INFO: task jbd2/sda1-8:5160 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:jbd2/sda1-8 state:D stack:25288 pid:5160 tgid:5160 ppid:2 task_flags:0x240040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7026
jbd2_journal_wait_updates+0x11e/0x240 fs/jbd2/transaction.c:843
jbd2_journal_commit_transaction+0x828/0x68f0 fs/jbd2/commit.c:454
kjournald2+0x1f4/0x760 fs/jbd2/journal.c:201
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task syz-executor:5815 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:21784 pid:5815 tgid:5815 ppid:5814 task_flags:0x400100 flags:0x00080003
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7026
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083
rwsem_down_write_slowpath+0x521/0x1310 kernel/locking/rwsem.c:1185
__down_write_common kernel/locking/rwsem.c:1317 [inline]
__down_write kernel/locking/rwsem.c:1326 [inline]
down_write+0x1d6/0x200 kernel/locking/rwsem.c:1591
ext4_da_map_blocks fs/ext4/inode.c:1956 [inline]
ext4_da_get_block_prep+0x69e/0x11e0 fs/ext4/inode.c:2020
__block_write_begin_int+0x4f4/0x16d0 fs/buffer.c:2145
block_page_mkwrite+0x3d3/0x4b0 fs/buffer.c:2639
ext4_page_mkwrite+0x1362/0x1880 fs/ext4/inode.c:6704
do_page_mkwrite+0x174/0x380 mm/memory.c:3489
do_shared_fault mm/memory.c:5792 [inline]
do_fault mm/memory.c:5854 [inline]
do_pte_missing+0x29d/0x3ba0 mm/memory.c:4362
handle_pte_fault mm/memory.c:6195 [inline]
__handle_mm_fault+0x1556/0x2aa0 mm/memory.c:6336
handle_mm_fault+0x589/0xd10 mm/memory.c:6505
do_user_addr_fault+0x60c/0x1370 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x64/0xc0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0033:0x7faa97c7631f
RSP: 002b:00007ffc3720e9f0 EFLAGS: 00010202
RAX: 00007faa96354000 RBX: 00007ffc3720eef0 RCX: 0000000000000006
RDX: 1ffffffff165caa6 RSI: 000055558f666888 RDI: 0000000000000040
RBP: 000055558f640bf0 R08: 000055558f666888 R09: 0000000000003954
R10: 00007faa97c00000 R11: 0000000000000246 R12: 00007ffc3720ed40
R13: 00007ffc3720eb30 R14: 00007ffc3720edc0 R15: 00007ffc3720ea50
INFO: task kworker/u10:16:13651 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u10:16 state:D stack:23544 pid:13651 tgid:13651 ppid:2 task_flags:0x4248160 flags:0x00080000
Workqueue: ext4-rsv-conversion ext4_end_io_rsv_work
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7026
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083
rwsem_down_write_slowpath+0x521/0x1310 kernel/locking/rwsem.c:1185
__down_write_common kernel/locking/rwsem.c:1317 [inline]
__down_write kernel/locking/rwsem.c:1326 [inline]
down_write+0x1d6/0x200 kernel/locking/rwsem.c:1591
ext4_map_blocks+0x46f/0x1400 fs/ext4/inode.c:810
ext4_convert_unwritten_extents+0x2ab/0x4c0 fs/ext4/extents.c:4976
ext4_convert_unwritten_io_end_vec+0x127/0x280 fs/ext4/extents.c:5016
ext4_end_io_end+0xd5/0x4a0 fs/ext4/page-io.c:199
ext4_do_flush_completed_IO fs/ext4/page-io.c:290 [inline]
ext4_end_io_rsv_work+0x205/0x380 fs/ext4/page-io.c:305
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
process_scheduled_works kernel/workqueue.c:3346 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task syz.0.5276:21717 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.5276 state:D stack:25912 pid:21717 tgid:21716 ppid:20215 task_flags:0x400140 flags:0x00080003
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7026
schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121
__flush_work+0x7d7/0xcc0 kernel/workqueue.c:4273
flush_work kernel/workqueue.c:4294 [inline]
flush_rcu_work+0x74/0xd0 kernel/workqueue.c:4332
kvfree_rcu_barrier+0x107/0x1d0 mm/slab_common.c:2118
kmem_cache_destroy+0x2c/0x180 mm/slab_common.c:495
destroy_ai+0x908/0xdc0 drivers/mtd/ubi/attach.c:1360
ubi_attach+0x9d3/0x4be0 drivers/mtd/ubi/attach.c:1646
ubi_attach_mtd_dev+0x15a7/0x35d0 drivers/mtd/ubi/build.c:1004
ctrl_cdev_ioctl+0x337/0x3d0 drivers/mtd/ubi/cdev.c:1113
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f798858f6c9
RSP: 002b:00007f79893e2038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f79887e5fa0 RCX: 00007f798858f6c9
RDX: 0000000000000000 RSI: 0000000040186f40 RDI: 0000000000000002
RBP: 00007f7988611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f79887e6038 R14: 00007f79887e5fa0 R15: 00007ffe7e23f2d8
