INFO: task dhcpcd:3917 blocked for more than 143 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:20648 pid:3917 ppid:3916 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747 devinet_ioctl+0x2a5/0x1ae0 net/ipv4/devinet.c:1081 inet_ioctl+0x32d/0x400 net/ipv4/af_inet.c:1008 sock_do_ioctl+0x152/0x450 net/socket.c:1204 sock_ioctl+0x47f/0x770 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f78e3472d49 RSP: 002b:00007ffd5248d2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f78e33a46c0 RCX: 00007f78e3472d49 RDX: 00007ffd5249d4e8 RSI: 0000000000008914 RDI: 000000000000001c RBP: 00007ffd524ad6a8 R08: 00007ffd5249d4a8 R09: 00007ffd5249d458 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd5249d4e8 R14: 0000000000000028 R15: 0000000000008914 INFO: task syz-executor:4267 blocked for more than 144 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20560 pid:4267 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x819/0x930 kernel/rcu/tree_exp.h:962 namespace_unlock+0x297/0x4d0 fs/namespace.c:1497 do_umount fs/namespace.c:1720 [inline] path_umount+0xe78/0xef0 fs/namespace.c:1802 ksys_umount fs/namespace.c:1825 [inline] __do_sys_umount fs/namespace.c:1830 [inline] __se_sys_umount fs/namespace.c:1828 [inline] __x64_sys_umount+0x122/0x170 fs/namespace.c:1828 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7facec387057 RSP: 002b:00007ffee8fe5d48 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: ffffffffffffffda RBX: 00007facec4018f4 RCX: 00007facec387057 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffee8fe5e00 RBP: 00007ffee8fe5e00 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffee8fe6e80 R13: 00007facec4018f4 R14: 00007ffee8fe6ec0 R15: 0000000000000038 INFO: task kworker/0:4:4298 blocked for more than 144 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:4 state:D stack:23032 pid:4298 ppid:2 flags:0x00004000 Workqueue: events free_ipc Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x819/0x930 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x11c/0x3f0 kernel/rcu/tree.c:3576 kern_unmount+0x52/0xf0 fs/namespace.c:4490 free_ipc_ns ipc/namespace.c:138 [inline] free_ipc+0x6c/0x1d0 ipc/namespace.c:159 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/0:8:4347 blocked for more than 145 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:8 state:D stack:23800 pid:4347 ppid:2 flags:0x00004000 Workqueue: events rfkill_global_led_trigger_worker Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747 rfkill_global_led_trigger_worker+0x23/0xd0 net/rfkill/core.c:181 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:10:4383 blocked for more than 145 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:10 state:D stack:24152 pid:4383 ppid:2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747 linkwatch_event+0xa/0x50 net/core/link_watch.c:263 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:11:4386 blocked for more than 146 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:11 state:D stack:24416 pid:4386 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_timeout+0xac/0x300 kernel/time/timer.c:1941 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x350/0x610 kernel/sched/completion.c:138 __synchronize_srcu+0x2b7/0x360 kernel/rcu/srcutree.c:1243 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor:4562 blocked for more than 146 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20760 pid:4562 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x819/0x930 kernel/rcu/tree_exp.h:962 namespace_unlock+0x297/0x4d0 fs/namespace.c:1497 do_umount fs/namespace.c:1720 [inline] path_umount+0xe78/0xef0 fs/namespace.c:1802 ksys_umount fs/namespace.c:1825 [inline] __do_sys_umount fs/namespace.c:1830 [inline] __se_sys_umount fs/namespace.c:1828 [inline] __x64_sys_umount+0x122/0x170 fs/namespace.c:1828 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7ce3787057 RSP: 002b:00007fff949812b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: ffffffffffffffda RBX: 00007f7ce38018f4 RCX: 00007f7ce3787057 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff94981370 RBP: 00007fff94981370 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff949823f0 R13: 00007f7ce38018f4 R14: 00007fff94982430 R15: 0000000000000021 INFO: task kworker/u4:15:4634 blocked for more than 146 