/0x14e0 net/ipv6/addrconf.c:4190 2 locks held by kswapd0/89: 2 locks held by kworker/u8:11/3664: 2 locks held by getty/5585: #0: ffff888031b060a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211 2 locks held by syz.2.18/6072: 1 lock held by syz.2.18/6073: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.6.22/6172: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.6.22/6173: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.5.21/6187: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.5.21/6190: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.7.23/6202: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.7.23/6204: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.8.24/6218: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.8.24/6219: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.9.25/6227: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.9.25/6230: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.0.26/6545: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.0.26/6546: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.3.27/6618: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.3.27/6620: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.1.28/6654: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.1.28/6655: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.4.30/6658: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.4.30/6659: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.2.29/6662: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.2.29/6663: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.6.31/6693: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.6.31/6694: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.5.32/6718: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.5.32/6721: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.8.34/6781: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.8.34/6783: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.7.33/6790: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.7.33/6792: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.9.35/6798: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.9.35/6800: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.0.36/6816: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.0.36/6818: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.3.37/6824: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.3.37/6825: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.1.38/6864: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.1.38/6865: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.2.40/6900: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.2.40/6901: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.4.39/6906: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.4.39/6908: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.6.41/6945: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.6.41/6946: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.5.42/6953: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.5.42/6954: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 3 locks held by syz-executor/6958: #0: ffffffff8fef7ee8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fef7ee8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:335 [inline] #0: ffffffff8fef7ee8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x5d9/0x1d60 net/core/rtnetlink.c:4021 #1: ffff8881b525d4e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x203/0x4e0 drivers/net/wireguard/device.c:50 #2: ffffffff8e1c8538 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x282/0x3b0 kernel/rcu/tree_exp.h:302 1 lock held by syz.8.43/6992: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.8.43/6994: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 1 lock held by syz.7.44/7003: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_setup+0xd8/0x1b0 kernel/trace/blktrace.c:631 1 lock held by syz.7.44/7004: #0: ffff888143bcdb38 (&q->debugfs_mutex){+.+.}-{4:4}, at: blk_trace_remove+0x1f/0x40 kernel/trace/blktrace.c:406 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline] watchdog+0xf62/0x12b0 kernel/hung_task.c:399 kthread+0x3af/0x750 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 5136 Comm: kworker/u9:1 Not tainted 6.14.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: hci26 hci_rx_work RIP: 0010:format_decode+0x86d/0xd40 lib/vsprintf.c:2690 Code: b6 04 02 48 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 bd 03 00 00 44 0a 7b 02 48 8d 7c 24 49 49 83 c5 01 48 89 fa 4c 89 6c 24 40 <48> c1 ea 03 45 88 3e 0f b6 03 88 44 24 48 48 b8 00 00 00 00 00 fc RSP: 0018:ffffc90010857058 EFLAGS: 00000286 RAX: 0000000000000000 RBX: ffffffff8ccf966c RCX: ffffffff8b543bef RDX: ffffc900108570a1 RSI: ffffffff8b543c02 RDI: ffffc900108570a1 RBP: ffffc90010857100 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 000000000003a548 R12: 0000000000000004 R13: ffffffff8b6dd1e2 R14: ffffc90010857188 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd41044ad8 CR3: 000000015676a000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: vsnprintf+0x15b/0x1180 lib/vsprintf.c:2786 snprintf+0xc8/0x100 lib/vsprintf.c:2937 print_caller kernel/printk/printk.c:1390 [inline] info_print_prefix+0x135/0x350 kernel/printk/printk.c:1409 record_print_text+0x141/0x400 kernel/printk/printk.c:1456 printk_get_next_message+0x2be/0x690 kernel/printk/printk.c:3008 console_emit_next_record kernel/printk/printk.c:3076 [inline] console_flush_all+0x6ec/0xc60 kernel/printk/printk.c:3210 __console_flush_and_unlock kernel/printk/printk.c:3269 [inline] console_unlock+0xd9/0x210 kernel/printk/printk.c:3309 vprintk_emit+0x424/0x6f0 kernel/printk/printk.c:2432 _printk+0xc8/0x100 kernel/printk/printk.c:2457 bt_warn+0xe5/0x120 net/bluetooth/lib.c:276 hci_cc_func net/bluetooth/hci_event.c:4184 [inline] hci_cmd_complete_evt+0x2f0/0x920 net/bluetooth/hci_event.c:4208 hci_event_func net/bluetooth/hci_event.c:7470 [inline] hci_event_packet+0x666/0x1180 net/bluetooth/hci_event.c:7525 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4015 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3400 kthread+0x3af/0x750 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244