INFO: task kworker/0:1:13 blocked for more than 143 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:1 state:D stack:22624 pid: 13 ppid: 2 flags:0x00004000 Workqueue: events rfkill_sync_work Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 device_lock include/linux/device.h:760 [inline] nfc_dev_down net/nfc/core.c:143 [inline] nfc_rfkill_set_block+0x4c/0x2f0 net/nfc/core.c:179 rfkill_set_block+0x1e7/0x430 net/rfkill/core.c:345 rfkill_sync_work+0x8a/0xe0 net/rfkill/core.c:1030 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/0:3:2303 blocked for more than 143 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:3 state:D stack:21152 pid: 2303 ppid: 2 flags:0x00004000 Workqueue: usb_hub_wq hub_event Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rfkill_register+0x30/0x880 net/rfkill/core.c:1045 hci_register_dev+0x4dd/0xa50 net/bluetooth/hci_core.c:3960 btusb_probe+0x296f/0x2c40 drivers/bluetooth/btusb.c:4093 usb_probe_interface+0x5c0/0xaf0 drivers/usb/core/driver.c:396 really_probe+0x24e/0xb60 drivers/base/dd.c:595 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:755 driver_probe_device+0x50/0x420 drivers/base/dd.c:785 __device_attach_driver+0x2b9/0x500 drivers/base/dd.c:907 bus_for_each_drv+0x183/0x200 drivers/base/bus.c:429 __device_attach+0x359/0x570 drivers/base/dd.c:979 bus_probe_device+0xba/0x1e0 drivers/base/bus.c:489 device_add+0xb48/0xfd0 drivers/base/core.c:3412 usb_set_configuration+0x19dd/0x2020 drivers/usb/core/message.c:2165 usb_generic_driver_probe+0x84/0x140 drivers/usb/core/generic.c:238 usb_probe_device+0x130/0x260 drivers/usb/core/driver.c:293 really_probe+0x24e/0xb60 drivers/base/dd.c:595 __driver_probe_device+0x1a2/0x3d0 drivers/base/dd.c:755 driver_probe_device+0x50/0x420 drivers/base/dd.c:785 __device_attach_driver+0x2b9/0x500 drivers/base/dd.c:907 bus_for_each_drv+0x183/0x200 drivers/base/bus.c:429 __device_attach+0x359/0x570 drivers/base/dd.c:979 bus_probe_device+0xba/0x1e0 drivers/base/bus.c:489 device_add+0xb48/0xfd0 drivers/base/core.c:3412 usb_new_device+0xc17/0x18e0 drivers/usb/core/hub.c:2593 hub_port_connect drivers/usb/core/hub.c:5455 [inline] hub_port_connect_change drivers/usb/core/hub.c:5595 [inline] port_event drivers/usb/core/hub.c:5741 [inline] hub_event+0x2cdf/0x54c0 drivers/usb/core/hub.c:5823 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task udevd:4158 blocked for more than 143 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:udevd state:D stack:24832 pid: 4158 ppid: 3546 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 device_lock include/linux/device.h:760 [inline] uevent_show+0x17e/0x340 drivers/base/core.c:2408 dev_attr_show+0x50/0xb0 drivers/base/core.c:2110 sysfs_kf_seq_show+0x313/0x4e0 fs/sysfs/file.c:61 seq_read_iter+0x43a/0xd10 fs/seq_file.c:230 call_read_iter include/linux/fs.h:2168 [inline] new_sync_read fs/read_write.c:404 [inline] vfs_read+0xa93/0xe10 fs/read_write.c:485 ksys_read+0x1a2/0x2c0 fs/read_write.c:623 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f7bdb823b6a RSP: 002b:00007fff4a50ae08 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 0000556968b2dea0 RCX: 00007f7bdb823b6a RDX: 0000000000001000 RSI: 0000556968af2690 RDI: 0000000000000008 RBP: 0000556968b2dea0 R08: 0000000000000008 R09: 0000000000000008 R10: 000000000000010f R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000003fff R14: 00007fff4a50b2e8 R15: 000000000000000a INFO: task syz-executor:4169 blocked for more than 144 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20792 pid: 4169 ppid: 1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rfkill_unregister+0xcc/0x220 net/rfkill/core.c:1118 hci_unregister_dev+0x42a/0x580 net/bluetooth/hci_core.c:4057 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345 __fput+0x3fe/0x8e0 fs/file_table.c:280 task_work_run+0x129/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x6a3/0x2480 kernel/exit.c:874 do_group_exit+0x144/0x310 kernel/exit.c:996 get_signal+0xc66/0x14e0 kernel/signal.c:2900 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fb30baaaf97 RSP: 002b:00007fff15877460 EFLAGS: 00000293 ORIG_RAX: 000000000000003d RAX: fffffffffffffe00 RBX: 0000000000000033 RCX: 00007fb30baaaf97 RDX: 0000000040000000 RSI: 00007fff158774bc RDI: 00000000ffffffff