INFO: task syz.2.338:5361 blocked for more than 431 seconds.
      Not tainted 6.13.0-rc2-syzkaller-g21f1b85c8912 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.338       state:D stack:0     pid:5361  tgid:5360  ppid:4196   flags:0x0000000c
Call Trace:
[<ffffffff861cbf70>] context_switch kernel/sched/core.c:5369 [inline]
[<ffffffff861cbf70>] __schedule+0xdaa/0x393a kernel/sched/core.c:6756
[<ffffffff861cebc4>] __schedule_loop kernel/sched/core.c:6833 [inline]
[<ffffffff861cebc4>] schedule+0xc4/0x324 kernel/sched/core.c:6848
[<ffffffff861cf50c>] schedule_preempt_disabled+0x16/0x28 kernel/sched/core.c:6905
[<ffffffff861d8780>] rwsem_down_read_slowpath+0x56a/0x91e kernel/locking/rwsem.c:1084
[<ffffffff861d91d2>] __down_read_common kernel/locking/rwsem.c:1248 [inline]
[<ffffffff861d91d2>] __down_read kernel/locking/rwsem.c:1261 [inline]
[<ffffffff861d91d2>] down_read+0xe4/0x45e kernel/locking/rwsem.c:1526
[<ffffffff80143da2>] mmap_read_lock include/linux/mmap_lock.h:144 [inline]
[<ffffffff80143da2>] exit_mm kernel/exit.c:546 [inline]
[<ffffffff80143da2>] do_exit+0x810/0x296e kernel/exit.c:925
[<ffffffff80146460>] do_group_exit+0xd4/0x26c kernel/exit.c:1087
[<ffffffff8017cf9e>] get_signal+0x1f4c/0x22de kernel/signal.c:3017
[<ffffffff8006b8c4>] arch_do_signal_or_restart+0xa3c/0x1d2c arch/riscv/kernel/signal.c:437
[<ffffffff861c30c4>] exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
[<ffffffff861c30c4>] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
[<ffffffff861c30c4>] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
[<ffffffff861c30c4>] syscall_exit_to_user_mode+0x29e/0x316 kernel/entry/common.c:218
[<ffffffff861c1e8a>] do_trap_ecall_u+0x86/0x216 arch/riscv/kernel/traps.c:345
[<ffffffff861e652a>] _new_vmalloc_restore_context_a0+0xc2/0xce

Showing all locks held in the system:
1 lock held by kthreadd/2:
2 locks held by kworker/1:0/25:
 #0: ff6000005cdf4a58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:598 [inline]
 #0: ff6000005cdf4a58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock kernel/sched/sched.h:1514 [inline]
 #0: ff6000005cdf4a58 (&rq->__lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1813 [inline]
 #0: ff6000005cdf4a58 (&rq->__lock){-.-.}-{2:2}, at: __schedule+0x278/0x393a kernel/sched/core.c:6680
 #1: ff6000005cde0688 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x22c/0x71a kernel/sched/psi.c:987
5 locks held by kworker/u9:0/28:
1 lock held by khungtaskd/38:
 #0: ffffffff881d0c40 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x68/0x2e6 kernel/locking/lockdep.c:6740
4 locks held by kworker/u9:4/1028:
 #0: ff600000211bc948 ((wq_completion)wg-kex-wg1#5){+.+.}-{0:0}, at: process_one_work+0x848/0x1f38 kernel/workqueue.c:3204
 #1: ff20000003147c90 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x870/0x1f38 kernel/workqueue.c:3204
 #2: ff6000001b59d2c8 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xe4/0x5f0 drivers/net/wireguard/noise.c:529
 #3: ff6000002f1958b8 (&handshake->lock){++++}-{4:4}, at: __debug_check_no_obj_freed lib/debugobjects.c:1088 [inline]
 #3: ff6000002f1958b8 (&handshake->lock){++++}-{4:4}, at: debug_check_no_obj_freed+0x188/0x4fc lib/debugobjects.c:1129