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:15 state:D stack:22624 pid:4634 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_timeout+0xac/0x300 kernel/time/timer.c:1941 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x350/0x610 kernel/sched/completion.c:138 __synchronize_srcu+0x2b7/0x360 kernel/rcu/srcutree.c:1243 fsnotify_mark_destroy_workfn+0x142/0x340 fs/notify/mark.c:924 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/0:12:5126 blocked for more than 147 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:12 state:D stack:20128 pid:5126 ppid:2 flags:0x00004000 Workqueue: events rfkill_op_handler Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] synchronize_rcu_expedited+0x360/0x930 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x11c/0x3f0 kernel/rcu/tree.c:3576 ieee80211_ibss_leave+0xdd/0x130 net/mac80211/ibss.c:1881 rdev_leave_ibss net/wireless/rdev-ops.h:561 [inline] __cfg80211_leave_ibss+0x1dd/0x470 net/wireless/ibss.c:211 cfg80211_leave net/wireless/core.c:1343 [inline] cfg80211_netdev_notifier_call+0x4ed/0x1530 net/wireless/core.c:1505 notifier_call_chain kernel/notifier.c:87 [inline] raw_notifier_call_chain+0xd0/0x170 kernel/notifier.c:455 call_netdevice_notifiers_info net/core/dev.c:1970 [inline] call_netdevice_notifiers_extack net/core/dev.c:2008 [inline] call_netdevice_notifiers net/core/dev.c:2022 [inline] __dev_close_many+0x1e3/0x3c0 net/core/dev.c:1515 dev_close_many+0x22a/0x530 net/core/dev.c:1566 dev_close+0x1b3/0x2b0 net/core/dev.c:1592 cfg80211_shutdown_all_interfaces+0xb7/0x1c0 net/wireless/core.c:275 cfg80211_rfkill_set_block+0x29/0x40 net/wireless/core.c:307 rfkill_set_block+0x1e7/0x430 net/rfkill/core.c:345 rfkill_epo+0x7c/0x180 net/rfkill/core.c:454 __rfkill_handle_global_op net/rfkill/input.c:60 [inline] rfkill_op_handler+0x7e/0x260 net/rfkill/input.c:108 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz.6.214:5534 blocked for more than 147 seconds. Not tainted 6.1.123-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.6.214 state:D stack:24664 pid:5534 ppid:4782 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5241 [inline] __schedule+0x143f/0x4570 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 synchronize_rcu_expedited+0x777/0x930 kernel/rcu/tree_exp.h:977 packet_release+0x9b8/0xca0 net/packet/af_packet.c:3227 __sock_release net/socket.c:654 [inline] sock_close+0xcd/0x230 net/socket.c:1400 __fput+0x3f6/0x8d0 fs/file_table.c:320 task_work_run+0x246/0x300 kernel/task_work.c:203 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xde/0x100 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fcbb7b85d29 RSP: 002b:00007ffd29c3c518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007fcbb7d77ba0 RCX: 00007fcbb7b85d29 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007fcbb7d77ba0 R08: 0000000000000214 R09: 00007ffd29c3c80f R10: 00000000003ffbc8 R11: 0000000000000246 R12: 000000000002dc2a R13: 00007fcbb7d76080 R14: 0000000000000032 R15: ffffffffffffffff Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8d32b290 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8d32ba90 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:517 1 lock held by khungtaskd/27: #0: ffffffff8d32b0c0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8d32b0c0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8d32b0c0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6510 3 locks held by kworker/u4:2/32: #0: ffff888056066138 ((wq_completion)phy6){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90000a97d20 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffff888056104d40 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1113 [inline] #2: ffff888056104d40 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0xa0/0x1480 net/mac80211/ibss.c:1680 1 lock held by dhcpcd/3917: #0: ffffffff8e50b428 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2a5/0x1ae0 net/ipv4/devinet.c:1081 2 locks held by getty/4010: #0: ffff88814d197098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000325e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a7/0x1db0 drivers/tty/n_tty.c:2198 2 locks held by kworker/0:4/4298: #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90003fc7d20 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 3 locks held by kworker/0:5/4300: #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90003fe7d20 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e50b428 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104 3 locks held by kworker/0:8/4347: #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90004147d20 ((work_completion)(&rfkill_global_led_trigger_work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_global_led_trigger_worker+0x23/0xd0 net/rfkill/core.c:181 4 locks held by kworker/u4:8/4348: #0: ffff8880771dc938 ((wq_completion)phy7){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc900044b7d20 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffff888056280d40 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1113 [inline] #2: ffff888056280d40 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0xa0/0x1480 net/mac80211/ibss.c:1680 #3: ffff8880790e9780 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_sta_expire net/mac80211/ibss.c:1256 [inline] #3: ffff8880790e9780 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_sta_merge_ibss net/mac80211/ibss.c:1299 [inline] #3: ffff8880790e9780 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0x4cc/0x1480 net/mac80211/ibss.c:1708 5 locks held by kworker/1:7/4366: 3 locks held by kworker/u4:10/4383: #0: ffff888017c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc900046b7d20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e50b428 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263 2 locks held by kworker/u4:11/4386: #0: ffff888017c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc900046d7d20 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 2 locks held by kworker/u4:15/4634: #0: ffff888017c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90003457d20 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 3 locks held by kworker/0:11/5125: #0: ffff88814cd36938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90003927d20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e50b428 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4675 7 locks held by kworker/0:12/5126: #0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90003987d20 ((rfkill_op_work).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_epo+0x47/0x180 net/rfkill/core.c:450 #3: ffffffff8e50b428 (rtnl_mutex){+.+.}-{3:3}, at: cfg80211_rfkill_set_block+0x1a/0x40 net/wireless/core.c:306 #4: ffff8880560c07c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: wiphy_lock include/net/cfg80211.h:5639 [inline] #4: ffff8880560c07c8 (&rdev->wiphy.mtx){+.+.}-{3:3}, at: cfg80211_netdev_notifier_call+0x4d4/0x1530 net/wireless/core.c:1504 #5: ffff888056104d40 (&wdev->mtx){+.+.}-{3:3}, at: wdev_lock net/wireless/core.h:231 [inline] #5: ffff888056104d40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_leave net/wireless/core.c:1342 [inline] #5: ffff888056104d40 (&wdev->mtx){+.+.}-{3:3}, at: cfg80211_netdev_notifier_call+0x4e2/0x1530 net/wireless/core.c:1505 #6: ffffffff8d3306b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #6: ffffffff8d3306b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x360/0x930 kernel/rcu/tree_exp.h:962 3 locks held by kworker/0:13/5129: #0: ffff888017c71938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90003957d20 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e50b428 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x8d/0xdb0 net/wireless/reg.c:2498 2 locks held by syz.6.214/5534: #0: ffff88807459ca10 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88807459ca10 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff88807459ca10 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: sock_close+0x98/0x230 net/socket.c:1400 #1: ffffffff8d3306b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #1: ffffffff8d3306b8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x360/0x930 kernel/rcu/tree_exp.h:962 2 locks held by syz-executor/5562: #0: ffff888056872118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5566: #0: ffff88807c26a918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5567: #0: ffff888071c5e918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5570: #0: ffff888079210118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5571: #0: ffff88807fb24118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5573: #0: ffff888073420118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5577: #0: ffff8880743e8118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5579: #0: ffff8880561b4118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5581: #0: ffff88805570e118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5582: #0: ffff88805570c918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5584: #0: ffff888055d7e918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5588: #0: ffff88807a252918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5590: #0: ffff8880791c1118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5593: #0: ffff888075ab1918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 2 locks held by syz-executor/5594: #0: ffff888071e11118 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x700 drivers/bluetooth/hci_vhci.c:378 #1: ffffffff8e7badc8 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1057 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 6.1.123-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 nmi_cpu_backtrace+0x4e1/0x560 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1ae/0x3f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xf88/0xfd0 kernel/hung_task.c:377 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 4366 Comm: kworker/1:7 Not tainted 6.1.123-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: usb_hub_wq hub_event RIP: 0010:stack_trace_consume_entry+0x0/0x270 kernel/stacktrace.c:83 Code: ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 7b ff ff ff 48 89 df e8 00 d8 69 00 e9 6e ff ff ff e8 76 0d 3a 09 66 0f 1f 44 00 00 <55> 41 57 41 56 41 55 41 54 53 48 83 ec 18 48 89 fb 48 ba 00 00 00 RSP: 0018:ffffc900040c65d8 EFLAGS: 00000286 RAX: ffffffff867652dd RBX: ffffc900040c65e0 RCX: ffffffff8fdd4000 RDX: ffffffff8ff2e701 RSI: ffffffff867652dd RDI: ffffc900040c66c0 RBP: ffffc900040c6670 R08: ffffc900040c7790 R09: ffffc900040c6630 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88807c8c3b80 R13: ffffffff81785810 R14: ffffc900040c66c0 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055ef0951d708 CR3: 000000000d08e000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0x101/0x140 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:383 kmalloc include/linux/slab.h:563 [inline] dummy_urb_enqueue+0x79/0x770 drivers/usb/gadget/udc/dummy_hcd.c:1273 usb_hcd_submit_urb+0x368/0x1de0 drivers/usb/core/hcd.c:1560 ath6kl_usb_post_recv_transfers+0x3ef/0x6c0 drivers/net/wireless/ath/ath6kl/usb.c:450 ath6kl_usb_start_recv_pipes drivers/net/wireless/ath/ath6kl/usb.c:498 [inline] hif_start drivers/net/wireless/ath/ath6kl/usb.c:703 [inline] ath6kl_usb_power_on+0x69/0x270 drivers/net/wireless/ath/ath6kl/usb.c:1062 ath6kl_hif_power_on drivers/net/wireless/ath/ath6kl/hif-ops.h:136 [inline] ath6kl_core_init+0x1b9/0x1120 drivers/net/wireless/ath/ath6kl/core.c:97 ath6kl_usb_probe+0x1233/0x1320 drivers/net/wireless/ath/ath6kl/usb.c:1168 usb_probe_interface+0x5c0/0xaf0 drivers/usb/core/driver.c:396 really_probe+0x2ab/0xcb0 drivers/base/dd.c:639 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:785 driver_probe_device+0x50/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2cf/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x183/0x200 drivers/base/bus.c:429 __device_attach+0x359/0x570 drivers/base/dd.c:1015 bus_probe_device+0xba/0x1e0 drivers/base/bus.c:489 device_add+0xb48/0xfd0 drivers/base/core.c:3696 usb_set_configuration+0x19dd/0x2020 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x84/0x140 drivers/usb/core/generic.c:238 usb_probe_device+0x130/0x260 drivers/usb/core/driver.c:293 really_probe+0x2ab/0xcb0 drivers/base/dd.c:639 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:785 driver_probe_device+0x50/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2cf/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x183/0x200 drivers/base/bus.c:429 __device_attach+0x359/0x570 drivers/base/dd.c:1015 bus_probe_device+0xba/0x1e0 drivers/base/bus.c:489 device_add+0xb48/0xfd0 drivers/base/core.c:3696 usb_new_device+0xbdd/0x18f0 drivers/usb/core/hub.c:2620 hub_port_connect drivers/usb/core/hub.c:5477 [inline] hub_port_connect_change drivers/usb/core/hub.c:5617 [inline] port_event drivers/usb/core/hub.c:5773 [inline] hub_event+0x2efe/0x5730 drivers/usb/core/hub.c:5855 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295