INFO: task syz.9.2802:21225 blocked for more than 143 seconds. Tainted: G L syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.9.2802 state:D stack:26712 pid:21225 tgid:21220 ppid:20963 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5295 [inline] __schedule+0xfee/0x60e0 kernel/sched/core.c:6907 __schedule_loop kernel/sched/core.c:6989 [inline] schedule+0xdd/0x390 kernel/sched/core.c:7004 schedule_timeout+0x1b2/0x280 kernel/time/sleep_timeout.c:75 ___down_common kernel/locking/semaphore.c:268 [inline] __down_common+0x396/0x790 kernel/locking/semaphore.c:293 down+0x74/0xa0 kernel/locking/semaphore.c:100 console_lock+0x5b/0xa0 kernel/printk/printk.c:2896 class_console_lock_constructor include/linux/console.h:736 [inline] con_install+0x99/0x620 drivers/tty/vt/vt.c:3640 tty_driver_install_tty drivers/tty/tty_io.c:1295 [inline] tty_init_dev.part.0+0x9e/0x470 drivers/tty/tty_io.c:1407 tty_init_dev include/linux/err.h:78 [inline] tty_open_by_driver drivers/tty/tty_io.c:2073 [inline] tty_open+0xa63/0xfa0 drivers/tty/tty_io.c:2120 chrdev_open+0x234/0x6a0 fs/char_dev.c:411 do_dentry_open+0x6d8/0x1660 fs/open.c:949 vfs_open+0x82/0x3f0 fs/open.c:1081 do_open fs/namei.c:4671 [inline] path_openat+0x208c/0x31a0 fs/namei.c:4830 do_file_open+0x20e/0x430 fs/namei.c:4859 do_sys_openat2+0x10d/0x1e0 fs/open.c:1366 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x12d/0x210 fs/open.c:1383 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x106/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe59895c84e RSP: 002b:00007fe5998fcb28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007fe5998fd6c0 RCX: 00007fe59895c84e RDX: 0000000000000002 RSI: 00007fe5998fcc00 RDI: ffffffffffffff9c RBP: 00007fe598a327e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe598c16128 R14: 00007fe598c16090 R15: 00007ffdc5597c18 Showing all locks held in the system: 1 lock held by kworker/R-rcu_g/4: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by khungtaskd/30: #0: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline] #0: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline] #0: ffffffff8e7e94a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775 4 locks held by kworker/0:2/792: 2 locks held by getty/5563: #0: ffff8880349460a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x1500 drivers/tty/n_tty.c:2211 1 lock held by kworker/R-wg-cr/5843: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/5844: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 3 locks held by kworker/0:4/5858: 3 locks held by kworker/0:6/5872: 3 locks held by kworker/0:8/5932: 2 locks held by kworker/0:0/11769: 4 locks held by kworker/u8:2/12216: #0: ffff888037990148 ((wq_completion)wg-kex-wg0#63){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc9000708fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff8880382e1348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff8880569e9708 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 4 locks held by kworker/1:4/14793: #0: ffff88805628c548 ((wq_completion)wg-kex-wg2#47){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc9000459fd08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff88802641d348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff8880375a2ad8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 2 locks held by kworker/0:1/15581: 1 lock held by kworker/0:7/15582: 4 locks held by kworker/u8:0/16824: #0: ffff88805e2f1948 ((wq_completion)wg-kex-wg1#59){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90006e4fd08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff88802b525348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff8880569eaad8 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 3 locks held by kworker/u8:32/16835: #0: ffff8880340e2148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc900063cfd08 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11f/0x1360 net/ipv6/addrconf.c:4199 2 locks held by kworker/0:9/17721: 1 lock held by kworker/R-wg-cr/20136: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/20138: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 4 locks held by kworker/1:1/20269: #0: ffff8880340b6d48 ((wq_completion)wg-kex-wg2#56){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90002ee7d08 ((work_completion)(&({ do { const void __seg_gs *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff88805f515348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x860 drivers/net/wireguard/noise.c:598 #3: ffff88807a91b4c0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x860 drivers/net/wireguard/noise.c:632 2 locks held by syz.7.2878/21061: 1 lock held by kworker/R-wg-cr/21069: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21075: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21080: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 1 lock held by kworker/R-wg-cr/21102: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 1 lock held by kworker/R-wg-cr/21105: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 1 lock held by kworker/R-wg-cr/21106: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21143: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21144: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 2 locks held by syz.9.2802/21225: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120 #1: ffff888056c8e1c0 (&tty->legacy_mutex){+.