INFO: task kworker/u8:1:13 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:1    state:D stack:23192 pid:13    tgid:13    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: ipv6_addrconf addrconf_verify_work
Call Trace:
 <TASK>
 __schedule+0x1840/0x57a0
 schedule+0x164/0x360
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7c5/0x1590
 addrconf_verify_work+0x19/0x30
 process_scheduled_works+0xa8e/0x14e0
 worker_thread+0xa47/0xfb0
 kthread+0x389/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
INFO: task kworker/u10:0:27 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u10:0   state:D stack:22688 pid:27    tgid:27    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound bpf_map_free_deferred
Call Trace:
 <TASK>
 __schedule+0x1840/0x57a0
 schedule+0x164/0x360
 synchronize_rcu_expedited+0x619/0x770
 dev_map_free+0x11a/0x680
 bpf_map_free_deferred+0x23b/0x4b0
 process_scheduled_works+0xa8e/0x14e0
 worker_thread+0xa47/0xfb0
 kthread+0x389/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
INFO: task syz-executor:5621 blocked for more than 146 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22096 pid:5621  tgid:5621  ppid:1      task_flags:0x40054c flags:0x00080003
Call Trace:
 <TASK>
 __schedule+0x1840/0x57a0
 schedule+0x164/0x360
 synchronize_rcu_expedited+0x619/0x770
 namespace_unlock+0x556/0x780
 deactivate_nsproxy+0x41/0x140
 do_exit+0x735/0x2360
 do_group_exit+0x22d/0x2f0
 get_signal+0x121b/0x12c0
 arch_do_signal_or_restart+0xbb/0x860
 exit_to_user_mode_loop+0xa9/0x6b0
 do_syscall_64+0x353/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa51fb5d68e
RSP: 002b:00007ffe0f8c6678 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: fffffffffffffe00 RBX: 000055556dbcb500 RCX: 00007fa51fb5d68e
RDX: 0000000040000000 RSI: 00007ffe0f8c671c RDI: ffffffffffffffff
RBP: 00007ffe0f8c671c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000000000b6
R13: 000055556dbde9f0 R14: 0000000000028af1 R15: 00007ffe0f8c6770
 </TASK>
INFO: task kworker/u10:24:7258 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u10:24  state:D stack:25088 pid:7258  tgid:7258  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 __schedule+0x1840/0x57a0
 schedule+0x164/0x360
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7c5/0x1590
 linkwatch_event+0xe/0x60
 process_scheduled_works+0xa8e/0x14e0
 worker_thread+0xa47/0xfb0
 kthread+0x389/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
INFO: task syz.1.495:7780 blocked for more than 146 seconds.
      Not tainted syzkaller #0
      Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.495       state:D stack:24000 pid:7780  tgid:7778  ppid:5621   task_flags:0x40054c flags:0x00080003
Call Trace:
 <TASK>
 __schedule+0x1840/0x57a0
 schedule+0x164/0x360
 schedule_timeout+0xc0/0x2c0
 wait_for_completion+0x2ca/0x5e0
 __synchronize_srcu+0x23b/0x2f0
 perf_trace_event_unreg+0xd1/0x1c0
 perf_trace_destroy+0xa4/0x150
 __free_event+0x328/0x7e0
 perf_event_release_kernel+0x40e/0x4c0
 perf_release+0x38/0x50
 __fput+0x418/0xa50
 task_work_run+0x1d9/0x270
 do_exit+0x73a/0x2360
 do_group_exit+0x22d/0x2f0
 get_signal+0x121b/0x12c0
 arch_do_signal_or_restart+0xbb/0x860
 exit_to_user_mode_loop+0xa9/0x6b0
 do_syscall_64+0x353/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa51fb9ce59
RSP: 002b:00007fa51ddd5028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 0000000000000009 RBX: 00007fa51fe16090 RCX: 00007fa51fb9ce59
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000080
RBP: 00007fa51fc32e6f R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa51fe16128 R14: 00007fa51fe16090 R15: 00007ffe0f8c6378
 </TASK>
INFO: task syz-executor:7783 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22448 pid:7783  tgid:7783  ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x1840/0x57a0
 schedule+0x164/0x360
 synchronize_rcu_expedited+0x619/0x770
 netif_change_name+0x433/0x980
 do_setlink+0xb66/0x4670
 rtnl_newlink+0x15c2/0x1bd0
 rtnetlink_rcv_msg+0x802/0xc00
 netlink_rcv_skb+0x226/0x4a0
 netlink_unicast+0x7bb/0x940
 netlink_sendmsg+0x813/0xb40
 __sys_sendto+0x672/0x710
 __x64_sys_sendto+0xde/0x100
 do_syscall_64+0x174/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fdd24f5d68e
RSP: 002b:00007ffc41936688 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555569834500 RCX: 00007fdd24f5d68e
RDX: 0000000000000030 RSI: 00007fdd25d43610 RDI: 0000000000000006
RBP: 0000000000000001 R08: 00007ffc41936704 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
R13: 0000000000000000 R14: 00007fdd25d43610 R15: 0000000000000000
 </TASK>
INFO: task syz.2.502:7823 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.502       state:D stack:25640 pid:7823  tgid:7823  ppid:5626   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x1840/0x57a0
 schedule+0x164/0x360
 synchronize_rcu_expedited+0x619/0x770
 packet_release+0xa38/0xd30
 sock_close+0xad/0x220
 __fput+0x418/0xa50
 task_work_run+0x1d9/0x270
 exit_to_user_mode_loop+0x193/0x6b0
 do_syscall_64+0x353/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe28819ce59
RSP: 002b:00007fffdf8e6f08 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fe288417da0 RCX: 00007fe28819ce59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fe288417da0 R08: 00007fe288416128 R09: 0000000000000000
R10: 00000000003ffd58 R11: 0000000000000246 R12: 0000000000029e82
R13: 00007fe28841618c R14: 0000000000029be4 R15: 00007fe288416180
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/0:1/10:
 #0: ffff888100692d40 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc900000f7c40 ((work_completion)(&(&ssp->srcu_sup->work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffffffff8e9bc8e8 (&ssp->srcu_sup->srcu_gp_mutex){+.+.}-{4:4}, at: process_srcu+0x6c/0x16f0
3 locks held by kworker/u8:1/13:
 #0: ffff888173b98140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90000127c40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30
