INFO: task kworker/u9:6:1116 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:6    state:D stack:22168 pid:1116  tgid:1116  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: wg-kex-wg0 wg_packet_handshake_send_worker
Call Trace:
 <TASK>
 __schedule+0x1821/0x5740
 schedule+0x164/0x360
 schedule_preempt_disabled+0x13/0x30
 rwsem_down_write_slowpath+0x883/0x1080
 down_write+0x1bc/0x200
 wg_noise_handshake_create_initiation+0x140/0x830
 wg_packet_handshake_send_worker+0x18d/0x350
 process_scheduled_works+0xb5d/0x1860
 worker_thread+0xa53/0xfc0
 kthread+0x389/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/u8:0/12:
 #0: ffff88810f2d6940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc90000117c40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30
1 lock held by kworker/R-mm_pe/14:
2 locks held by kworker/1:0/24:
4 locks held by kworker/u9:0/26:
 #0: ffff88811643c940 ((wq_completion)wg-kex-wg1#17){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc90000a17c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffff88801bca53c0 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12f/0x830
 #3: ffff88811e857028 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x140/0x830
2 locks held by kworker/1:1/32:
1 lock held by khungtaskd/34:
 #0: ffffffff8e95cd20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
2 locks held by kworker/1:2/798:
4 locks held by kworker/u9:6/1116:
 #0: ffff88811e510140 ((wq_completion)wg-kex-wg0#17){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc9000780fc40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffff888011d7d3c0 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12f/0x830
 #3: ffff888026178d18 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x140/0x830
1 lock held by kworker/R-krxrp/3271:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0
4 locks held by kworker/1:3/5082:
1 lock held by dhcpcd/5361:
 #0: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x32b/0x1b30
2 locks held by getty/5443:
 #0: ffff8881754be0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffffc900034732e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0
4 locks held by kworker/1:4/5670:
1 lock held by kworker/1:5/5677:
5 locks held by kworker/u8:4/5885:
 #0: ffff8881012b5940 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc900075efc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8fdba268 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800
 #3: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x940
 #4: ffffffff8e963028 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2d0/0x770
2 locks held by kworker/1:10/10324:
2 locks held by kworker/1:12/10326:
3 locks held by kworker/0:12/15572:
 #0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc900200dfc40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20
3 locks held by kworker/0:13/15573:
 #0: ffff888100069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc9000feb7c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xab/0x1090
2 locks held by kworker/1:15/15581:
3 locks held by kworker/u9:5/15697:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc9000a837c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60
1 lock held by kworker/R-wg-cr/20438:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0
1 lock held by kworker/R-wg-cr/20439:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0
2 locks held by kworker/R-wg-cr/20440:
8 locks held by kworker/R-wg-cr/20524:
1 lock held by kworker/R-wg-cr/20526:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
1 lock held by kworker/R-wg-cr/20691:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
1 lock held by kworker/R-wg-cr/20692:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0
1 lock held by kworker/R-wg-cr/20693:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
3 locks held by kworker/R-wg-cr/20698:
1 lock held by kworker/R-wg-cr/20699:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
1 lock held by kworker/R-wg-cr/20700:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0
1 lock held by kworker/R-wg-cr/21162:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
1 lock held by kworker/R-wg-cr/21163:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
1 lock held by kworker/R-wg-cr/21164:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
2 locks held by kworker/R-wg-cr/21165:
1 lock held by kworker/R-wg-cr/21166:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
1 lock held by kworker/R-wg-cr/21167:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0
3 locks held by kworker/0:2/21339:
 #0: ffff88810006b140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860
 #1: ffffc90004567c40 (rx_mode_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860
 #2: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: netdev_rx_mode_work+0x19/0x3c0
2 locks held by kworker/R-wg-cr/21377:
1 lock held by kworker/R-wg-cr/21378:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0
1 lock held by kworker/R-wg-cr/21628:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
1 lock held by kworker/R-wg-cr/21629:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130
1 lock held by kworker/R-wg-cr/21630:
 #0: ffffffff8e7faf80 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0
7 locks held by syz-executor/21812:
 #0: ffff888172da2410 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x227/0xb90
 #1: ffff88803078fc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540
 #2: ffff88816e6b6a58 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540
