INFO: task syz.2.195:6618 blocked for more than 144 seconds.
      Not tainted 6.17.0-rc1-syzkaller-00207-g815957293639 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.195       state:D stack:26360 pid:6618  tgid:6613  ppid:5850   task_flags:0x400140 flags:0x00004006
Call Trace:
 <TASK>
 __schedule+0x1798/0x4cc0
 schedule+0x165/0x360
 __lock_sock+0x14e/0x2b0
 lock_sock_nested+0x9f/0x100
 mptcp_sendmsg+0x11a/0x1970
 __sock_sendmsg+0xe5/0x270
 ____sys_sendmsg+0x505/0x830
 ___sys_sendmsg+0x21f/0x2a0
 __x64_sys_sendmsg+0x19b/0x260
 do_syscall_64+0xfa/0x3b0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f394518ebe9
RSP: 002b:00007f394601e038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f39453b6180 RCX: 00007f394518ebe9
RDX: 0000000024000059 RSI: 0000200000000000 RDI: 000000000000000a
RBP: 00007f3945211e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f39453b6218 R14: 00007f39453b6180 R15: 00007ffeb81a3d48
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/34:
 #0: ffffffff8e139ee0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180
3 locks held by kworker/u9:7/1093:
 #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
 #1: ffffc90006fa7bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
 #2: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60
2 locks held by getty/5674:
 #0: ffff888028b710a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70
 #1: ffffc900029062f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400
3 locks held by kworker/u8:2/5676:
 #0: ffff888020c49148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
 #1: ffffc90002f9fbc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
 #2: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30
3 locks held by kworker/1:5/5901:
 #0: ffff88801a482148 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
 #1: ffffc900047afbc0 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
 #2: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x15/0x50
6 locks held by kworker/u8:4/5912:
 #0: ffff88801b2f7148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0
 #1: ffffc9000482fbc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0
 #2: ffffffff8f52adf0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800
 #3: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1c/0x1d0
 #4: ffff88802f9214e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_netns_pre_exit+0xb0/0x1d0
 #5: ffffffff8e13f978 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730
8 locks held by syz.2.195/6615:
1 lock held by syz.2.195/6618:
 #0: ffff888112504d58 (sk_lock-AF_INET6){+.+.}-{0:0}, at: mptcp_sendmsg+0x11a/0x1970
5 locks held by syz-executor/6641:
 #0: ffff888123d50dc0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x510
 #1: ffff888123d500b8 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x66a/0x1330
 #2: ffffffff8f69c988 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x230
 #3: ffff8881069d7338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x70/0x680
 #4: ffffffff8e13f978 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730
2 locks held by syz-executor/6647:
 #0: ffffffff8f52adf0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0
 #1: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x990
2 locks held by syz-executor/6649:
 #0: ffffffff8f52adf0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0
 #1: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1c/0x1d0
1 lock held by syz-executor/6658:
 #0: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70
2 locks held by syz-executor/6664:
 #0: ffffffff8f52adf0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0
 #1: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: register_nexthop_notifier+0x80/0x210
2 locks held by syz-executor/6667:
 #0: ffffffff8f52adf0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x304/0x4d0
 #1: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0
1 lock held by syz-executor/6678:
 #0: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0
1 lock held by syz-executor/6686:
 #0: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0
1 lock held by syz-executor/6688:
 #0: ffffffff8f537c48 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3b0/0x18b0

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 34 Comm: khungtaskd Not tainted 6.17.0-rc1-syzkaller-00207-g815957293639 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250
 nmi_cpu_backtrace+0x39e/0x3d0
 nmi_trigger_cpumask_backtrace+0x17a/0x300
 watchdog+0xf93/0xfe0
 kthread+0x711/0x8a0
 ret_from_fork+0x3fc/0x770
 ret_from_fork_asm+0x1a/0x30
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6615 Comm: syz.2.195 Not tainted 6.17.0-rc1-syzkaller-00207-g815957293639 #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:__lock_acquire+0xa4f/0xd20
