INFO: task syz-executor:28625 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22352 pid:28625 tgid:28625 ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x17d9/0x56c0
 schedule+0x164/0x2b0
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7bf/0x1550
 del_device_store+0xd6/0x370
 kernfs_fop_write_iter+0x3a4/0x540
 vfs_write+0x612/0xba0
 ksys_write+0x150/0x270
 do_syscall_64+0x174/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbed515d68e
RSP: 002b:00007ffca86e7ba8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055556f5c0500 RCX: 00007fbed515d68e
RDX: 0000000000000001 RSI: 00007ffca86e7c30 RDI: 0000000000000005
RBP: 00007fbed52336f2 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffca86e7c30 R14: 00007fbed5f44620 R15: 0000000000000003
 </TASK>
INFO: task syz-executor:28635 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22920 pid:28635 tgid:28635 ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 __schedule+0x17d9/0x56c0
 schedule+0x164/0x2b0
 schedule_preempt_disabled+0x13/0x30
 __mutex_lock+0x7bf/0x1550
 del_device_store+0xd6/0x370
 kernfs_fop_write_iter+0x3a4/0x540
 vfs_write+0x612/0xba0
 ksys_write+0x150/0x270
 do_syscall_64+0x174/0x580
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faf3d95d68e
RSP: 002b:00007ffcd525e638 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055555b99e500 RCX: 00007faf3d95d68e
RDX: 0000000000000001 RSI: 00007ffcd525e6c0 RDI: 0000000000000005
RBP: 00007faf3da336f2 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffcd525e6c0 R14: 00007faf3e744620 R15: 0000000000000003
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/35:
 #0: ffffffff8e959c20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
2 locks held by getty/5435:
 #0: ffff88810dddd0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffffc900034762e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360
4 locks held by kworker/u8:2/5439:
 #0: ffff8881012bd940 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc90004edfc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffffffff8fddc068 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810
 #3: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
3 locks held by kworker/0:11/21133:
1 lock held by syz.1.5792/28221:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
1 lock held by syz.0.5796/28241:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
1 lock held by syz-executor/28258:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
1 lock held by syz.5.5800/28390:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
1 lock held by syz.3.5807/28405:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
1 lock held by syz.6.5813/28465:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
1 lock held by syz-executor/28469:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
1 lock held by syz.8.5815/28552:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
1 lock held by syz-executor/28560:
 #0: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
7 locks held by syz-executor/28620:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff8881abcfc080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370
 #4: ffff888173f73128 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880
 #5: ffff888173f72258 (&devlink->lock_key){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x170
 #6: ffffffff8e95fdf8 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530
4 locks held by syz-executor/28625:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff8881ad306480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370
4 locks held by syz-executor/28635:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff8881a2606880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370
9 locks held by kworker/0:1/28682:
4 locks held by syz-executor/28684:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff88819ea64c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370
4 locks held by syz-executor/28691:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff8881b29b5080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370