RBP: 00007fff158774bc R08: 0000000000000000 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 000055558a052590 R14: 00007fff15877510 R15: 0000000000000010 INFO: task syz-executor:4312 blocked for more than 144 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:20504 pid: 4312 ppid: 1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rfkill_unregister+0xcc/0x220 net/rfkill/core.c:1118 hci_unregister_dev+0x42a/0x580 net/bluetooth/hci_core.c:4057 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:345 __fput+0x3fe/0x8e0 fs/file_table.c:280 task_work_run+0x129/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x6a3/0x2480 kernel/exit.c:874 do_group_exit+0x144/0x310 kernel/exit.c:996 get_signal+0xc66/0x14e0 kernel/signal.c:2900 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f23f97bef97 RSP: 002b:00007ffd00062eb0 EFLAGS: 00000293 ORIG_RAX: 000000000000003d RAX: fffffffffffffe00 RBX: 000000000000001b RCX: 00007f23f97bef97 RDX: 0000000040000000 RSI: 00007ffd00062f0c RDI: 00000000ffffffff RBP: 00007ffd00062f0c R08: 0000000000000000 R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 000055558ed97590 R14: 00007ffd00062f60 R15: 0000000000000007 INFO: task syz.4.73:4725 blocked for more than 144 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.73 state:D stack:24632 pid: 4725 ppid: 4169 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rfkill_fop_release+0x49/0x220 net/rfkill/core.c:1300 __fput+0x3fe/0x8e0 fs/file_table.c:280 task_work_run+0x129/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x6a3/0x2480 kernel/exit.c:874 do_group_exit+0x144/0x310 kernel/exit.c:996 get_signal+0xc66/0x14e0 kernel/signal.c:2900 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fb30bab492b RSP: 002b:00007fb309922f10 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffffffffc RBX: 0000000000000007 RCX: 00007fb30bab492b RDX: 00007fb309923fe0 RSI: 0000000080085502 RDI: 0000000000000007 RBP: 00007fb309923fe0 R08: 0000000000000080 R09: 00007fb309922fd8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000080085502 R13: 0000000800000000 R14: 0000000000000008 R15: 00007fb30bb3ad68 INFO: task syz.5.79:4777 blocked for more than 145 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.5.79 state:D stack:22544 pid: 4777 ppid: 4312 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_timeout+0xac/0x300 kernel/time/timer.c:1890 do_wait_for_common+0x2d9/0x480 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __flush_work+0x124/0x1a0 kernel/workqueue.c:3094 __cancel_work_timer+0x519/0x6a0 kernel/workqueue.c:3181 rfkill_unregister+0x92/0x220 net/rfkill/core.c:1112 nfc_unregister_device+0x92/0x290 net/nfc/core.c:1167 virtual_ncidev_close+0x55/0x90 drivers/nfc/virtual_ncidev.c:170 __fput+0x3fe/0x8e0 fs/file_table.c:280 task_work_run+0x129/0x1a0 kernel/task_work.c:188 exit_task_work include/linux/task_work.h:33 [inline] do_exit+0x6a3/0x2480 kernel/exit.c:874 do_group_exit+0x144/0x310 kernel/exit.c:996 get_signal+0xc66/0x14e0 kernel/signal.c:2900 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867 handle_signal_work kernel/entry/common.c:154 [inline] exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f23f97c8d29 RSP: 002b:00007f23f7639038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: 000000000000000b RBX: 00007f23f99b8fa0 RCX: 00007f23f97c8d29 RDX: 0000000000000002 RSI: 0000000020000000 RDI: ffffffffffffff9c RBP: 00007f23f9844b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f23f99b8fa0 R15: 00007ffd00062b48 INFO: task syz-executor:5061 blocked for more than 145 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:26816 pid: 5061 ppid: 1 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rfkill_register+0x30/0x880 net/rfkill/core.c:1045 hci_register_dev+0x4dd/0xa50 net/bluetooth/hci_core.c:3960 __vhci_create_device drivers/bluetooth/hci_vhci.c:129 [inline] vhci_create_device+0x310/0x590 drivers/bluetooth/hci_vhci.c:153 vhci_get_user drivers/bluetooth/hci_vhci.c:210 [inline] vhci_write+0x382/0x430 drivers/bluetooth/hci_vhci.c:290 call_write_iter include/linux/fs.h:2174 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0xacd/0xe50 fs/read_write.c:594 ksys_write+0x1a2/0x2c0 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7efd52e337a0 RSP: 