INFO: task kworker/1:3:2256 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:3     state:D stack:22616 pid:2256  tgid:2256  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_power_efficient crda_timeout_work
Call Trace:
 <TASK>
 __schedule+0x17db/0x58f0
 schedule+0x164/0x2b0
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7c1/0x1550
 crda_timeout_work+0x16/0x80
 process_scheduled_works+0xc3d/0x1630
 worker_thread+0xa47/0xfb0
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
INFO: task kworker/u9:7:7180 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u9:7    state:D stack:26376 pid:7180  tgid:7180  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 __schedule+0x17db/0x58f0
 schedule+0x164/0x2b0
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7c1/0x1550
 linkwatch_event+0xe/0x60
 process_scheduled_works+0xc3d/0x1630
 worker_thread+0xa47/0xfb0
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
INFO: task syz.1.468:7685 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.468       state:D stack:24872 pid:7685  tgid:7685  ppid:5589   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x17db/0x58f0
 schedule+0x164/0x2b0
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7c1/0x1550
 netdev_run_todo+0x6e4/0x1060
 tun_chr_close+0x13c/0x1c0
 __fput+0x418/0xa50
 task_work_run+0x1d9/0x270
 exit_to_user_mode_loop+0x204/0x770
 do_syscall_64+0x328/0x520
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f06b419e159
RSP: 002b:00007fff26849db8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f06b4427da0 RCX: 00007f06b419e159
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f06b4427da0 R08: 0000000000000006 R09: 0000000000000000
R10: 000000000003fc80 R11: 0000000000000246 R12: 000000000001782a
R13: 00007f06b442609c R14: 000000000001753c R15: 00007f06b4426090
 </TASK>
INFO: task syz.2.484:7751 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.484       state:D stack:24648 pid:7751  tgid:7751  ppid:5597   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x17db/0x58f0
 schedule+0x164/0x2b0
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7c1/0x1550
 tun_chr_close+0x3e/0x1c0
 __fput+0x418/0xa50
 task_work_run+0x1d9/0x270
 exit_to_user_mode_loop+0x204/0x770
 do_syscall_64+0x328/0x520
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe8f519e159
RSP: 002b:00007ffe6dfce898 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fe8f5427da0 RCX: 00007fe8f519e159
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fe8f5427da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007fe8f5427cb0 R11: 0000000000000246 R12: 0000000000017d6c
R13: 00007fe8f542636c R14: 0000000000017a6c R15: 00007fe8f5426360
 </TASK>

Showing all locks held in the system:
locks held by kworker/u10:0/28: 2, last CPU#1:
 #0: ffff8881000ab940 ((wq_completion)events_dfl_long){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90000a37c40 ((work_completion)(&(&ipvs->defense_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
locks held by khungtaskd/36: 1, last CPU#1:
 #0: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
locks held by kworker/1:3/2256: 3, on CPU#1:
 #0: ffff888100069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90008987c40 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffffffff90253220 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x16/0x80
locks held by jbd2/sda1-8/5003: 2, last CPU#0:
 #0: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60
 #1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x4a0
locks held by syslogd/5023: 2, last CPU#0:
 #0: ffffffff8f4f1938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_path_perm+0x251/0x560
 #1: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60
locks held by udevd/5041: 4, last CPU#1:
 #0: ffffffff8ee363b0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10f/0x480
 #1: ffff88810dded038 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0
 #2: ffff888022d536b8 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0
 #3: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60
locks held by getty/5418: 2, on CPU#0:
 #0: ffff88816a9790a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffffc900034832e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360
locks held by kworker/u8:3/5646: 5, last CPU#0:
 #0: ffff88817790b140 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90004e97c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: netif_receive_skb_list_internal+0x501/0xcf0
 #3: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0xa2/0x3f0
 #4: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0xa2/0x3f0
locks held by kworker/1:5/6105: 2, last CPU#1:
 #0: ffff888111aced40 ((wq_completion)wg-crypt-wg0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90007a2fc40 ((work_completion)(&peer->transmit_packet_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
