INFO: task acpid:3546 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:acpid state:D stack:22128 pid: 3546 ppid: 1 flags:0x00004002
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
synchronize_rcu_expedited+0x5c1/0x750 kernel/rcu/tree_exp.h:861
synchronize_rcu+0x119/0x1e0 kernel/rcu/tree.c:3802
evdev_detach_client drivers/input/evdev.c:386 [inline]
evdev_release+0x1f3/0x800 drivers/input/evdev.c:449
__fput+0x234/0x930 fs/file_table.c:311
task_work_run+0x125/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fb5cb3ac407
RSP: 002b:00007ffe4ecf65f0 EFLAGS: 00000202
ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 00007fb5cb322740 RCX: 00007fb5cb3ac407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 000000000000000a
RBP: 00007ffe4ecf67b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000040
R13: 00007ffe4ecf68b0 R14: 0000556baa52f7fe R15: 00007ffe4ecf68b0
INFO: task kworker/u4:8:4293 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:8 state:D
stack:22904 pid: 4293 ppid: 2 flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
__synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930
fsnotify_mark_destroy_workfn+0x106/0x2f0 fs/notify/mark.c:924
process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
INFO: task kworker/u4:13:4476 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:13 state:D stack:23312 pid: 4476 ppid: 2 flags:0x00004000
Workqueue: events_unbound fsnotify_connector_destroy_workfn
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
__synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930
fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234
process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
INFO: task udevd:4567 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D
stack:25200 pid: 4567 ppid: 3561 flags:0x00004002
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
device_lock include/linux/device.h:764 [inline]
uevent_show+0x17a/0x330 drivers/base/core.c:2408
dev_attr_show+0x50/0xb0 drivers/base/core.c:2110
sysfs_kf_seq_show+0x316/0x4c0 fs/sysfs/file.c:61
seq_read_iter+0x49b/0xd50 fs/seq_file.c:230
call_read_iter include/linux/fs.h:2167 [inline]
new_sync_read fs/read_write.c:404 [inline]
vfs_read+0x759/0xd60 fs/read_write.c:485
ksys_read+0x152/0x260 fs/read_write.c:623
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f7bb58c0407
RSP: 002b:00007ffe299e4030 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f7bb57d2880 RCX: 00007f7bb58c0407
RDX: 0000000000001000 RSI: 00005595f74e3730 RDI: 0000000000000008
RBP: 00007f7bb5a08ff0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
R13: 00007f7bb5a08ea0 R14: 0000000000000000 R15: 00005595f74c98a0
INFO: task udevd:4733 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd state:D
stack:25776 pid: 4733 ppid: 3561 flags:0x00004002
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
synchronize_rcu+0x119/0x1e0 kernel/rcu/tree.c:3802
evdev_detach_client drivers/input/evdev.c:386 [inline]
evdev_release+0x1f3/0x800 drivers/input/evdev.c:449
__fput+0x234/0x930 fs/file_table.c:311
task_work_run+0x125/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f7bb58c0407
RSP: 002b:00007ffe299e7740 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 00007f7bb57d2880 RCX: 00007f7bb58c0407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 00007f7bb57d26e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000016
R13: 00005595c3401f40 R14: 00005595c3401f50 R15: 0000000000100000
INFO: task kworker/1:13:4979 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:13 state:D
stack:24560 pid: 4979 ppid: 2 flags:0x00004000
Workqueue: events tipc_net_finalize_work
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
tipc_net_finalize_work+0x1a/0x90 net/tipc/net.c:148
process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
INFO: task syz.1.461:6177 blocked for more than 146 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.461 state:D
stack:27824 pid: 6177 ppid: 4185 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
__synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930
mmu_notifier_unregister+0x283/0x370 mm/mmu_notifier.c:854
kvm_destroy_vm virt/kvm/kvm_main.c:1237 [inline]
kvm_put_kvm+0xd5f/0x17d0 virt/kvm/kvm_main.c:1283
kvm_vm_release+0x42/0x50 virt/kvm/kvm_main.c:1306
__fput+0x234/0x930 fs/file_table.c:311
task_work_run+0x125/0x1a0 kernel/task_work.c:188
get_signal+0x1222/0x12c0 kernel/signal.c:2672
arch_do_signal_or_restart+0xe7/0x12c0 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:154 [inline]
exit_to_user_mode_loop+0x9e/0x130 kernel/entry/common.c:178
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f4fdfb0edd9
RSP: 002b:00007f4fddd26028 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
RAX: fffffffffffffffe RBX: 00007f4fdfd88180 RCX: 00007f4fdfb0edd9