2 locks held by kworker/u10:0/27:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90000a27c40 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
1 lock held by khungtaskd/34:
 #0: ffffffff8e95c700 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
4 locks held by kworker/u11:0/54:
 #0: ffff8881b45c9140 ((wq_completion)hci8#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90000be7c40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881ad7500b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950
 #3: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950
2 locks held by kworker/0:2/798:
 #0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90004a9fc40 (xfrm_state_gc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
5 locks held by kworker/u11:1/5003:
 #0: ffff88816aa93940 ((wq_completion)hci0){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90021e1fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881697a8ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0
 #3: ffff8881697a80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190
 #4: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x145/0x320
2 locks held by getty/5443:
 #0: ffff88816d5320a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffffc900034762e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1380
6 locks held by kworker/u11:2/5623:
 #0: ffff88811728b940 ((wq_completion)hci2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000648fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff88801cedcea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0
 #3: ffff88801cedc0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190
 #4: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x145/0x320
 #5: ffff888173b9a2f8 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x92/0x570
4 locks held by kworker/u11:3/5628:
 #0: ffff8881b7cfa140 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc900064bfc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881ad5e00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950
 #3: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950
4 locks held by kworker/u11:4/5633:
 #0: ffff8881ac388940 ((wq_completion)hci7#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc900064ffc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881acea00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950
 #3: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950
6 locks held by kworker/u8:2/5658:
 #0: ffff8881012b5940 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000657fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffffffff8fdb0968 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810
 #3: ffff8881bc1be128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420
 #4: ffff8881bc1bd258 (&devlink->lock_key#2){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420
 #5: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0
3 locks held by kworker/1:7/6945:
 #0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90006af7c40 (free_ipc_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffffffff8e962a28 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770
3 locks held by kworker/u10:16/7245:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90003a4fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff888115e80780 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc0/0x490
3 locks held by kworker/u10:21/7255:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc900039bfc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff888103fe0780 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xc0/0x490
3 locks held by kworker/u10:24/7258:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000395fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60
3 locks held by kworker/0:9/7385:
 #0: ffff888100069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90007bb7c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xac/0x10e0
3 locks held by kworker/1:12/7392:
 #0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90007af7c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20
4 locks held by syz.3.489/7756:
1 lock held by syz.1.495/7780:
 #0: ffffffff8e9ce020 (event_mutex){+.+.}-{4:4}, at: perf_trace_destroy+0x2e/0x150
2 locks held by syz-executor/7783:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0
 #1: ffff88816b134dc8 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: do_setlink+0x3d4/0x4670
1 lock held by syz.2.502/7823:
 #0: ffff8881bdc47a40 (&sb->s_type->i_mutex_key#13){+.+.}-{4:4}, at: sock_close+0x82/0x220
1 lock held by syz-executor/7829:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0
1 lock held by syz-executor/7830:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0
4 locks held by kworker/u11:5/7835:
 #0: ffff888173aca940 ((wq_completion)hci5#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc900039afc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881ad5dc0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950
 #3: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950
4 locks held by kworker/u11:6/7836:
 #0: ffff8881a6c27140 ((wq_completion)hci6#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000397fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881ad5f00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950
 #3: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950
1 lock held by dhcpcd/7841:
 #0: ffff8881155e4260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90
1 lock held by dhcpcd/7842:
 #0: ffff88817432e260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90
1 lock held by dhcpcd/7843:
 #0: ffff8880243a8260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90
1 lock held by dhcpcd/7844:
 #0: ffff88817519a260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90