locks held by kworker/u10:13/6394: 3, last CPU#0:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc9000670fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffff88810d98f258 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb40
locks held by kworker/u8:4/6406: 3, on CPU#0:
 #0: ffff888177690940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc9000661fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffffffff90253220 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30
locks held by kworker/1:7/6674: 3, last CPU#1:
 #0: ffff888100069d40 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90003acfc40 ((work_completion)(&(&gc_work->dwork)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: gc_worker+0x274/0x1890
locks held by kworker/0:10/6686: 5, last CPU#0:
 #0: ffff888177406d40 ((wq_completion)mld){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90003a0fc40 ((work_completion)(&(&idev->mc_ifc_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffff88810d276530 (&idev->mc_lock){+.+.}-{4:4}, at: mld_ifc_work+0x2d/0xd60
 #3: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: mld_newpack+0x2d4/0xcb0
 #4: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: ipv6_get_lladdr+0x2b/0x3f0
locks held by kworker/u8:7/6932: 2, last CPU#1:
 #0: ffff888020e56140 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc900027efc40 ((work_completion)(&(&cp->cp_send_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
locks held by kworker/u9:7/7180: 3, on CPU#1:
 #0: ffff8881000ac140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90020b8fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #2: ffffffff90253220 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60
locks held by kworker/0:18/7679: 2, last CPU#0:
 #0: ffff88801f9d0540 ((wq_completion)wg-kex-wg1#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
 #1: ffffc90006a77c40 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630
locks held by syz.1.468/7685: 1, on CPU#1:
 #0: ffffffff90253220 (rtnl_mutex){+.+.}-{4:4}, at: netdev_run_todo+0x6e4/0x1060
locks held by syz.2.484/7751: 1, on CPU#1:
 #0: ffffffff90253220 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0
locks held by syz.0.489/7771: 2, on CPU#1:
 #0: ffffffff90253220 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0
 #1: ffffffff8ebe9930 (cpu_hotplug_lock){++++}-{0:0}, at: unregister_netdevice_many_notify+0xcac/0x2140
locks held by syz-executor/7775: 2, last CPU#1:
 #0: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60
 #1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550
locks held by syz-executor/7778: 2, last CPU#1:
 #0: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60
 #1: ffffffff8ed5c8e0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550
locks held by syz-executor/7779: 3, last CPU#1:
 #0: ffff88816908b2e0 (&sig->cred_guard_mutex){+.+.}-{4:4}, at: bprm_execve+0xbc/0x1590
 #1: ffffffff8f4f1938 (tomoyo_ss){.+.+}-{0:0}, at: tomoyo_bprm_check_security+0xef/0x180
 #2: ffffffff8eeac3f0 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 36 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 nmi_cpu_backtrace+0x274/0x2d0
 nmi_trigger_cpumask_backtrace+0x17d/0x390
 sys_info+0x135/0x170
 watchdog+0xfd7/0x1030
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 5646 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: bat_events batadv_tt_purge
RIP: 0010:__dev_queue_xmit+0x13b0/0x3820
Code: 00 4c 89 f0 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 f7 e8 aa a2 85 f8 4d 8b 36 4c 89 f6 48 83 e6 03 <31> ff e8 79 a0 15 f8 49 83 e6 03 0f 84 a9 00 00 00 e8 aa 9a 15 f8
RSP: 0018:ffffc900000068e0 EFLAGS: 00000246
RAX: 1ffff1102f00a7b2 RBX: 1ffff1102f00a7b0 RCX: dffffc0000000000
RDX: 8000000000000300 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000006b98 R08: 0000000000000100 R09: 0000000000000002
R10: 0000000000004888 R11: 8000000000000300 R12: 0000000100000000
R13: ffff888178053c00 R14: 0000000000000000 R15: ffff88816ffc4000
FS:  0000000000000000(0000) GS:ffff88818d6cd000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f35a1455ff8 CR3: 0000000105bc6000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 br_dev_queue_push_xmit+0x370/0x4b0
 NF_HOOK+0x64e/0x6e0
 br_nf_post_routing+0xa51/0xee0
 nf_hook_slow+0xc5/0x220
 NF_HOOK+0x23e/0x3f0
 br_forward_finish+0xd3/0x130
 br_nf_forward_finish+0xa76/0xea0
 NF_HOOK+0x64e/0x6e0
 br_nf_forward_ip+0x7e7/0xa30
 nf_hook_slow+0xc5/0x220
 NF_HOOK+0x23e/0x3f0
 __br_forward+0x397/0x540
 br_flood+0x3e3/0x8d0
 br_handle_frame_finish+0x1119/0x1950
 br_nf_hook_thresh+0x3dd/0x4c0
 br_nf_pre_routing_finish_ipv6+0x90c/0xc40
 br_nf_pre_routing_ipv6+0x382/0x6f0
 br_handle_frame+0x1329/0x1600
 __netif_receive_skb_core+0x989/0x30c0
 process_backlog+0x727/0x18b0
 __napi_poll+0xaa/0x330
 net_rx_action+0x61d/0xf50
 handle_softirqs+0x226/0x860
 do_softirq+0x77/0xd0
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x140
 batadv_tt_purge+0x4ee/0xa40
 process_scheduled_works+0xc3d/0x1630
 worker_thread+0xa47/0xfb0
 kthread+0x38b/0x480
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
