INFO: task syz-executor:5403 blocked for more than 143 seconds. Not tainted 6.1.117-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:5403 ppid:1 flags:0x00000001 Call trace: __switch_to+0x308/0x5fc arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6693 __mutex_lock_common+0xbd8/0x21a0 kernel/locking/mutex.c:679 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799 del_device_store+0xec/0x39c drivers/net/netdevsim/bus.c:209 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124 sysfs_kf_write+0x200/0x280 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x334/0x48c fs/kernfs/file.c:334 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x610/0x91c fs/read_write.c:584 ksys_write+0x15c/0x26c fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 INFO: task syz-executor:5407 blocked for more than 143 seconds. Not tainted 6.1.117-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:5407 ppid:1 flags:0x00000001 Call trace: __switch_to+0x308/0x5fc arch/arm64/kernel/process.c:553 context_switch kernel/sched/core.c:5241 [inline] __schedule+0xef4/0x1d44 kernel/sched/core.c:6558 schedule+0xc4/0x170 kernel/sched/core.c:6634 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:6693 __mutex_lock_common+0xbd8/0x21a0 kernel/locking/mutex.c:679 __mutex_lock kernel/locking/mutex.c:747 [inline] mutex_lock_nested+0x38/0x44 kernel/locking/mutex.c:799 del_device_store+0xec/0x39c drivers/net/netdevsim/bus.c:209 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124 sysfs_kf_write+0x200/0x280 fs/sysfs/file.c:136 kernfs_fop_write_iter+0x334/0x48c fs/kernfs/file.c:334 call_write_iter include/linux/fs.h:2265 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x610/0x91c fs/read_write.c:584 ksys_write+0x15c/0x26c fs/read_write.c:637 __do_sys_write fs/read_write.c:649 [inline] __se_sys_write fs/read_write.c:646 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:646 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Showing all locks held in the system: 2 locks held by kworker/0:0/7: #0: ffff0000c0020938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff80001d0f7c20 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 1 lock held by rcu_tasks_kthre/12: #0: ffff800015ba5470 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffff800015ba5c70 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x44/0xcf4 kernel/rcu/tasks.h:517 4 locks held by ksoftirqd/0/15: 1 lock held by khungtaskd/28: #0: ffff800015ba52a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0xc/0x44 include/linux/rcupdate.h:349 5 locks held by kworker/u4:2/39: #0: ffff0000c03dd138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff80001d637c20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff800017fe8610 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf4/0x994 net/core/net_namespace.c:566 #3: ffff0000dab3d3e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_destruct+0x11c/0x2dc drivers/net/wireguard/device.c:249 #4: ffff800015baa740 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x58/0x5c4 kernel/rcu/tree.c:4019 1 lock held by dhcpcd/3965: #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: __netlink_dump_start+0x104/0x680 net/netlink/af_netlink.c:2302 2 locks held by getty/4060: #0: ffff0000d6393098 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff80001efc02f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x414/0x1214 drivers/tty/n_tty.c:2198 4 locks held by kworker/u5:1/4295: #0: ffff0001a7d8b938 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff800021017c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0000dac88078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0xa0/0x8c4 net/bluetooth/hci_event.c:3770 #3: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1785 [inline] #3: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x458/0x8c4 net/bluetooth/hci_event.c:3803 4 locks held by kworker/u5:3/4301: #0: ffff000101ddf938 ((wq_completion)hci17#2){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff800021197c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff0001892a8078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0xa0/0x8c4 net/bluetooth/hci_event.c:3770 #3: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1785 [inline] #3: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x458/0x8c4 net/bluetooth/hci_event.c:3803 4 locks held by kworker/u5:4/4305: #0: ffff00012773f938 ((wq_completion)hci16#2){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff8000211d7c20 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff000158dc4078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0xa0/0x8c4 net/bluetooth/hci_event.c:3770 #3: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1785 [inline] #3: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x458/0x8c4 net/bluetooth/hci_event.c:3803 2 locks held by kworker/u4:9/4665: 3 locks held by kworker/u4:11/5172: #0: ffff0000c0029138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x664/0x1404 kernel/workqueue.c:2265 #1: ffff800021947c20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x6a8/0x1404 kernel/workqueue.c:2267 #2: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 4 locks held by syz-executor/5403: #0: ffff0000d81b0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x244/0x91c fs/read_write.c:580 #1: ffff0000cb40d488 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1c8/0x48c fs/kernfs/file.c:325 #2: ffff0000ca8740f0 (kn->active#45){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1e4/0x48c fs/kernfs/file.c:326 #3: ffff8000173b6aa8 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xec/0x39c drivers/net/netdevsim/bus.c:209 3 locks held by syz-executor/5406: #0: ffff0000f1ec10b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000f1ec10b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000f1ec0078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1800 [inline] #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x27c net/bluetooth/hci_conn.c:2444 4 locks held by syz-executor/5407: #0: ffff0000d81b0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x244/0x91c fs/read_write.c:580 #1: ffff0000f0940088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1c8/0x48c fs/kernfs/file.c:325 #2: ffff0000ca8740f0 (kn->active#45){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1e4/0x48c fs/kernfs/file.c:326 #3: ffff8000173b6aa8 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xec/0x39c drivers/net/netdevsim/bus.c:209 7 locks held by syz-executor/5409: #0: ffff0000d81b0460 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x244/0x91c fs/read_write.c:580 #1: ffff0000f0a3a888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1c8/0x48c fs/kernfs/file.c:325 #2: ffff0000ca8740f0 (kn->active#45){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1e4/0x48c fs/kernfs/file.c:326 #3: ffff8000173b6aa8 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xec/0x39c drivers/net/netdevsim/bus.c:209 #4: ffff0000f022c0e8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:837 [inline] #4: ffff0000f022c0e8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1080 [inline] #4: ffff0000f022c0e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xbc/0x724 drivers/base/dd.c:1283 #5: ffff0000f022d2f8 (&devlink->lock_key#2){+.+.}-{3:3}, at: devl_lock+0x24/0x34 net/devlink/leftover.c:275 #6: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:74 2 locks held by syz.7.244/5690: #0: ffff0000d80c90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000d80c90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000d80c8078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 3 locks held by syz-executor/5706: #0: ffff0000dd8390b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000dd8390b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000dd838078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1800 [inline] #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x27c net/bluetooth/hci_conn.c:2444 2 locks held by syz-executor/5708: #0: ffff0000f23c10b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000f23c10b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000f23c0078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 3 locks held by syz-executor/5711: #0: ffff0000f23bd0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000f23bd0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000f23bc078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1800 [inline] #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x27c net/bluetooth/hci_conn.c:2444 3 locks held by syz-executor/5720: #0: ffff0000f23b90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000f23b90b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000f23b8078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1800 [inline] #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x27c net/bluetooth/hci_conn.c:2444 3 locks held by syz-executor/5722: #0: ffff0000dd83d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000dd83d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000dd83c078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1800 [inline] #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x27c net/bluetooth/hci_conn.c:2444 3 locks held by syz-executor/5731: #0: ffff0000efc290b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000efc290b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000efc28078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1800 [inline] #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x27c net/bluetooth/hci_conn.c:2444 3 locks held by syz-executor/5734: #0: ffff0000d1a710b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000d1a710b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000d1a70078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1800 [inline] #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x27c net/bluetooth/hci_conn.c:2444 1 lock held by syz-executor/5736: #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 3 locks held by syz-executor/5738: #0: ffff0000f008d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close net/bluetooth/hci_core.c:508 [inline] #0: ffff0000f008d0b8 (&hdev->req_lock){+.+.}-{3:3}, at: hci_unregister_dev+0x1f8/0x4c4 net/bluetooth/hci_core.c:2707 #1: ffff0000f008c078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_close_sync+0x39c/0xf6c net/bluetooth/hci_sync.c:5057 #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1800 [inline] #2: ffff800018141f28 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xb0/0x27c net/bluetooth/hci_conn.c:2444 1 lock held by syz-executor/5745: #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 1 lock held by syz-executor/5774: #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 1 lock held by syz-executor/5789: #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 1 lock held by syz-executor/5793: #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffff800017ff4448 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x6e8/0xd94 net/core/rtnetlink.c:6147 =============================================