1 lock held by dhcpcd/7845:
 #0: ffff8881b41de260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90
1 lock held by dhcpcd/7846:
 #0: ffff8881b3728260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xe90
1 lock held by syz-executor/7848:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0
1 lock held by syz-executor/7855:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0
5 locks held by kworker/u11:7/7858:
 #0: ffff88811620d140 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000381fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881001d0ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0
 #3: ffff8881001d00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190
 #4: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x145/0x320
1 lock held by syz-executor/7860:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0
4 locks held by kworker/u11:8/7862:
 #0: ffff8881af6fc940 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc900037bfc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881ae3a40b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950
 #3: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950
4 locks held by kworker/u11:9/7867:
 #0: ffff8881a0882940 ((wq_completion)hci9#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000384fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881ad50c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950
 #3: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950
1 lock held by syz-executor/7871:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0
5 locks held by kworker/u11:10/7874:
 #0: ffff8881bc971940 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000376fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff88811516cea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0
 #3: ffff88811516c0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0xa6f/0x1190
 #4: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x145/0x320
1 lock held by syz-executor/7879:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0
4 locks held by kworker/u11:12/7880:
 #0: ffff88816e69f940 ((wq_completion)hci10#2){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc9000371fc40 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881ae3bc0b8 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950
 #3: ffffffff8ff41a40 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950
1 lock held by syz-executor/7887:
 #0: ffffffff8fdbf640 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x464/0x19e0

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 34 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 nmi_cpu_backtrace+0x274/0x2d0
 nmi_trigger_cpumask_backtrace+0x17a/0x300
 sys_info+0x135/0x170
 watchdog+0xfd7/0x1030
 kthread+0x389/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 7756 Comm: syz.3.489 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:native_apic_msr_write+0x39/0x50
Code: 74 2a 83 ff 30 74 25 eb 10 81 ff d0 00 00 00 74 1b 81 ff e0 00 00 00 74 13 c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 e9 c0 00 30 0a cc 89 f6 31 d2 e9 c6 a1 78 03 66 0f 1f 44 00
RSP: 0018:ffffc90000007a10 EFLAGS: 00000046
RAX: 00000000000000cc RBX: ffff888121023e40 RCX: 0000000000000838
RDX: 0000000000000000 RSI: 00000000000000cc RDI: 0000000000000838
RBP: ffffc90000007ad0 R08: ffffffff81b266f5 R09: 0000000000080000
R10: 0000000000000000 R11: ffffffff8173f690 R12: 00000000000000cc
R13: dffffc0000000000 R14: 0000000010005fa1 R15: 0000000000000020
FS:  00007faa7d41f6c0(0000) GS:ffff88818dcb8000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fdf4223dcf3 CR3: 000000010bbc8000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 lapic_next_event+0x11/0x20
 clockevents_program_event+0x385/0x630
 __hrtimer_rearm_deferred+0x25d/0x440
 irqentry_exit+0x8a3/0x8e0
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:kasan_check_range+0x97/0x2c0
Code: 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 3d 01 00 00 4c 89 cb 48 f7 d3 4c 01 fb 41 80 3b 00 <0f> 85 9e 01 00 00 49 ff c3 48 ff c3 75 ee e9 1d 01 00 00 44 89 dd
RSP: 0018:ffffc90000007c20 EFLAGS: 00000246
RAX: 0000000000000101 RBX: fffffffffffffffb RCX: ffffffff81b1b55c
RDX: 0000000000000000 RSI: 0000000000000028 RDI: ffff888110fcc530
RBP: ffffc90000007d70 R08: ffff888110fcc557 R09: 1ffff110221f98aa
R10: dffffc0000000000 R11: ffffed10221f98a6 R12: 0000000000000005
R13: 0000000100000bff R14: ffffed10221f98ab R15: 1ffff110221f98a6
 __asan_memcpy+0x29/0x70
 call_timer_fn+0xbc/0x5e0
 __run_timer_base+0x652/0x8b0
 run_timer_softirq+0xb7/0x170
 handle_softirqs+0x225/0x840
 __irq_exit_rcu+0xca/0x220
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:exit_signals+0xc0/0x7a0
Code: 3a 00 49 bd 00 00 00 00 00 fc ff df 48 c7 c0 00 bf 99 8e 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 f7 05 00 00 8b 2d 80 74 0f 0d <31> ff 89 ee e8 87 fa 3a 00 85 ed 0f 85 71 05 00 00 e8 3a f6 3a 00
RSP: 0018:ffffc90003e2fab8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff8881130ed940 RCX: ffff8881130ed940
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff8186cf64 R09: 0000000000000000
R10: 0000000000000000 R11: ffffffff8e99bfd0 R12: 0000000000000b00
R13: dffffc0000000000 R14: ffff8881130ee2a8 R15: dffffc0000000000
 do_exit+0x3b4/0x2360
 do_group_exit+0x22d/0x2f0
 get_signal+0x121b/0x12c0
 arch_do_signal_or_restart+0xbb/0x860
 exit_to_user_mode_loop+0xa9/0x6b0
 do_syscall_64+0x353/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faa7c59ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faa7d41f028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 0000000000000003 RBX: 00007faa7c815fa0 RCX: 00007faa7c59ce59
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000480
RBP: 00007faa7c632e6f R08: 0000000000000008 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007faa7c816038 R14: 00007faa7c815fa0 R15: 00007fff00465ab8
 </TASK>
