Extracting prog: 7m11.973205604s
Minimizing prog: 28m20.275932012s
Simplifying prog options: 11m12.527698312s
Extracting C: 5m16.59670488s
Simplifying C: 0s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program did not crash
single: failed to extract reproducer
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program crashed: INFO: rcu detected stall in worker_thread
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)

program did not crash
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$EVIOCGMASK
detailed listing:
executing program 0:
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program did not crash
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, 0x0, 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program did not crash
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB, @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m55.737327597s, {Threaded:false Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program crashed: INFO: rcu detected stall in rescuer_thread
a never seen crash title: INFO: rcu detected stall in rescuer_thread, ignore
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program did not crash
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program crashed: INFO: task hung in corrupted
validation run: crashed=true
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program crashed: INFO: rcu detected stall in worker_thread
validation run: crashed=true
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program did not crash
validation run: crashed=false
testing program (duration=6m55.737327597s, {Threaded:true Repeat:true RepeatTimes:0 Procs:6 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-ioctl$EVIOCGMASK
detailed listing:
executing program 0:
syz_usb_connect(0x0, 0x2d, &(0x7f0000000200)=ANY=[@ANYBLOB="12010000eafa7240936901b02926f400100109021b000124a800800904000001030000000905", @ANYRES64], 0x0)
ioctl$EVIOCGMASK(0xffffffffffffffff, 0x80104592, 0x0)

program crashed: INFO: task hung in reg_check_chans_work
validation run: crashed=true
reproducing took 1h32m10.132426726s
repro crashed as (corrupted=false):
INFO: task kworker/1:1:29 blocked for more than 150 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:1     state:D
 stack:24488 pid:29    tgid:29    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_power_efficient reg_check_chans_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7326
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821
 class_wiphy_constructor include/net/cfg80211.h:6884 [inline]
 reg_leave_invalid_chans net/wireless/reg.c:2457 [inline]
 reg_check_chans_work+0x1a1/0x1110 net/wireless/reg.c:2472
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz-executor:6111 blocked for more than 154 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D
 stack:22064 pid:6111  tgid:6111  ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7326
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821
 rtnl_lock net/core/rtnetlink.c:80 [inline]
 rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7076
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
 __sock_sendmsg net/socket.c:790 [inline]
 __sys_sendto+0x408/0x5a0 net/socket.c:2252
 __do_sys_sendto net/socket.c:2259 [inline]
 __se_sys_sendto net/socket.c:2255 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2255
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9ecc75e6ce
RSP: 002b:00007ffe49a86418 EFLAGS: 00000246
 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555574b10500 RCX: 00007f9ecc75e6ce
RDX: 000000000000002c RSI: 00007f9ecd554670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffe49a86494 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f9ecd554670 R15: 0000000000000000
 </TASK>

Showing all locks held in the system:
1 lock held by kworker/R-mm_pe/14:
 #0: ffffffff8e9f6ea0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
4 locks held by kworker/1:1/29:
1 lock held by khungtaskd/32:
 #0: 
ffffffff8eb59c60
 (
rcu_read_lock
){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
1 lock held by kworker/R-write/34:
 #0: ffffffff8e9f6ea0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
3 locks held by kworker/u8:3/49:
 #0: 
ffff8880324b7140
 (
(wq_completion)ipv6_addrconf
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3297 [inline]
, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: 
ffffc90000b97c40
 (
(work_completion)(&(&ifa->dad_work)->work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3297 [inline]
, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: 
ffffffff9002cf40
 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4229
5 locks held by kworker/u8:7/1052:
1 lock held by kworker/R-bat_e/3221:
 #0: 
ffffffff8e9f6ea0
 (
wq_pool_attach_mutex
){+.+.}-{4:4}
, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline]
, at: rescuer_thread+0xbda/0x10b0 kernel/workqueue.c:3657
4 locks held by kworker/u9:1/4937:
 #0: 
ffff88805a78e940 ((wq_completion)hci4#2){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3297 [inline]
, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: 
ffffc9000d90fc40
 (
(work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3297 [inline]
, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: 
ffff888028ebc0b8
 (
&hdev->lock
){+.+.}-{4:4}
, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3714
 #3: 
ffffffff901b4420
 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3748
2 locks held by udevd/4987:
 #0: 
ffff888034fa70c0
 (
&type->i_mutex_dir_key
#4
){++++}-{4:4}
, at: inode_lock_shared include/linux/fs.h:1039 [inline]
, at: lookup_slow+0x46/0x70 fs/namei.c:1935
 #1: 
ffff88801c28d180
 (
&root->kernfs_rwsem
){++++}-{4:4}
, at: kernfs_iop_lookup+0x5f/0x320 fs/kernfs/dir.c:1259
3 locks held by kworker/1:3/5029:
1 lock held by dhcpcd/5283:
 #0: 
ffffffff9002cf40
 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x2fb/0x1c50 net/ipv4/devinet.c:1120
2 locks held by getty/5376:
 #0: 
ffff8880368900a0
 (
&tty->ldisc_sem
){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: 
ffffc900032332e8
 (
&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
6 locks held by kworker/u9:3/5762:
 #0: ffff88805aadd140 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88805aadd140 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc90003a6fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc90003a6fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff888058788ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
 #3: ffff8880587880b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5822
 #4: 
ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1408
 #5: ffff88802af9faf8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x520 net/bluetooth/l2cap_core.c:1808
5 locks held by kworker/u9:4/5765:
 #0: ffff88807ca43140 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88807ca43140 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9000337fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9000337fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff888057784ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
 #3: ffff8880577840b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5822
 #4: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #4: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1408
7 locks held by kworker/1:4/5906:
 #0: ffff888022a89d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888022a89d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900031efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900031efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88802a4041d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #2: ffff88802a4041d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5899
 #3: ffff888029ea11d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #3: ffff888029ea11d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 drivers/usb/core/hub.c:2336
 #4: ffff888033e361a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #4: ffff888033e361a0 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
 #4: ffff888033e361a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369
 #5: ffffffff8faa5440 (input_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #5: ffffffff8faa5440 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x2d8/0x650 drivers/input/input.c:2204
 #6: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
 #6: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:961
3 locks held by kworker/0:5/5968:
 #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9000366fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9000366fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880b8626058 (&base->lock){-.-.}-{2:2}, at: lock_timer_base kernel/time/timer.c:1004 [inline]
 #2: ffff8880b8626058 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1a9/0xed0 kernel/time/timer.c:1085
3 locks held by syz-executor/6054:
 #0: ffff888075898ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:497 [inline]
 #0: ffff888075898ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x22a/0x5b0 net/bluetooth/hci_core.c:2678
 #1: ffff8880758980b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x61f/0x10a0 net/bluetooth/hci_sync.c:5429
 #2: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2149 [inline]
 #2: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0x99/0x260 net/bluetooth/hci_conn.c:2733
3 locks held by syz-executor/6060:
 #0: 
ffff888027e48ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:497 [inline]
ffff888027e48ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x22a/0x5b0 net/bluetooth/hci_core.c:2678
 #1: ffff888027e480b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x61f/0x10a0 net/bluetooth/hci_sync.c:5429
 #2: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2149 [inline]
 #2: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0x99/0x260 net/bluetooth/hci_conn.c:2733
4 locks held by udevd/6078:
 #0: ffff888025aeb638 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183
 #1: ffff88805b7b9080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165
 #2: ffff88803447b788 (kn->active#34){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
 #2: ffff88803447b788 (kn->active#34){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166
 #3: ffff888029ea11d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1107 [inline]