RDX: 00002000000000c0 RSI: 000000004010ae42 RDI: 0000000000000004
RBP: 00007f4fdfba4d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4fdfd88218 R14: 00007f4fdfd88180 R15: 00007ffd07011bb8
INFO: task syz.2.485:6231 blocked for more than 146 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.485 state:D
stack:26512 pid: 6231 ppid: 4186 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline]
synchronize_rcu_expedited+0x680/0x750 kernel/rcu/tree_exp.h:845
synchronize_rcu+0x119/0x1e0 kernel/rcu/tree.c:3802
packet_release+0x976/0xc30 net/packet/af_packet.c:3175
__sock_release net/socket.c:651 [inline]
sock_close+0xd5/0x240 net/socket.c:1345
__fput+0x234/0x930 fs/file_table.c:311
task_work_run+0x125/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f2017327dd9
RSP: 002b:00007ffd61c9c008 EFLAGS: 00000246
ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f20175a2da0 RCX: 00007f2017327dd9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f20175a2da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007f20175a2cb0 R11: 0000000000000246 R12: 000000000002c992
R13: 00007f20175a118c R14: 000000000002c739 R15: 00007f20175a1180
INFO: task syz.5.488:6241 blocked for more than 147 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.488 state:D
stack:25744 pid: 6241 ppid: 4438 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline]
synchronize_rcu_expedited+0x680/0x750 kernel/rcu/tree_exp.h:845
__tun_detach+0x81f/0x1500 drivers/net/tun.c:670
tun_detach drivers/net/tun.c:702 [inline]
tun_chr_close+0x109/0x1b0 drivers/net/tun.c:3440
__fput+0x234/0x930 fs/file_table.c:311
task_work_run+0x125/0x1a0 kernel/task_work.c:188
tracehook_notify_resume include/linux/tracehook.h:189 [inline]
exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
__syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f56a4e5ddd9
RSP: 002b:00007f56a30b7028 EFLAGS: 00000246
ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f56a50d6fa0 RCX: 00007f56a4e5ddd9
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003
RBP: 00007f56a4ef3d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f56a50d7038 R14: 00007f56a50d6fa0 R15: 00007fff31089ae8
INFO: task syz.3.489:6247 blocked for more than 147 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.489 state:D
stack:28208 pid: 6247 ppid: 4192 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline]
synchronize_rcu_expedited+0x680/0x750 kernel/rcu/tree_exp.h:845
synchronize_rcu+0x119/0x1e0 kernel/rcu/tree.c:3802
__sched_core_enable kernel/sched/core.c:312 [inline]
sched_core_get+0x82/0x1d0 kernel/sched/core.c:331
sched_core_alloc_cookie+0x71/0xa0 kernel/sched/core_sched.c:21
sched_core_share_pid+0x2d8/0x710 kernel/sched/core_sched.c:178
__do_sys_prctl kernel/sys.c:2564 [inline]
__se_sys_prctl+0x17f/0x1050 kernel/sys.c:2298
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fe49d996dd9
RSP: 002b:00007fe49bbae028 EFLAGS: 00000246
ORIG_RAX: 000000000000009d
RAX: ffffffffffffffda RBX: 00007fe49dc10180 RCX: 00007fe49d996dd9
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000003e
RBP: 00007fe49da2cd69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe49dc10218 R14: 00007fe49dc10180 R15: 00007ffece0c7e18
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0:
ffffffff8c31eb20
(
rcu_read_lock
){....}-{1:2}
, at: rcu_lock_acquire+0x0/0x30
4 locks held by kworker/u5:0/146:
#0:
ffff8880206c0938
(
(wq_completion)hci7
#2
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc900016dfd00
(
(work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff88807e678078
(
&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3:
ffffffff8d583928
(
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
1 lock held by acpid/3546:
#0:
ffffffff8c3235a8
(rcu_state.exp_mutex
){+.+.}-{3:3}
, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845
2 locks held by getty/3946:
#0: ffff88814cd82098
(
&tty->ldisc_sem){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
#1:
ffffc90002d032e8
(
&ldata->atomic_read_lock
){+.+.}-{3:3}, at: n_tty_read+0x5df/0x1a70 drivers/tty/n_tty.c:2158
4 locks held by kworker/u5:1/4188:
#0:
ffff8880745ab938
(
(wq_completion)hci8
#2
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc90002f3fd00
(
(work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff88807ae00078
(
&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3: ffffffff8d583928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
#3: ffffffff8d583928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
4 locks held by kworker/u5:2/4195:
#0: ffff88807710c938 ((wq_completion)hci10#2){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1: ffffc90002f9fd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2: ffff888075988078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3: ffffffff8d583928