002b:00007fffb9879268 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007efd52e337a0 RDX: 0000000000000002 RSI: 00007fffb987927a RDI: 00000000000000ca RBP: 00007efd53025738 R08: 0000000000000000 R09: 00007efd53b5c6c0 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 INFO: task syz-executor:5097 blocked for more than 145 seconds. Not tainted 5.15.176-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:26456 pid: 5097 ppid: 1 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5027 [inline] __schedule+0x12c4/0x45b0 kernel/sched/core.c:6373 schedule+0x11b/0x1f0 kernel/sched/core.c:6456 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6515 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rfkill_register+0x30/0x880 net/rfkill/core.c:1045 hci_register_dev+0x4dd/0xa50 net/bluetooth/hci_core.c:3960 __vhci_create_device drivers/bluetooth/hci_vhci.c:129 [inline] vhci_create_device+0x310/0x590 drivers/bluetooth/hci_vhci.c:153 vhci_get_user drivers/bluetooth/hci_vhci.c:210 [inline] vhci_write+0x382/0x430 drivers/bluetooth/hci_vhci.c:290 call_write_iter include/linux/fs.h:2174 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0xacd/0xe50 fs/read_write.c:594 ksys_write+0x1a2/0x2c0 fs/read_write.c:647 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f376b76c7a0 RSP: 002b:00007ffe11a68658 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f376b76c7a0 RDX: 0000000000000002 RSI: 00007ffe11a6866a RDI: 00000000000000ca RBP: 00007f376b95e738 R08: 0000000000000000 R09: 00007f376c4956c0 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000000 Showing all locks held in the system: 4 locks held by kworker/0:1/13: #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90000d27d20 ((work_completion)(&rfkill->sync_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_sync_work+0x25/0xe0 net/rfkill/core.c:1028 #3: ffff88802b824190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff88802b824190 (&dev->mutex){....}-{3:3}, at: nfc_dev_down net/nfc/core.c:143 [inline] #3: ffff88802b824190 (&dev->mutex){....}-{3:3}, at: nfc_rfkill_set_block+0x4c/0x2f0 net/nfc/core.c:179 1 lock held by khungtaskd/27: #0: ffffffff8cb1fce0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 6 locks held by kworker/0:3/2303: #0: ffff888141993138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc90005e2fd20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffff88802377c220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff88802377c220 (&dev->mutex){....}-{3:3}, at: hub_event+0x208/0x54c0 drivers/usb/core/hub.c:5769 #3: ffff88807bd6a220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff88807bd6a220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8a/0x570 drivers/base/dd.c:954 #4: ffff88807bd691a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff88807bd691a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8a/0x570 drivers/base/dd.c:954 #5: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1045 2 locks held by getty/3925: #0: ffff88802c05d098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc900026362e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0 drivers/tty/n_tty.c:2158 4 locks held by udevd/4158: #0: ffff88813fee8668 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xae/0xd10 fs/seq_file.c:182 #1: ffff88805f863088 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x50/0x3b0 fs/kernfs/file.c:112 #2: ffff8880616c7008 (kn->active#32){++++}-{0:0}, at: kernfs_seq_start+0x6f/0x3b0 fs/kernfs/file.c:113 #3: ffff88807bd691a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff88807bd691a8 (&dev->mutex){....}-{3:3}, at: uevent_show+0x17e/0x340 drivers/base/core.c:2408 4 locks held by udevd/4160: #0: ffff88807b7739e0 (&p->lock){+.+.}-{3:3}, at: seq_read_iter+0xae/0xd10 fs/seq_file.c:182 #1: ffff888079a48888 (&of->mutex){+.+.}-{3:3}, at: kernfs_seq_start+0x50/0x3b0 fs/kernfs/file.c:112 #2: ffff88805ea5c578 (kn->active#32){++++}-{0:0}, at: kernfs_seq_start+0x6f/0x3b0 fs/kernfs/file.c:113 #3: ffff88802ab5b220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff88802ab5b220 (&dev->mutex){....