INFO: task syz.0.5276:21720 blocked for more than 145 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.5276 state:D stack:29096 pid:21720 tgid:21716 ppid:20215 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5325 [inline]
__schedule+0x1190/0x5de0 kernel/sched/core.c:6929
__schedule_loop kernel/sched/core.c:7011 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:7026
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083
__mutex_lock_common kernel/locking/mutex.c:676 [inline]
__mutex_lock+0x818/0x1060 kernel/locking/mutex.c:760
ctrl_cdev_ioctl+0x1ea/0x3d0 drivers/mtd/ubi/cdev.c:1138
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f798858f6c9
RSP: 002b:00007f79893c1038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f79887e6090 RCX: 00007f798858f6c9
RDX: 0000000000000000 RSI: 0000000040046f41 RDI: 0000000000000002
RBP: 00007f7988611f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f79887e6128 R14: 00007f79887e6090 R15: 00007ffe7e23f2d8
Showing all locks held in the system:
4 locks held by kworker/R-kvfre/6:
1 lock held by khungtaskd/31:
#0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
#0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
3 locks held by kworker/R-ipv6_/3185:
#0: ffff88802ffc6148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc9000b407c98 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffffffff900eae08 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#2: ffffffff900eae08 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734
6 locks held by kworker/R-bat_e/3410:
4 locks held by syz-executor/5815:
#0: ffff888078c081c8 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x117/0x530 mm/mmap_lock.c:238
#1: ffff88814e1ec518 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x174/0x380 mm/memory.c:3489
#2: ffff8880671b3ee0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1045 [inline]
#2: ffff8880671b3ee0 (mapping.invalidate_lock#2){++++}-{4:4}, at: ext4_page_mkwrite+0x353/0x1880 fs/ext4/inode.c:6685
#3: ffff8880671b3bd0 (&ei->i_data_sem){++++}-{4:4}, at: ext4_da_map_blocks fs/ext4/inode.c:1956 [inline]
#3: ffff8880671b3bd0 (&ei->i_data_sem){++++}-{4:4}, at: ext4_da_get_block_prep+0x69e/0x11e0 fs/ext4/inode.c:2020
3 locks held by kworker/1:3/5816:
#0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc90003f9fd00 ((work_completion)(&(&ovs_net->masks_rebalance)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffffffff9060e8c8 (ovs_mutex){+.+.}-{4:4}, at: ovs_lock net/openvswitch/datapath.c:108 [inline]
#2: ffffffff9060e8c8 (ovs_mutex){+.+.}-{4:4}, at: ovs_dp_masks_rebalance+0x24/0xf0 net/openvswitch/datapath.c:2561
3 locks held by kworker/0:3/5881:
2 locks held by kworker/0:4/5888:
2 locks held by kworker/0:5/5961:
1 lock held by syz.2.1435/12251:
1 lock held by syz.2.1435/12252:
3 locks held by kworker/1:1/12490:
#0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc9000b1ffd00 ((work_completion)(&(&ovs_net->masks_rebalance)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffffffff9060e8c8 (ovs_mutex){+.+.}-{4:4}, at: ovs_lock net/openvswitch/datapath.c:108 [inline]
#2: ffffffff9060e8c8 (ovs_mutex){+.+.}-{4:4}, at: ovs_dp_masks_rebalance+0x24/0xf0 net/openvswitch/datapath.c:2561
4 locks held by kworker/u10:0/13432:
#0: ffff88802993c148 ((wq_completion)wg-kex-wg1#25){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc90003097d00 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff88803bfdd308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0xec/0x610 drivers/net/wireguard/noise.c:529
#3: ffff888021775278 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x100/0x610 drivers/net/wireguard/noise.c:530
5 locks held by kworker/u11:0/13433:
#0: ffff88807d5ab948 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc90003067d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff88803d490dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331
#3: ffff88803d4900b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x13f/0xb20 net/bluetooth/hci_sync.c:5684
#4: ffffffff9035ed48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2104 [inline]
#4: ffffffff9035ed48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x14f/0x330 net/bluetooth/hci_conn.c:1324
3 locks held by kworker/u10:1/13435:
4 locks held by kworker/u10:2/13437:
3 locks held by kworker/u10:3/13447:
3 locks held by kworker/u10:4/13448:
4 locks held by kworker/u11:1/13451:
#0: ffff888032319148 ((wq_completion)hci2){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc9000472fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff88802a058dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331
#3: ffff88802a0580b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x13f/0xb20 net/bluetooth/hci_sync.c:5684
3 locks held by kworker/u10:5/13583:
3 locks held by kworker/u10:6/13593:
6 locks held by kworker/u10:7/13631:
3 locks held by kworker/u10:8/13634:
3 locks held by kworker/u10:9/13635:
3 locks held by kworker/u10:10/13636:
3 locks held by kworker/u10:11/13637:
3 locks held by kworker/u10:12/13638:
3 locks held by kworker/u10:13/13639:
6 locks held by kworker/u10:14/13649:
3 locks held by kworker/u10:15/13650:
4 locks held by kworker/u10:16/13651:
#0: ffff88814de5e148 ((wq_completion)ext4-rsv-conversion){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc9000b687d00 ((work_completion)(&ei->i_rsv_conversion_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff88814e1f0950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0x5e4/0x1410 fs/jbd2/transaction.c:444
#3: ffff8880671b3bd0 (&ei->i_data_sem){++++}-{4:4}, at: ext4_map_blocks+0x46f/0x1400 fs/ext4/inode.c:810
3 locks held by kworker/u10:17/13652:
4 locks held by kworker/u10:18/13653:
4 locks held by kworker/u10:19/13654:
4 locks held by kworker/u10:20/13655:
4 locks held by kworker/u10:21/13656:
2 locks held by getty/14369:
#0: ffff88814d4f50a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc900157792f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
4 locks held by kworker/u10:22/15133:
3 locks held by kworker/u10:23/15134:
3 locks held by kworker/u10:24/15135:
4 locks held by kworker/0:0/18712:
4 locks held by kworker/1:0/20488:
#0: ffff88802c89cd48 ((wq_completion)wg-kex-wg1#20){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc9000ae67d00 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff88805af85308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x880 drivers/net/wireguard/noise.c:598
#3: ffff888066d80d20 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x880 drivers/net/wireguard/noise.c:632
3 locks held by kworker/1:2/20659:
#0: ffff88813ff16948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc90003157d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffffffff900eae08 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x91/0x11f0 net/wireless/reg.c:2453
4 locks held by kworker/0:2/21263:
2 locks held by syz.6.5267/21649:
#0: ffffffff900d49d0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x2d6/0x690 net/core/net_namespace.c:576
#1: ffffffff900eae08 (rtnl_mutex){+.+.}-{4:4}, at: ipmr_net_exit_batch+0x15/0xa0 net/ipv4/ipmr.c:3276
1 lock held by syz.7.5270/21698:
#0: ffffffff900d49d0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x2d6/0x690 net/core/net_namespace.c:576
1 lock held by syz.0.5276/21717:
#0: ffffffff8f429de8 (ubi_devices_mutex){+.+.}-{4:4}, at: ctrl_cdev_ioctl+0x2ed/0x3d0 drivers/mtd/ubi/cdev.c:1112
1 lock held by syz.0.5276/21720:
#0: ffffffff8f429de8 (ubi_devices_mutex){+.+.}-{4:4}, at: ctrl_cdev_ioctl+0x1ea/0x3d0 drivers/mtd/ubi/cdev.c:1138
6 locks held by kworker/u11:5/21733:
#0: ffff8880794bf148 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
#1: ffffc90004a97d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
#2: ffff88802b6f8dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 net/bluetooth/hci_sync.c:331
#3: ffff88802b6f80b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x13f/0xb20 net/bluetooth/hci_sync.c:5684
#4: ffffffff9035ed48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2104 [inline]
#4: ffffffff9035ed48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x14f/0x330 net/bluetooth/hci_conn.c:1324
#5: ffff888031633338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x730 net/bluetooth/l2cap_core.c:1763
2 locks held by kworker/0:6/21736:
4 locks held by kworker/u10:25/21737:
4 locks held by kworker/u10:26/21741:
2 locks held by kworker/u10:27/21742:
3 locks held by kworker/u10:28/21743:
1 lock held by kworker/u10:29/21744:
1 lock held by dhcpcd/21759:
#0: ffff88807b9d0260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1679 [inline]
#0: ffff88807b9d0260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 net/packet/af_packet.c:3197
1 lock held by dhcpcd/21760:
#0: ffff888033430260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1679 [inline]
#0: ffff888033430260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 net/packet/af_packet.c:3197
1 lock held by dhcpcd/21761:
#0: ffff888033432260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1679 [inline]
#0: ffff888033432260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 net/packet/af_packet.c:3197
1 lock held by dhcpcd/21762:
#0: ffff888033436260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1679 [inline]
#0: ffff888033436260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 net/packet/af_packet.c:3197
1 lock held by dhcpcd/21763:
#0: ffff88802463c260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1679 [inline]
#0: ffff88802463c260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 net/packet/af_packet.c:3197
1 lock held by dhcpcd/21764:
#0: ffff888024638260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1679 [inline]
#0: ffff888024638260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 net/packet/af_packet.c:3197
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
watchdog+0xf3f/0x1170 kernel/hung_task.c:495
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 3410 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: bat_events batadv_dat_purge
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:118 [inline]
RIP: 0010:lock_acquire kernel/locking/lockdep.c:5844 [inline]
RIP: 0010:lock_acquire+0x102/0x350 kernel/locking/lockdep.c:5825
Code: 65 ff 0d 71 dc 08 12 0f 85 4f ff ff ff e8 96 7a 93 ff e9 45 ff ff ff 48 8b 74 24 68 48 89 df e8 94 84 8b 00 8b 0d 52 25 ea 0e <85> c9 0f 84 b1 00 00 00 65 8b 05 d7 1d 09 12 85 c0 0f 85 a2 00 00
RSP: 0000:ffffc90000007588 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffffff8e3c45e0 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff816bb3e1 RDI: fffffbfff1c788bc
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 00000000000123cc R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888124a0d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c9347fa CR3: 000000000e182000 CR4: 00000000003526f0
Call Trace:
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:867 [inline]
class_rcu_constructor include/linux/rcupdate.h:1195 [inline]
unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
kasan_save_track+0x14/0x30 mm/kasan/common.c:77
__kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2543 [inline]
slab_free mm/slub.c:6642 [inline]
kmem_cache_free+0x2d4/0x6c0 mm/slub.c:6752
kfree_skbmem+0x1a4/0x1f0 net/core/skbuff.c:1110
__kfree_skb net/core/skbuff.c:1167 [inline]
sk_skb_reason_drop+0x136/0x1a0 net/core/skbuff.c:1204
kfree_skb_reason include/linux/skbuff.h:1322 [inline]
kfree_skb include/linux/skbuff.h:1331 [inline]
ip6_mc_input+0x82c/0xf60 net/ipv6/ip6_input.c:593
dst_input include/net/dst.h:474 [inline]
dst_input include/net/dst.h:472 [inline]
ip6_rcv_finish net/ipv6/ip6_input.c:79 [inline]
NF_HOOK include/linux/netfilter.h:318 [inline]
NF_HOOK include/linux/netfilter.h:312 [inline]
ipv6_rcv+0x497/0x650 net/ipv6/ip6_input.c:311
__netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6079
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6192
process_backlog+0x439/0x15e0 net/core/dev.c:6544
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7594
napi_poll net/core/dev.c:7657 [inline]
net_rx_action+0x97f/0xef0 net/core/dev.c:7784
handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
do_softirq kernel/softirq.c:523 [inline]
do_softirq+0xb2/0xf0 kernel/softirq.c:510
__local_bh_enable_ip+0x100/0x120 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:396 [inline]
__batadv_dat_purge.part.0+0x279/0x3a0 net/batman-adv/distributed-arp-table.c:185
__batadv_dat_purge net/batman-adv/distributed-arp-table.c:166 [inline]
batadv_dat_purge+0x4b/0xa0 net/batman-adv/distributed-arp-table.c:204
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
process_scheduled_works kernel/workqueue.c:3346 [inline]
rescuer_thread+0x620/0xea0 kernel/workqueue.c:3523
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
net_ratelimit: 6238 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:56:a9:27:36:51:cf, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:56:a9:27:36:51:cf, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:56:a9:27:36:51:cf, vlan:0)