Code: e5 ff 90 0f 0b 90 90 90 31 c0 48 8b 3c 24 48 83 78 40 00 0f 84 8c 02 00 00 41 8b 46 20 25 ff 1f 00 00 48 0f a3 05 91 9a 0a 12 <73> 10 48 69 c0 c8 00 00 00 48 8d 80 10 03 49 93 eb 40 83 3d f8 29
RSP: 0018:ffffc900001df490 EFLAGS: 00000003
RAX: 0000000000000007 RBX: 0000000000000005 RCX: 00000000fe09d4ff
RDX: 00000000105209fd RSI: 000000005a44979c RDI: ffff888105e1b980
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff81eeb0ff
R10: dffffc0000000000 R11: ffffffff81eeb070 R12: 0000000000004008
R13: ffff888105e1c470 R14: ffff888105e1c538 R15: 0ac0d5affe09d4ff
FS:  00007f394603f6c0(0000) GS:ffff8881a3c1c000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055c9a16cf680 CR3: 0000000109f44000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 lock_acquire+0x120/0x360
 perf_event_output_forward+0xb0/0x430
 __perf_event_overflow+0x7cf/0xe10
 perf_swevent_hrtimer+0x3c5/0x550
 __hrtimer_run_queues+0x4e0/0xc60
 hrtimer_interrupt+0x45b/0xaa0
 __sysvec_apic_timer_interrupt+0x10b/0x410
 sysvec_apic_timer_interrupt+0x52/0xc0
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:stack_trace_consume_entry+0xf3/0x280
Code: 8b 74 24 08 48 8b 1f 45 8d 79 01 0f b6 44 15 00 84 c0 0f 85 3a 01 00 00 45 89 38 4e 8d 3c cb 4c 89 f8 48 c1 e8 03 80 3c 10 00 <74> 1a 4c 89 ff 48 89 f3 49 89 d4 4c 89 c5 e8 5a dc 76 00 49 89 e8
RSP: 0018:ffffc900001dfdb8 EFLAGS: 00000246
RAX: 1ffff9200003c010 RBX: ffffc900001dff40 RCX: 6410180db2f65700
RDX: dffffc0000000000 RSI: ffffffff89eff55e RDI: ffffc900001dfec0
RBP: 1ffff9200003bfda R08: ffffc900001dfed0 R09: 0000000000000028
R10: ffffc900001dfe58 R11: ffffffff81ac3870 R12: 0000000000000000
R13: 1ffff9200003bfd9 R14: ffffc900001dfec8 R15: ffffc900001e0080
 arch_stack_walk+0x110/0x150
 stack_trace_save+0x9c/0xe0
 kasan_save_track+0x3e/0x80
 __kasan_kmalloc+0x93/0xb0
 __kmalloc_noprof+0x27a/0x4f0
 cfg80211_inform_single_bss_data+0x905/0x1ac0
 cfg80211_inform_bss_data+0x1fb/0x3b30
 cfg80211_inform_bss_frame_data+0x3d7/0x730
 ieee80211_bss_info_update+0x746/0x9e0
 ieee80211_scan_rx+0x593/0xa20
 ieee80211_rx_list+0x201c/0x2a90
 ieee80211_rx_napi+0x1a8/0x3d0
 ieee80211_handle_queued_frames+0xe8/0x1f0
 tasklet_action_common+0x36c/0x580
 handle_softirqs+0x286/0x870
 __irq_exit_rcu+0xca/0x1f0
 irq_exit_rcu+0x9/0x30
 sysvec_apic_timer_interrupt+0xa6/0xc0
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:lock_acquire+0x180/0x360
Code: 24 30 00 02 00 00 0f 85 cd 00 00 00 f7 44 24 08 00 02 00 00 74 01 fb 65 48 8b 05 eb e3 02 11 48 3b 44 24 58 0f 85 f2 00 00 00 <48> 83 c4 60 5b 41 5c 41 5d 41 5e 41 5f 5d e9 8d df de 09 cc 65 8b
RSP: 0018:ffffc90008016ab8 EFLAGS: 00000246
RAX: 6410180db2f65700 RBX: 0000000000000000 RCX: 6410180db2f65700
RDX: 0000000000000000 RSI: ffffffff8dba6149 RDI: ffffffff8be33400
RBP: ffffffff8172c195 R08: 0000000000000000 R09: ffffffff8172c195
R10: dffffc0000000000 R11: ffffffff81ac3870 R12: 0000000000000002
R13: ffffffff8e139ee0 R14: 0000000000000000 R15: 0000000000000246
 unwind_next_frame+0xc2/0x2390
 arch_stack_walk+0x11c/0x150
 stack_trace_save+0x9c/0xe0
 save_stack+0xf5/0x1f0
 __reset_page_owner+0x71/0x1f0
 __free_frozen_pages+0xbc4/0xd30
 pagetable_dtor_free+0x2d2/0x3b0
 __mmdrop+0xb5/0x580
 finish_task_switch+0x3ee/0x950
 __schedule+0x17a0/0x4cc0
 preempt_schedule_irq+0xb5/0x150
 irqentry_exit+0x6f/0x90
 asm_sysvec_apic_timer_interrupt+0x1a/0x20
RIP: 0010:__reset_page_owner+0x8b/0x1f0
Code: c7 e8 99 c3 01 00 bf 00 20 00 00 e8 8f 01 00 00 44 0f b7 e5 4c 89 f7 89 c6 44 89 e2 4c 89 f9 e8 7b 03 00 00 8b 2d 85 d7 85 17 <89> df 89 ee e8 0c 3d 93 ff 39 eb 75 0a e8 43 3b 93 ff e9 ad 00 00
RSP: 0018:ffffc90008017450 EFLAGS: 00000287
RAX: 0000000000000000 RBX: 000000000616027a RCX: 6410180db2f65700
RDX: 0000000000000003 RSI: ffffffff8dba6149 RDI: ffff888105e1b980
RBP: 0000000001420001 R08: ffff88801bcbab37 R09: 1ffff11003797566
R10: dffffc0000000000 R11: ffffed1003797567 R12: 0000000000000003
R13: 0000000000000000 R14: ffffea0000a95400 R15: 0000003633ab9179
 __free_frozen_pages+0xbc4/0xd30
 __put_partials+0x156/0x1a0
 put_cpu_partial+0x17c/0x250
 __slab_free+0x2d5/0x3c0
 qlist_free_all+0x97/0x140
 kasan_quarantine_reduce+0x148/0x160
 __kasan_slab_alloc+0x22/0x80
 __kmalloc_cache_noprof+0x1be/0x3d0
 tcp_sendmsg_fastopen+0x1de/0x5e0
 mptcp_sendmsg_fastopen+0x17d/0x580
 mptcp_sendmsg+0x176c/0x1970
 __sock_sendmsg+0xe5/0x270
 ____sys_sendmsg+0x505/0x830
 ___sys_sendmsg+0x21f/0x2a0
 __x64_sys_sendmsg+0x19b/0x260
 do_syscall_64+0xfa/0x3b0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f394518ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f394603f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f39453b6090 RCX: 00007f394518ebe9
RDX: 0000000024000059 RSI: 0000200000000000 RDI: 000000000000000a
RBP: 00007f3945211e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f39453b6128 R14: 00007f39453b6090 R15: 00007ffeb81a3d48
 </TASK>