2 locks held by jbd2/vda-8/2955:
1 lock held by klogd/2978:
1 lock held by dhcpcd/3021:
2 locks held by getty/3131:
 #0: ff60000018b030a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3a/0x46 drivers/tty/tty_ldsem.c:340
 #1: ff2000000008b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0xd7c/0x129a drivers/tty/n_tty.c:2211
2 locks held by sshd/3152:
2 locks held by syz-executor/3154:
1 lock held by syz-executor/3161:
 #0: ffffffff881e1238 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x266/0x384 kernel/rcu/tree_exp.h:297
2 locks held by kworker/u9:5/3245:
5 locks held by kworker/0:3/3780:
3 locks held by kworker/u10:2/3812:
2 locks held by kworker/0:4/3853:
2 locks held by kworker/0:5/3994:
1 lock held by syz-executor/4196:
4 locks held by kworker/1:2/4747:
 #0: ff6000001bbd2948 ((wq_completion)wg-kex-wg1#6){+.+.}-{0:0}, at: process_one_work+0x848/0x1f38 kernel/workqueue.c:3204
 #1: ff2000000d367c90 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"(({ unsigned long __pcpu_ptr = ( unsigned long)((worker)); (typeof(*((worker))) *)(__pcpu_ptr); }))); (typeof(({ unsigned long __pcpu_ptr = ( unsigned long)((worker)); (typeof(*((worker))) *)(__pcpu_ptr); }))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x870/0x1f38 kernel/workqueue.c:3204
 #2: ff6000001b59d2c8 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x12c/0x904 drivers/net/wireguard/noise.c:598
 #3: ff6000002f1958b8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x4b4/0x904 drivers/net/wireguard/noise.c:632
3 locks held by kworker/u9:1/4775:
2 locks held by kworker/1:4/4821:
3 locks held by kworker/u9:3/5286:
2 locks held by syz.2.338/5360:
1 lock held by syz.2.338/5361:
 #0: ff6000001ddba4d0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:144 [inline]
 #0: ff6000001ddba4d0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm kernel/exit.c:546 [inline]
 #0: ff6000001ddba4d0 (&mm->mmap_lock){++++}-{4:4}, at: do_exit+0x810/0x296e kernel/exit.c:925
1 lock held by syz.2.338/5362:
 #0: ff6000001ddba4d0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:144 [inline]
 #0: ff6000001ddba4d0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mm kernel/exit.c:546 [inline]
 #0: ff6000001ddba4d0 (&mm->mmap_lock){++++}-{4:4}, at: do_exit+0x810/0x296e kernel/exit.c:925

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Not tainted 6.13.0-rc2-syzkaller-g21f1b85c8912 #0
Hardware name: riscv-virtio,qemu (DT)
Call Trace:
[<ffffffff80071bae>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:130
[<ffffffff8000325c>] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:136
[<ffffffff8005e1f4>] __dump_stack lib/dump_stack.c:94 [inline]
[<ffffffff8005e1f4>] dump_stack_lvl+0x12e/0x1a6 lib/dump_stack.c:120
[<ffffffff8005e288>] dump_stack+0x1c/0x24 lib/dump_stack.c:129
[<ffffffff86185c28>] nmi_cpu_backtrace+0x3b0/0x3b2 lib/nmi_backtrace.c:113
[<ffffffff86185ee0>] nmi_trigger_cpumask_backtrace+0x2b6/0x458 lib/nmi_backtrace.c:62
[<ffffffff8007c972>] arch_trigger_cpumask_backtrace+0x2c/0x3e arch/riscv/kernel/smp.c:347
[<ffffffff804b88b8>] trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