 #3: ffff888029ea11d8 (&dev->mutex){....}-{4:4}, at: serial_show+0x26/0xa0 drivers/usb/core/sysfs.c:143
6 locks held by kworker/1:9/6084:
 #0: ffff888022a89d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888022a89d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900038cfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900038cfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88802a33c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #2: ffff88802a33c1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5899
 #3: ffff888026e371d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #3: ffff888026e371d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 drivers/usb/core/hub.c:2336

final repro crashed as (corrupted=false):
INFO: task kworker/1:1:29 blocked for more than 150 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:1     state:D
 stack:24488 pid:29    tgid:29    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_power_efficient reg_check_chans_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7326
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821
 class_wiphy_constructor include/net/cfg80211.h:6884 [inline]
 reg_leave_invalid_chans net/wireless/reg.c:2457 [inline]
 reg_check_chans_work+0x1a1/0x1110 net/wireless/reg.c:2472
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz-executor:6111 blocked for more than 154 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D
 stack:22064 pid:6111  tgid:6111  ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x17d9/0x56c0 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0x164/0x2b0 kernel/sched/core.c:7326
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7383
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0x7bf/0x1550 kernel/locking/mutex.c:821
 rtnl_lock net/core/rtnetlink.c:80 [inline]
 rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7076
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
 __sock_sendmsg net/socket.c:790 [inline]
 __sys_sendto+0x408/0x5a0 net/socket.c:2252
 __do_sys_sendto net/socket.c:2259 [inline]
 __se_sys_sendto net/socket.c:2255 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2255
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9ecc75e6ce
RSP: 002b:00007ffe49a86418 EFLAGS: 00000246
 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555574b10500 RCX: 00007f9ecc75e6ce
RDX: 000000000000002c RSI: 00007f9ecd554670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffe49a86494 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f9ecd554670 R15: 0000000000000000
 </TASK>

Showing all locks held in the system:
1 lock held by kworker/R-mm_pe/14:
 #0: ffffffff8e9f6ea0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
4 locks held by kworker/1:1/29:
1 lock held by khungtaskd/32:
 #0: 
ffffffff8eb59c60
 (
rcu_read_lock
){....}-{1:3}
, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
1 lock held by kworker/R-write/34:
 #0: ffffffff8e9f6ea0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x31/0x390 kernel/workqueue.c:2737
3 locks held by kworker/u8:3/49:
 #0: 
ffff8880324b7140
 (
(wq_completion)ipv6_addrconf
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3297 [inline]
, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: 
ffffc90000b97c40
 (
(work_completion)(&(&ifa->dad_work)->work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3297 [inline]
, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: 
ffffffff9002cf40
 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x116/0x15c0 net/ipv6/addrconf.c:4229
5 locks held by kworker/u8:7/1052:
1 lock held by kworker/R-bat_e/3221:
 #0: 
ffffffff8e9f6ea0
 (
wq_pool_attach_mutex
){+.+.}-{4:4}
, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline]
, at: rescuer_thread+0xbda/0x10b0 kernel/workqueue.c:3657
4 locks held by kworker/u9:1/4937:
 #0: 
ffff88805a78e940 ((wq_completion)hci4#2){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3297 [inline]
, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: 
ffffc9000d90fc40
 (
(work_completion)(&hdev->rx_work)
){+.+.}-{0:0}
, at: process_one_work kernel/workqueue.c:3297 [inline]
, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: 
ffff888028ebc0b8
 (
&hdev->lock
){+.+.}-{4:4}
, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3714
 #3: 
ffffffff901b4420
 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3748
2 locks held by udevd/4987:
 #0: 
ffff888034fa70c0
 (
&type->i_mutex_dir_key
#4
){++++}-{4:4}
, at: inode_lock_shared include/linux/fs.h:1039 [inline]
, at: lookup_slow+0x46/0x70 fs/namei.c:1935
 #1: 
ffff88801c28d180
 (
&root->kernfs_rwsem
){++++}-{4:4}
, at: kernfs_iop_lookup+0x5f/0x320 fs/kernfs/dir.c:1259
3 locks held by kworker/1:3/5029:
1 lock held by dhcpcd/5283:
 #0: 
ffffffff9002cf40
 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x2fb/0x1c50 net/ipv4/devinet.c:1120
2 locks held by getty/5376:
 #0: 
ffff8880368900a0
 (
&tty->ldisc_sem
){++++}-{0:0}
, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: 
ffffc900032332e8
 (
&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211
6 locks held by kworker/u9:3/5762:
 #0: ffff88805aadd140 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88805aadd140 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc90003a6fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc90003a6fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff888058788ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
 #3: ffff8880587880b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5822
 #4: 
ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1408
 #5: ffff88802af9faf8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x520 net/bluetooth/l2cap_core.c:1808
5 locks held by kworker/u9:4/5765:
 #0: ffff88807ca43140 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88807ca43140 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9000337fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9000337fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff888057784ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0 net/bluetooth/hci_sync.c:331
 #3: ffff8880577840b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190 net/bluetooth/hci_sync.c:5822
 #4: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
 #4: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x149/0x320 net/bluetooth/hci_conn.c:1408
7 locks held by kworker/1:4/5906:
 #0: ffff888022a89d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888022a89d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900031efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900031efc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88802a4041d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #2: ffff88802a4041d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5899
 #3: ffff888029ea11d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #3: ffff888029ea11d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 drivers/usb/core/hub.c:2336
 #4: ffff888033e361a0 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #4: ffff888033e361a0 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
 #4: ffff888033e361a0 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369
 #5: ffffffff8faa5440 (input_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:253 [inline]
 #5: ffffffff8faa5440 (input_mutex){+.+.}-{4:4}, at: __input_unregister_device+0x2d8/0x650 drivers/input/input.c:2204
 #6: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
 #6: ffffffff8eb5ff68 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:961
3 locks held by kworker/0:5/5968:
 #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff88801b02b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc9000366fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc9000366fc40 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff8880b8626058 (&base->lock){-.-.}-{2:2}, at: lock_timer_base kernel/time/timer.c:1004 [inline]
 #2: ffff8880b8626058 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1a9/0xed0 kernel/time/timer.c:1085
3 locks held by syz-executor/6054:
 #0: ffff888075898ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:497 [inline]
 #0: ffff888075898ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x22a/0x5b0 net/bluetooth/hci_core.c:2678
 #1: ffff8880758980b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x61f/0x10a0 net/bluetooth/hci_sync.c:5429
 #2: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2149 [inline]
 #2: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0x99/0x260 net/bluetooth/hci_conn.c:2733
3 locks held by syz-executor/6060:
 #0: 
ffff888027e48ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:497 [inline]
ffff888027e48ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x22a/0x5b0 net/bluetooth/hci_core.c:2678
 #1: ffff888027e480b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x61f/0x10a0 net/bluetooth/hci_sync.c:5429
 #2: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2149 [inline]
 #2: ffffffff901b4420 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0x99/0x260 net/bluetooth/hci_conn.c:2733
4 locks held by udevd/6078:
 #0: ffff888025aeb638 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xa4/0xca0 fs/seq_file.c:183
 #1: ffff88805b7b9080 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5d/0x420 fs/kernfs/file.c:165
 #2: ffff88803447b788 (kn->active#34){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
 #2: ffff88803447b788 (kn->active#34){.+.+}-{0:0}, at: kernfs_seq_start+0xb2/0x420 fs/kernfs/file.c:166
 #3: ffff888029ea11d8 (&dev->mutex){....}-{4:4}, at: device_lock_interruptible include/linux/device.h:1107 [inline]
 #3: ffff888029ea11d8 (&dev->mutex){....}-{4:4}, at: serial_show+0x26/0xa0 drivers/usb/core/sysfs.c:143
6 locks held by kworker/1:9/6084:
 #0: ffff888022a89d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #0: ffff888022a89d40 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #1: ffffc900038cfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline]
 #1: ffffc900038cfc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0 kernel/workqueue.c:3405
 #2: ffff88802a33c1d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #2: ffff88802a33c1d8 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4d30 drivers/usb/core/hub.c:5899
 #3: ffff888026e371d8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
 #3: ffff888026e371d8 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xfc/0x9a0 drivers/usb/core/hub.c:2336