+.}-{4:4}, at: tty_init_dev.part.0+0x39/0x470 drivers/tty/tty_io.c:1406 2 locks held by kworker/0:3/21237: 1 lock held by syz.3.2906/21367: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120 1 lock held by syz.8.2908/21457: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: ptmx_open drivers/tty/pty.c:798 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0x150/0x3c0 drivers/tty/pty.c:765 1 lock held by kworker/R-wg-cr/21588: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21589: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 1 lock held by kworker/R-wg-cr/21590: 1 lock held by kworker/R-wg-cr/21628: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21629: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 1 lock held by kworker/R-wg-cr/21630: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21719: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21720: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 1 lock held by kworker/R-wg-cr/21853: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21854: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 1 lock held by kworker/R-wg-cr/21856: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 1 lock held by syz.0.2911/21858: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: ptmx_open drivers/tty/pty.c:798 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0x150/0x3c0 drivers/tty/pty.c:765 1 lock held by syz.1.2913/21897: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120 2 locks held by syz-executor/21922: #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:634 [inline] #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x220 drivers/net/tun.c:3436 #1: ffffffff8e680c50 (cpu_hotplug_lock){++++}-{0:0}, at: flush_all_backlogs net/core/dev.c:6524 [inline] #1: ffffffff8e680c50 (cpu_hotplug_lock){++++}-{0:0}, at: unregister_netdevice_many_notify+0x953/0x2580 net/core/dev.c:12375 1 lock held by syz.7.2915/21928: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: ptmx_open drivers/tty/pty.c:798 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0x150/0x3c0 drivers/tty/pty.c:765 4 locks held by kworker/u8:4/21931: #0: ffff88805631d148 ((wq_completion)wg-kex-wg0#42){+.+.}-{0:0}, at: process_one_work+0x1287/0x1920 kernel/workqueue.c:3250 #1: ffffc90003907d08 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x93c/0x1920 kernel/workqueue.c:3251 #2: ffff888080fd5348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529 #3: ffff8880577c6648 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530 2 locks held by kworker/R-wg-cr/21934: 1 lock held by kworker/R-wg-cr/21935: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/21937: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 2 locks held by kworker/0:5/21966: 3 locks held by kworker/0:10/21971: 1 lock held by syz.2.2917/21983: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120 2 locks held by syz-executor/22043: 1 lock held by kworker/R-wg-cr/22063: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by kworker/R-wg-cr/22065: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2691 2 locks held by kworker/R-wg-cr/22066: 1 lock held by kworker/R-wg-cr/22129: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by syz-executor/22131: #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 7 locks held by kworker/R-wg-cr/22132: 1 lock held by syz.5.2932/22136: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open_by_driver drivers/tty/tty_io.c:2037 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: tty_open+0x539/0xfa0 drivers/tty/tty_io.c:2120 1 lock held by kworker/R-wg-cr/22135: #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline] #0: ffffffff8e696d68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xb78/0x1490 kernel/workqueue.c:3610 1 lock held by syz.6.2938/22229: #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: ptmx_open drivers/tty/pty.c:798 [inline] #0: ffffffff8f4e9b08 (tty_mutex){+.+.}-{4:4}, at: ptmx_open+0x150/0x3c0 drivers/tty/pty.c:765 1 lock held by syz-executor/22231: #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x49c/0x1bb0 net/ipv6/addrconf.c:5032 2 locks held by syz-executor/22370: #0: ffffffff905f4430 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577 #1: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x21e/0x780 net/ipv4/ip_tunnel.c:1146 1 lock held by syz.4.2924/22375: #0: ffff8880609d8b58 (&kvm->lock){+.+.}-{4:4}, at: kvm_arch_vm_ioctl+0xddd/0x18d0 arch/x86/kvm/x86.c:7297 1 lock held by syz.4.2924/22377: #0: ffff8880609d8b58 (&kvm->lock){+.+.}-{4:4}, at: kvm_vm_ioctl_create_vcpu virt/kvm/kvm_main.c:4192 [inline] #0: ffff8880609d8b58 (&kvm->lock){+.+.