[<ffffffff804b88b8>] check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
[<ffffffff804b88b8>] watchdog+0xcee/0x1170 kernel/hung_task.c:397
[<ffffffff801c6f2c>] kthread+0x28c/0x3a4 kernel/kthread.c:389
[<ffffffff861e6642>] ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:326
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 17 Comm: rcu_preempt Not tainted 6.13.0-rc2-syzkaller-g21f1b85c8912 #0
Hardware name: riscv-virtio,qemu (DT)
epc : __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
epc : _raw_spin_unlock_irqrestore+0x36/0xd4 kernel/locking/spinlock.c:194
 ra : __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
 ra : _raw_spin_unlock_irqrestore+0x86/0xd4 kernel/locking/spinlock.c:194
epc : ffffffff861e4106 ra : ffffffff861e4156 sp : ff200000000078a0
 gp : ffffffff899f4f80 tp : ff60000012e80000 t0 : 77f120be1e7495cd
 t1 : fffffffef219a18f t2 : 0000000000000000 s0 : ff200000000078c0
 s1 : 0000000000000002 a0 : 0000000000000000 a1 : ffffffff8663f920
 a2 : 0000000000000003 a3 : 0000000000000101 a4 : 0000000000000001
 a5 : 0000000000000000 a6 : 0000000000f00000 a7 : ffffffff90cd0c7b
 s2 : ffffffff90cd0c78 s3 : dead000000000100 s4 : dead000000000122
 s5 : dfffffff00000000 s6 : ff600000579d9e60 s7 : ff600000579d9e40
 s8 : 0000000000000010 s9 : 0000000000000010 s10: ff600000579d9e60
 s11: ff600000579d9000 t3 : ff60000012e80b20 t4 : fffffffef219a18f
 t5 : fffffffef219a190 t6 : 000000000000000f
status: 0000000200000120 badaddr: 0000000000000000 cause: 8000000000000001
[<ffffffff861e4106>] arch_local_irq_restore arch/riscv/include/asm/irqflags.h:51 [inline]
[<ffffffff861e4106>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
[<ffffffff861e4106>] _raw_spin_unlock_irqrestore+0x36/0xd4 kernel/locking/spinlock.c:194
[<ffffffff8162933a>] __debug_check_no_obj_freed lib/debugobjects.c:1108 [inline]
[<ffffffff8162933a>] debug_check_no_obj_freed+0x26a/0x4fc lib/debugobjects.c:1129
[<ffffffff8097e554>] slab_free_hook mm/slub.c:2269 [inline]
[<ffffffff8097e554>] slab_free mm/slub.c:4598 [inline]
[<ffffffff8097e554>] kfree+0x2e0/0x50c mm/slub.c:4746
[<ffffffff8189729c>] ref_tracker_free+0x350/0x794 lib/ref_tracker.c:272
[<ffffffff84f4ec0a>] netdev_tracker_free include/linux/netdevice.h:4156 [inline]
[<ffffffff84f4ec0a>] netdev_put include/linux/netdevice.h:4173 [inline]
[<ffffffff84f4ec0a>] dst_destroy+0xfc/0x3cc net/core/dst.c:114
[<ffffffff84f4eef6>] dst_destroy_rcu+0x1c/0x2e net/core/dst.c:132
[<ffffffff80354378>] rcu_do_batch kernel/rcu/tree.c:2567 [inline]
[<ffffffff80354378>] rcu_core+0xa24/0x1ea0 kernel/rcu/tree.c:2823
[<ffffffff80355c02>] rcu_core_si+0xc/0x14 kernel/rcu/tree.c:2840
[<ffffffff8014ce16>] handle_softirqs+0x4b2/0x132e kernel/softirq.c:554
[<ffffffff8014df62>] __do_softirq kernel/softirq.c:588 [inline]
[<ffffffff8014df62>] invoke_softirq kernel/softirq.c:428 [inline]
[<ffffffff8014df62>] __irq_exit_rcu+0x18c/0x550 kernel/softirq.c:655
[<ffffffff8014f31c>] irq_exit_rcu+0x10/0xf8 kernel/softirq.c:671
[<ffffffff861c1858>] handle_riscv_irq+0x40/0x4c arch/riscv/kernel/traps.c:378
[<ffffffff861e667e>] call_on_irq_stack+0x32/0x40 arch/riscv/kernel/entry.S:355