 #3: ffffffff8f654720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370
 #4: ffff88811f811128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870
 #5: ffff88811f812258 (&devlink->lock_key#13){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x170
 #6: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0
4 locks held by syz-executor/21869:
 #0: ffff888172da2410 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x227/0xb90
 #1: ffff88801be1a480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540
 #2: ffff88816e6b6a58 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540
 #3: ffffffff8f654720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370
4 locks held by syz-executor/22063:
 #0: ffff888172da2410 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x227/0xb90
 #1: ffff88804f0ec880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540
 #2: ffff88816e6b6a58 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540
 #3: ffffffff8f654720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370
1 lock held by syz.3.6131/22091:
 #0: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3bc/0x1e10
1 lock held by syz.3.6131/22092:
 #0: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x32b/0x1b30
1 lock held by syz-executor/22099:
 #0: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0
1 lock held by syz-executor/22103:
 #0: ffffffff8fdc8f40 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 nmi_cpu_backtrace+0x274/0x2d0
 nmi_trigger_cpumask_backtrace+0x17a/0x300
 sys_info+0x135/0x170
 watchdog+0xfd3/0x1030
 kthread+0x389/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 21165 Comm: kworker/R-wg-cr Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: wg-crypt-wg0 wg_packet_encrypt_worker
RIP: 0010:timerqueue_linked_add+0x272/0x2e0
Code: 28 00 74 08 4c 89 ff e8 5c c7 8d f6 4d 89 2f 4c 89 ef 48 89 de e8 3e 5f ff ff 4d 8d 7d 18 4d 89 fe 49 c1 ee 03 41 80 3c 2e 00 <74> 08 4c 89 ff e8 44 c6 8d f6 49 83 3f 00 74 2f e8 f9 6e 22 f6 41
RSP: 0018:ffffc90000a07920 EFLAGS: 00000046
RAX: 1ffff1102d652460 RBX: ffff88823c628418 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff88823c628418 RDI: ffff88816b292300
RBP: dffffc0000000000 R08: ffff88816b292317 R09: 0000000000000000
R10: ffff88816b292308 R11: ffffed102d652463 R12: 1ffff110478c5078
R13: ffff88816b292300 R14: 1ffff1102d652463 R15: ffff88816b292318
FS:  0000000000000000(0000) GS:ffff8882a92a0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f945e68aa26 CR3: 000000000e74a000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 enqueue_hrtimer+0x18e/0x2c0
 __hrtimer_run_queues+0x4d2/0xa20
 hrtimer_interrupt+0x44b/0x950
 __sysvec_apic_timer_interrupt+0x102/0x430
 sysvec_apic_timer_interrupt+0x52/0xc0
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80
Code: f7 e8 ad 28 f8 f5 f7 c3 00 02 00 00 74 05 e8 b0 c2 23 f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> c4 a7 e9 f5 65 8b 05 8d dd 8d 07 85 c0 74 18 5b 41 5e c3 cc cc
RSP: 0018:ffffc90000a07c88 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000080000102
RDX: 0000000000000002 RSI: ffffffff8dfa4f3d RDI: 0000000000000001
RBP: ffffc90000a07de0 R08: ffffffff903037f7 R09: 1ffffffff20606fe
R10: dffffc0000000000 R11: fffffbfff20606ff R12: 1ffff110370494d5
R13: dffffc0000000000 R14: ffff8881b824a658 R15: ffff8881b824a6a8
 ref_tracker_alloc+0x2f1/0x4c0
 dst_init+0xd9/0x480
 dst_alloc+0x12a/0x170
 ip_route_output_key_hash_rcu+0x14d0/0x25d0
 ip_route_output_key_hash+0x18d/0x2a0
 ip_route_output_flow+0x2a/0x150
 ip_route_me_harder+0x742/0xf90
 synproxy_send_tcp+0x34c/0x670
 synproxy_send_client_synack+0x8c1/0xe30
 nft_synproxy_eval_v4+0x34a/0x4e0
 nft_synproxy_do_eval+0x305/0x580
 nft_do_chain+0x48d/0x1ae0
 nft_do_chain_inet+0x360/0x4b0
 nf_hook_slow+0xc5/0x220
 NF_HOOK+0x21f/0x3c0
 NF_HOOK+0x336/0x3c0
 process_backlog+0xaa3/0x1950
 __napi_poll+0xae/0x340
 net_rx_action+0x627/0xf70
 handle_softirqs+0x22a/0x840
 __irq_exit_rcu+0xca/0x220
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:finish_task_switch+0x427/0xbe0
Code: 41 c7 84 24 e0 0d 00 00 00 00 00 00 0f 1f 44 00 00 49 83 c4 48 4c 89 e7 e8 36 3a 15 0a e8 71 fd 38 00 fb 49 8d bd c8 16 00 00 <48> 89 f8 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 7b 03 00 00 41 80
RSP: 0018:ffffc90003fff0f0 EFLAGS: 00000206
RAX: 0000000000142dc5 RBX: 1ffff110478c77cc RCX: 0000000080000001
RDX: 0000000000000006 RSI: ffffffff8dfa4f3d RDI: ffff88811f0f16c8
RBP: ffffc90003fff150 R08: ffffffff903037f7 R09: 1ffffffff20606fe
R10: dffffc0000000000 R11: fffffbfff20606ff R12: ffff88823c63b0c8
R13: ffff88811f0f0000 R14: ffff88810ac95940 R15: dffffc0000000000
 __schedule+0x1829/0x5740
 preempt_schedule_irq+0x4d/0xa0
 irqentry_exit+0x14f/0x8b0
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:queue_work_on+0x162/0x1d0
Code: 00 4d 85 ed 75 16 e8 dd 93 38 00 eb 15 e8 d6 93 38 00 e8 61 51 1a 0a 4d 85 ed 74 ea e8 c7 93 38 00 fb 65 48 8b 05 3e dc aa 11 <48> 3b 44 24 18 75 56 89 d8 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f
RSP: 0018:ffffc90003fff490 EFLAGS: 00000293
RAX: 24d5eaab5a32b500 RBX: ffff88811f110d01 RCX: ffff88811f0f0000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: ffffffff903037f7 R09: 1ffffffff20606fe
R10: dffffc0000000000 R11: fffffbfff20606ff R12: 0000000000000000
R13: 0000000000000200 R14: 0000000000000000 R15: 0000000000800001
 wg_queue_enqueue_per_peer_tx+0x3c9/0x450
 wg_packet_encrypt_worker+0x1346/0x16f0
 process_scheduled_works+0xb5d/0x1860
 rescuer_thread+0x827/0x1130
 kthread+0x389/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