}-{3:3}, at: uevent_show+0x17e/0x340 drivers/base/core.c:2408 1 lock held by syz-executor/4169: #0: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_unregister+0xcc/0x220 net/rfkill/core.c:1118 1 lock held by syz-executor/4312: #0: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_unregister+0xcc/0x220 net/rfkill/core.c:1118 6 locks held by kworker/1:14/4443: #0: ffff888141993138 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283 #1: ffffc900032dfd20 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285 #2: ffff88814898d220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #2: ffff88814898d220 (&dev->mutex){....}-{3:3}, at: hub_event+0x208/0x54c0 drivers/usb/core/hub.c:5769 #3: ffff88802ab5b220 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #3: ffff88802ab5b220 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8a/0x570 drivers/base/dd.c:954 #4: ffff8880732a21a8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #4: ffff8880732a21a8 (&dev->mutex){....}-{3:3}, at: __device_attach+0x8a/0x570 drivers/base/dd.c:954 #5: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1045 1 lock held by syz.4.73/4725: #0: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_release+0x49/0x220 net/rfkill/core.c:1300 1 lock held by syz.5.79/4777: #0: ffff88802b824190 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:760 [inline] #0: ffff88802b824190 (&dev->mutex){....}-{3:3}, at: nfc_unregister_device+0x5f/0x290 net/nfc/core.c:1165 2 locks held by syz-executor/5061: #0: ffff888079d9f918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x590 drivers/bluetooth/hci_vhci.c:152 #1: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1045 2 locks held by syz-executor/5097: #0: ffff888023739918 (&data->open_mutex){+.+.}-{3:3}, at: vhci_create_device+0x34/0x590 drivers/bluetooth/hci_vhci.c:152 #1: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_register+0x30/0x880 net/rfkill/core.c:1045 2 locks held by syz.0.180/5329: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 #1: ffffffff8dece468 (rfkill_global_mutex){+.+.}-{3:3}, at: rfkill_fop_open+0x130/0x680 net/rfkill/core.c:1151 1 lock held by syz.0.180/5330: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz.2.181/5335: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz.1.185/5348: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5350: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5352: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5354: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5360: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5362: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5364: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5366: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5368: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5376: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 1 lock held by syz-executor/5378: #0: ffffffff8d2128e8 (misc_mtx){+.+.}-{3:3}, at: misc_open+0x58/0x380 drivers/char/misc.c:107 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.176-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106 nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline] watchdog+0xe72/0xeb0 kernel/hung_task.c:295 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 4219 Comm: kworker/u4:5 Not tainted 5.15.176-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: phy7 ieee80211_iface_work RIP: 0010:trace_hardirqs_off+0x6b/0x70 kernel/trace/trace_preemptirq.c:82 Code: 89 ee 81 e6 00 00 f0 00 31 ff e8 90 80 f9 ff 81 e5 00 00 f0 00 74 08 e8 23 7d f9 ff 5b 5d c3 e8 1b 7d f9 ff 48 89 df 31 f6 5b <5d> eb 02 66 90 55 41 57 41 56 53 49 89 f6 48 89 fb e8 ff 7c f9 ff RSP: 0018:ffffc900031afb90 EFLAGS: 00000046 RAX: ffffffff818707c5 RBX: ffff88802bb40000 RCX: ffff88802bb40000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff81808caf RBP: 0000000000000000 R08: ffffffff818707b0 R09: fffffbfff2131441 R10: 0000000000000000 R11: dffffc0000000001 R12: ffff88805fa44c80 R13: ffff88805fa457c0 R14: 0000000000000246 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ae72b805e CR3: 000000001ef0a000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kcov_remote_start+0x6f/0x480 kernel/kcov.c:837 kcov_remote_start_common include/linux/kcov.h:50 [inline] ieee80211_iface_work+0x205/0xcc0 net/mac80211/iface.c:1505 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457 kthread+0x3f6/0x4f0 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287