}-{4:4}, at: kvm_vm_ioctl+0x297/0x4080 virt/kvm/kvm_main.c:5180 1 lock held by syz-executor/22385: #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff9060cd28 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x141/0x190 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline] watchdog+0xd25/0x1050 kernel/hung_task.c:515 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 22132 Comm: kworker/R-wg-cr Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: wg-crypt-wg1 wg_packet_tx_worker RIP: 0010:__lock_acquire+0x145/0x2630 kernel/locking/lockdep.c:5171 Code: 05 00 00 48 8b 04 24 44 89 ea 66 81 e2 ff 1f 48 01 c3 0f b7 43 20 4c 89 53 10 4c 89 63 18 66 25 00 e0 09 d0 31 d2 66 89 43 20 <48> 8b 84 24 b0 00 00 00 48 89 43 08 65 44 8b 1d 2f 8b 28 12 8b b5 RSP: 0018:ffffc900000065a0 EFLAGS: 00000046 RAX: 0000000000002007 RBX: ffff88807c9f8c30 RCX: 0000000000000007 RDX: 0000000000000000 RSI: ffff88807c9f8c08 RDI: ffffffff8e7e94a0 RBP: ffff88807c9f8000 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff8e7e94a0 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000007 R14: 0000000000000002 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124352000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000032000 CR3: 000000000e598000 CR4: 00000000003526f0 Call Trace: lock_acquire kernel/locking/lockdep.c:5868 [inline] lock_acquire+0x1cf/0x380 kernel/locking/lockdep.c:5825 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] class_rcu_constructor include/linux/rcupdate.h:1193 [inline] unwind_next_frame+0xd1/0x1ea0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2670 [inline] slab_free mm/slub.c:6082 [inline] kmem_cache_free+0x124/0x6a0 mm/slub.c:6212 skb_kfree_head net/core/skbuff.c:1087 [inline] skb_kfree_head net/core/skbuff.c:1084 [inline] skb_free_head+0x1c6/0x220 net/core/skbuff.c:1101 skb_release_data+0x79b/0x9d0 net/core/skbuff.c:1128 skb_release_all net/core/skbuff.c:1203 [inline] __kfree_skb net/core/skbuff.c:1217 [inline] sk_skb_reason_drop+0x102/0x1b0 net/core/skbuff.c:1255 kfree_skb_reason include/linux/skbuff.h:1322 [inline] enqueue_to_backlog+0x40d/0xfa0 net/core/dev.c:5361 netif_rx_internal+0x102/0x630 net/core/dev.c:5659 __netif_rx+0x88/0xb0 net/core/dev.c:5679 loopback_xmit+0x284/0x6e0 drivers/net/loopback.c:90 __netdev_start_xmit include/linux/netdevice.h:5275 [inline] netdev_start_xmit include/linux/netdevice.h:5284 [inline] xmit_one net/core/dev.c:3864 [inline] dev_hard_start_xmit+0x121/0x7d0 net/core/dev.c:3880 sch_direct_xmit+0x1b2/0xc60 net/sched/sch_generic.c:347 qdisc_restart net/sched/sch_generic.c:412 [inline] __qdisc_run+0x52d/0x1b10 net/sched/sch_generic.c:420 qdisc_run include/net/pkt_sched.h:120 [inline] qdisc_run include/net/pkt_sched.h:117 [inline] __dev_xmit_skb net/core/dev.c:4262 [inline] __dev_queue_xmit+0x2cb1/0x4750 net/core/dev.c:4795 dev_queue_xmit include/linux/netdevice.h:3384 [inline] neigh_hh_output include/net/neighbour.h:540 [inline] neigh_output include/net/neighbour.h:554 [inline] ip6_finish_output2+0xfd4/0x1ce0 net/ipv6/ip6_output.c:136 __ip6_finish_output+0x357/0x1080 net/ipv6/ip6_output.c:208 ip6_finish_output net/ipv6/ip6_output.c:219 [inline] NF_HOOK_COND include/linux/netfilter.h:307 [inline] ip6_output+0x2aa/0xa60 net/ipv6/ip6_output.c:246 dst_output include/net/dst.h:470 [inline] ip6_local_out+0xce/0x4a0 net/ipv6/output_core.c:152 synproxy_send_tcp_ipv6+0x5f3/0x700 net/netfilter/nf_synproxy_core.c:852 synproxy_send_client_synack_ipv6+0x601/0x7a0 net/netfilter/nf_synproxy_core.c:898 nft_synproxy_eval_v6 net/netfilter/nft_synproxy.c:91 [inline] nft_synproxy_do_eval+0x941/0xd50 net/netfilter/nft_synproxy.c:146 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x2e8/0x1930 net/netfilter/nf_tables_core.c:285 nft_do_chain_inet+0xee/0x340 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623 nf_hook.constprop.0+0x2a6/0x750 include/linux/netfilter.h:273 NF_HOOK include/linux/netfilter.h:316 [inline] ip6_input+0xe0/0x2f0 net/ipv6/ip6_input.c:500 dst_input include/net/dst.h:480 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline] NF_HOOK include/linux/netfilter.h:318 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x261/0x610 net/ipv6/ip6_input.c:311 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6149 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6262 process_backlog+0x37a/0x1580 net/core/dev.c:6614 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7678 napi_poll net/core/dev.c:7741 [inline] net_rx_action+0xa40/0xf20 net/core/dev.c:7893 handle_softirqs+0x1eb/0x9e0 kernel/softirq.c:622 do_softirq kernel/softirq.c:523 [inline] do_softirq+0xac/0xe0 kernel/softirq.c:510 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450 wg_timers_any_authenticated_packet_traversal+0x9b/0xc0 drivers/net/wireguard/timers.c:218 wg_packet_create_data_done drivers/net/wireguard/send.c:247 [inline] wg_packet_tx_worker+0x12d/0x7f0 drivers/net/wireguard/send.c:276 process_one_work+0x9d7/0x1920 kernel/workqueue.c:3275 process_scheduled_works kernel/workqueue.c:3358 [inline] rescuer_thread+0x902/0x1490 kernel/workqueue.c:3582 kthread+0x370/0x450 kernel/kthread.c:467 ret_from_fork+0x754/0xd80 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245