4 locks held by syz-executor/28722:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff88816b648c80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370
4 locks held by syz-executor/28744:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff8881ad6e8480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370
4 locks held by syz-executor/28749:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff8881ae17ac80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370
3 locks held by kworker/u11:4/28755:
 #0: ffff8881b3983940 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #1: ffffc900037ffc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa20/0x14e0
 #2: ffff8881a24a0ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x1cb/0x3f0
4 locks held by syz-executor/28782:
 #0: ffff88810eae8450 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22b/0xba0
 #1: ffff88816d071880 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d8/0x540
 #2: ffff88816f7252d8 (kn->active#48){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22b/0x540
 #3: ffffffff8f667720 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 35 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150
 nmi_cpu_backtrace+0x274/0x2d0
 nmi_trigger_cpumask_backtrace+0x17a/0x380
 sys_info+0x135/0x170
 watchdog+0xfd7/0x1030
 kthread+0x388/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 28682 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Workqueue: wg-kex-wg1 wg_packet_handshake_receive_worker
RIP: 0010:__refill_objects_node+0x41a/0x600
Code: 00 00 41 0f b7 c7 41 39 f4 41 0f 92 c7 29 c3 74 64 41 39 f4 73 5f 44 89 e0 48 ff c0 89 d9 4d 89 6c c0 f8 8b 57 28 4a 8b 14 2a <66> 90 4c 39 f0 41 0f 92 c7 41 ff c4 89 cb ff cb 74 3f 49 89 d5 4c
RSP: 0018:ffffc90000006c20 EFLAGS: 00000297
RAX: 0000000000000008 RBX: 0000000000000001 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 000000000000001c RDI: ffff888166759b40
RBP: ffffc90000006cf0 R08: ffff88810ea6de20 R09: ffffea0000cab590
R10: dffffc0000000000 R11: fffffbfff20659bf R12: 0000000000000007
R13: ffff888032ad6f00 R14: 000000000000001c R15: 0000000800100001
FS:  0000000000000000(0000) GS:ffff88818dc2c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3296dd CR3: 000000000e746000 CR4: 00000000000006f0
Call Trace:
 <IRQ>
 refill_objects+0x56/0x350
 __pcs_replace_empty_main+0x2bf/0x6b0
 kmem_cache_alloc_noprof+0x382/0x5f0
 dst_alloc+0x105/0x170
 ip_route_output_key_hash_rcu+0x14ac/0x2720
 ip_route_output_key_hash+0x18d/0x2a0
 ip_route_output_flow+0x2a/0x150
 ip_route_me_harder+0x762/0xfe0
 synproxy_send_tcp+0x347/0x670
 synproxy_send_client_synack+0x89b/0xde0
 nft_synproxy_eval_v4+0x362/0x4e0
 nft_synproxy_do_eval+0x335/0x550
 nft_do_chain+0x48d/0x1b10
 nft_do_chain_inet+0x360/0x4b0
 nf_hook_slow+0xc5/0x220
 NF_HOOK+0x21f/0x3c0
 NF_HOOK+0x336/0x3c0
 process_backlog+0xa34/0x1860
 __napi_poll+0xaa/0x330
 net_rx_action+0x61d/0xf50
 handle_softirqs+0x225/0x840
 __irq_exit_rcu+0xca/0x220
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:curve25519_generic+0x5d5/0xa470
Code: 0f be f8 48 8b 84 24 60 08 00 00 48 8b 8c 24 b0 08 00 00 48 89 ca 48 31 c2 48 21 fa 48 31 d0 48 31 ca 48 89 84 24 60 08 00 00 <48> 89 94 24 b0 08 00 00 48 8b 84 24 58 08 00 00 48 8b 8c 24 a8 08
RSP: 0018:ffffc90003a9e460 EFLAGS: 00000206
RAX: 00067d8ce0d3e0e9 RBX: ffffc90003a9eca0 RCX: 00067d8ce0d3e0e9
RDX: 0004a1cc02d83944 RSI: 0006259e401945f5 RDI: ffffffffffffffff
RBP: ffffc90003a9eff0 R08: 00059aa363ceacd6 R09: 0000969db899fe5f
R10: 0002d4bc7699de77 R11: 0000000000000000 R12: 06881e533cc12de9
R13: 0dae3ded2b9f731f R14: fffff52000753cc8 R15: ffffc90003a9eb20
 curve25519+0x5191/0x51a0
 wg_noise_handshake_create_response+0x2c8/0x9f0
 wg_packet_send_handshake_response+0x110/0x2d0
 wg_packet_handshake_receive_worker+0x6a9/0x10c0
 process_scheduled_works+0xa8e/0x14e0
 worker_thread+0xa47/0xfb0
 kthread+0x388/0x470
 ret_from_fork+0x514/0xb70
 ret_from_fork_asm+0x1a/0x30
 </TASK>