(
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
4 locks held by kworker/u5:3/4197:
#0:
ffff888076e36138
(
(wq_completion)hci9
#2
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1: ffffc90002fbfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2: ffff888079084078 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3: ffffffff8d583928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
#3: ffffffff8d583928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
4 locks held by kworker/u5:4/4198:
#0: ffff88805b19c938 ((wq_completion)hci14#2){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1: ffffc90002fcfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff88807b85c078
(
&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3:
ffffffff8d583928
(
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
4 locks held by kworker/u5:5/4199:
#0:
ffff888077a64138 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1: ffffc90002fdfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2: ffff888078de4078
(
&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3:
ffffffff8d583928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
ffffffff8d583928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
4 locks held by kworker/u5:6/4200:
#0: ffff8880658e8138 ((wq_completion)hci13#2){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc90002fefd00
(
(work_completion)(&hdev->rx_work)){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff88807aa04078
(
&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3:
ffffffff8d583928
(
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
4 locks held by kworker/u5:7/4201:
#0: ffff88807c67a138
(
(wq_completion)hci15
#2
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc90002fffd00
((work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff88807b858078
(
&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3:
ffffffff8d583928
(
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
4 locks held by kworker/u5:8/4202:
#0:
ffff88807adff938
((wq_completion)hci12
#2
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc9000300fd00
((work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff888077758078
(&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3:
ffffffff8d583928
(hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
9 locks held by kworker/0:8/4273:
2 locks held by kworker/u4:8/4293:
#0:
ffff888016c79138
(
(wq_completion)events_unbound
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc9000337fd00
(
(reaper_work).work
){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
3 locks held by syz-executor/4438:
#0:
ffff88801ea80ff0
(
&hdev->req_lock
){+.+.}-{3:3}
, at: hci_dev_do_close+0x5f/0x1030 net/bluetooth/hci_core.c:1737
#1:
ffff88801ea80078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x3f4/0x1030 net/bluetooth/hci_core.c:1782
#2: ffffffff8d583928 (
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1517 [inline]
, at: hci_conn_hash_flush+0xa4/0x220 net/bluetooth/hci_conn.c:1622
2 locks held by kworker/u4:13/4476:
#0: ffff888016c79138
(
(wq_completion)events_unbound
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc9000329fd00
(connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
4 locks held by udevd/4567:
#0: ffff8880560d40a0 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xad/0xd50 fs/seq_file.c:182
#1: ffff88807709d088
(
&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x51/0x3c0 fs/kernfs/file.c:112
#2:
ffff888024642cb8
(
kn->active
#32
){++++}-{0:0}
, at: kernfs_seq_start+0x71/0x3c0 fs/kernfs/file.c:113
#3: ffff88802aa4e220
(
&dev->mutex
){....}-{3:3}
, at: device_lock include/linux/device.h:764 [inline]
, at: uevent_show+0x17a/0x330 drivers/base/core.c:2408
1 lock held by udevd/4733:
#0: ffffffff8c3235a8
(
rcu_state.exp_mutex
){+.+.}-{3:3}
, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
3 locks held by kworker/1:13/4979:
#0:
ffff888016c70938
((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1: ffffc9000421fd00 ((work_completion)(&tn->work)){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: tipc_net_finalize_work+0x1a/0x90 net/tipc/net.c:148
1 lock held by syz.2.485/6231:
#0:
ffff8880707fc410 (&sb->s_type->i_mutex_key#11
){+.+.}-{3:3}
, at: inode_lock include/linux/fs.h:787 [inline]
, at: __sock_release net/socket.c:650 [inline]
, at: sock_close+0x90/0x240 net/socket.c:1345
1 lock held by syz.5.488/6241:
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline]
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3440
1 lock held by syz.3.489/6247:
#0: ffffffff8c1e0148 (sched_core_mutex){+.+.}-{3:3}
, at: sched_core_get+0x49/0x1d0 kernel/sched/core.c:329
1 lock held by dhcpcd/6249:
#0:
ffff888055a8c120
(
sk_lock-AF_PACKET
){+.+.}-{0:0}
, at: lock_sock include/net/sock.h:1744 [inline]
, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by syz.0.490/6253:
#0:
ffffffff8c1e0148
(
sched_core_mutex
){+.+.}-{3:3}
, at: sched_core_get+0x49/0x1d0 kernel/sched/core.c:329
1 lock held by dhcpcd/6255:
#0:
ffff88805c5c8120
(sk_lock-AF_PACKET
){+.+.}-{0:0}
, at: lock_sock include/net/sock.h:1744 [inline]
, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by dhcpcd/6256:
#0: ffff88802093e120
(
sk_lock-AF_PACKET){+.+.}-{0:0}
, at: lock_sock include/net/sock.h:1744 [inline]
, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by dhcpcd/6257:
#0: ffff888058e7c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
#0: ffff888058e7c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by syz-executor/6259:
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6262:
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6265:
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6268:
#0:
ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6271:
#0:
ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by dhcpcd/6273:
#0:
ffff8880759e8120
(
sk_lock-AF_PACKET
){+.+.}-{0:0}
, at: lock_sock include/net/sock.h:1744 [inline]
, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by dhcpcd/6274:
#0: ffff888056bb0120
(
sk_lock-AF_PACKET
){+.+.}-{0:0}
, at: lock_sock include/net/sock.h:1744 [inline]
, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by dhcpcd/6275:
#0: ffff88807e9a2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
#0: ffff88807e9a2120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by dhcpcd/6276:
#0: ffff888072e6c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
#0: ffff888072e6c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by dhcpcd/6277:
#0:
ffff888072e80120
(
sk_lock-AF_PACKET
){+.+.}-{0:0}
, at: lock_sock include/net/sock.h:1744 [inline]
, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by dhcpcd/6278:
#0:
ffff888074776120
(
sk_lock-AF_PACKET
){+.+.}-{0:0}
, at: lock_sock include/net/sock.h:1744 [inline]
, at: packet_do_bind+0x35/0xda0 net/packet/af_packet.c:3213
1 lock held by syz-executor/6280:
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6283:
#0: ffffffff8d43d408
(rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6286:
#0:
ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6289:
#0:
ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6292:
#0:
ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
4 locks held by kworker/u5:9/6293:
#0:
ffff88807c252138
(
(wq_completion)hci17
#2
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc9000423fd00
(
(work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2: ffff88807cf9c078
(
&hdev->lock
){+.+.}-{3:3}, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3: ffffffff8d583928 (
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
1 lock held by syz-executor/6296:
#0:
ffffffff8d43d408
(rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/6300:
#0:
ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
4 locks held by kworker/u5:11/6301:
#0:
ffff888054b35138
(
(wq_completion)hci16
#2
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc900042bfd00
(
(work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff888062818078
(
&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3:
ffffffff8d583928
(
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
1 lock held by syz-executor/6304:
#0: ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
4 locks held by kworker/u5:12/6305:
#0: ffff888028d08138 ((wq_completion)hci18#2){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc900042dfd00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff88807cf98078
(
&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3: ffffffff8d583928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
#3: ffffffff8d583928 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
1 lock held by syz-executor/6308:
#0:
ffffffff8d43d408
(
rtnl_mutex
){+.+.}-{3:3}
, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
4 locks held by kworker/u5:13/6309:
#0:
ffff8880256fb938
(
(wq_completion)hci19
#2
){+.+.}-{0:0}
, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
#1:
ffffc900042ffd00
((work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
#2:
ffff888023b34078
(
&hdev->lock
){+.+.}-{3:3}
, at: hci_remote_features_evt+0xba/0xa40 net/bluetooth/hci_event.c:3339
#3:
ffffffff8d583928
(
hci_cb_list_lock
){+.+.}-{3:3}
, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1502 [inline]
, at: hci_remote_features_evt+0x5f5/0xa40 net/bluetooth/hci_event.c:3372
1 lock held by syz-executor/6312:
#0:
ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
ffffffff8d43d408 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xe0f/0xe50 kernel/hung_task.c:369
kthread+0x436/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0