INFO: task kworker/u4:3:1208 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:3 state:D stack:21584 pid: 1208 ppid: 2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 linkwatch_event+0xa/0x50 net/core/link_watch.c:251 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/u4:4:1238 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:4 state:D stack:23952 pid: 1238 ppid: 2 flags:0x00004000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 netdev_run_todo+0x8dd/0xac0 net/core/dev.c:10723 default_device_exit_batch+0x369/0x3c0 net/core/dev.c:11695 ops_exit_list net/core/net_namespace.c:177 [inline] cleanup_net+0x78e/0xba0 net/core/net_namespace.c:635 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/0:19:4343 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:19 state:D stack:25552 pid: 4343 ppid: 2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz.2.56:4626 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.56 state:D stack:27408 pid: 4626 ppid: 4372 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 tun_detach drivers/net/tun.c:699 [inline] tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f1835981559 RSP: 002b:00007ffed5cd3588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f1835c09da0 RCX: 00007f1835981559 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f1835c09da0 R08: 00007f1835c08128 R09: 0000000000000000 R10: 000000000003fd50 R11: 0000000000000246 R12: 000000000002e966 R13: 00007f1835c0809c R14: 000000000002e7f1 R15: 00007ffed5cd3690 INFO: task syz.1.55:4627 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.55 state:D stack:27408 pid: 4627 ppid: 4371 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 tun_detach drivers/net/tun.c:699 [inline] tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f66021d5559 RSP: 002b:00007ffd692718a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f660245dda0 RCX: 00007f66021d5559 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f660245dda0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007f660245dcb0 R11: 0000000000000246 R12: 000000000002e938 R13: 00007f660245bfac R14: 000000000002e7f0 R15: 00007ffd692719b0 INFO: task syz.1.55:4628 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.55 state:D stack:25744 pid: 4628 ppid: 4371 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571 sock_do_ioctl+0x245/0x320 net/socket.c:1162 sock_ioctl+0x48a/0x700 net/socket.c:1267 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f66021d5559 RSP: 002b:00007f6601834028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f660245bfa0 RCX: 00007f66021d5559 RDX: 0000200000000080 RSI: 0000000000008914 RDI: 0000000000000005 RBP: 00007f660226cb20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f660245c038 R14: 00007f660245bfa0 R15: 00007ffd69271748 INFO: task syz.4.21:4631 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.21 state:D stack:27664 pid: 4631 ppid: 4378 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 tun_detach drivers/net/tun.c:699 [inline] tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f327ca8a559 RSP: 002b:00007ffdf45c3008 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f327cd12da0 RCX: 00007f327ca8a559 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f327cd12da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007f327cd12cb0 R11: 0000000000000246 R12: 000000000002ea14 R13: 00007f327cd1109c R14: 000000000002e7f6 R15: 00007ffdf45c3110 INFO: task syz.3.57:4634 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.57 state:D stack:27408 pid: 4634 ppid: 4377 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 tun_detach drivers/net/tun.c:699 [inline] tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efde5621559 RSP: 002b:00007ffc7f7d36e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007efde58a9da0 RCX: 00007efde5621559 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007efde58a9da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007efde58a9cb0 R11: 0000000000000246 R12: 000000000002ea41 R13: 00007efde58a809c R14: 000000000002e935 R15: 00007ffc7f7d37f0 INFO: task syz.3.57:4635 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.57 state:D stack:27600 pid: 4635 ppid: 4377 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 dev_ioctl+0x449/0xe30 net/core/dev_ioctl.c:508 sock_do_ioctl+0x245/0x320 net/socket.c:1162 sock_ioctl+0x48a/0x700 net/socket.c:1267 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efde5621559 RSP: 002b:00007efde4c80028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007efde58a7fa0 RCX: 00007efde5621559 RDX: 0000200000000080 RSI: 0000000000008946 RDI: 000000000000002c RBP: 00007efde4c80090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007efde58a8038 R14: 00007efde58a7fa0 R15: 00007ffc7f7d3588 INFO: task syz.3.57:4636 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.57 state:D stack:25744 pid: 4636 ppid: 4377 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571 sock_do_ioctl+0x245/0x320 net/socket.c:1162 sock_ioctl+0x48a/0x700 net/socket.c:1267 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efde5621559 RSP: 002b:00007efde4c5f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007efde58a8090 RCX: 00007efde5621559 RDX: 0000200000000080 RSI: 0000000000008914 RDI: 0000000000000004 RBP: 00007efde56b8b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007efde58a8128 R14: 00007efde58a8090 R15: 00007ffc7f7d3588 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 3 locks held by kworker/u4:1/145: #0: ffff8880b8f3a358 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x130 kernel/sched/core.c:475 #1: ffff8880b8f27888 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x4c3/0x810 kernel/sched/psi.c:882 #2: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312 3 locks held by kworker/u4:3/1208: #0: ffff888017879138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90004c27d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251 4 locks held by kworker/u4:4/1238: #0: ffff8880179cd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90004dd7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e25fe10 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589 #3: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: netdev_run_todo+0x8dd/0xac0 net/core/dev.c:10723 2 locks held by getty/3951: #0: ffff88814d53d098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc900026562e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158 3 locks held by kworker/0:18/4342: #0: ffff888017871938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000315fd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x82/0xa90 net/wireless/reg.c:2437 3 locks held by kworker/0:19/4343: #0: ffff88802bab2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000317fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128 1 lock held by syz.2.56/4626: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 1 lock held by syz.1.55/4627: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 1 lock held by syz.1.55/4628: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571 1 lock held by syz.4.21/4631: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 1 lock held by syz.4.21/4638: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571 1 lock held by syz.3.57/4634: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 1 lock held by syz.3.57/4635: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x449/0xe30 net/core/dev_ioctl.c:508 1 lock held by syz.3.57/4636: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571 1 lock held by syz.0.58/4639: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454 1 lock held by syz.0.58/4640: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571 1 lock held by syz.0.58/4641: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x449/0xe30 net/core/dev_ioctl.c:508 1 lock held by syz-executor/4647: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4651: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4656: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4657: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4659: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4671: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4676: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4681: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4682: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4684: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4696: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4698: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4704: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4707: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 1 lock held by syz-executor/4708: #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe1b/0xe60 kernel/hung_task.c:369 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 4642 Comm: kworker/u4:6 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:91 [inline] RIP: 0010:lock_acquire+0x126/0x400 kernel/locking/lockdep.c:5713 Code: c0 0f 85 44 01 00 00 65 4c 8b 35 55 80 a5 7e 49 81 c6 ec 0a 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 09 02 00 00 <41> 83 3e 00 0f 85 17 01 00 00 43 c6 44 3c 08 00 48 c7 84 24 a0 00 RSP: 0018:ffffc9000131f980 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 74e32f10678a8000 RDX: 0000000000000000 RSI: ffffffff8a7a4ba0 RDI: ffffffff8a7a4b60 RBP: ffffc9000131fa88 R08: ffffffff8e6d22af R09: 1ffffffff1cda455 R10: dffffc0000000000 R11: fffffbfff1cda456 R12: 1ffff92000263f3c R13: ffff88805ad15808 R14: ffff88806b018aec R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000558b6a557168 CR3: 000000002b5b2000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162 skb_dequeue+0x29/0x150 net/core/skbuff.c:3289 ieee80211_iface_work+0x16d/0xc50 net/mac80211/iface.c:1515 cfg80211_wiphy_work+0x224/0x260 net/wireless/core.c:433 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287