INFO: task syz.2.944:9575 blocked for more than 153 seconds. Tainted: G L syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.944 state:D stack:27016 pid:9575 tgid:9569 ppid:5617 task_flags:0x40044c flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5402 [inline] __schedule+0x16f9/0x5500 kernel/sched/core.c:7204 __schedule_loop kernel/sched/core.c:7283 [inline] schedule+0x164/0x360 kernel/sched/core.c:7298 schedule_timeout+0xc3/0x2c0 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common kernel/sched/completion.c:121 [inline] wait_for_common kernel/sched/completion.c:132 [inline] wait_for_completion+0x2cc/0x5e0 kernel/sched/completion.c:153 exit_aio+0x319/0x3f0 fs/aio.c:981 __mmput+0x68/0x3e0 kernel/fork.c:1183 exit_mm+0x18e/0x250 kernel/exit.c:610 do_exit+0x6a2/0x22c0 kernel/exit.c:992 do_group_exit+0x21b/0x2d0 kernel/exit.c:1147 get_signal+0x1284/0x1330 kernel/signal.c:3038 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x33e/0x560 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f37d9b1ce59 RSP: 002b:00007f37d7d4d0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f37d9d96098 RCX: 00007f37d9b1ce59 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f37d9d96098 RBP: 00007f37d9d96090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f37d9d96128 R14: 00007ffd88c23420 R15: 00007ffd88c23508 Showing all locks held in the system: 2 locks held by ktimers/0/16: #0: ffffffff8de61600 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 1 lock held by rcub/0/19: #0: ffffffff8dfd0788 (rcu_state){+.+.}-{0:0}, at: rcu_boost kernel/rcu/tree_plugin.h:1206 [inline] #0: ffffffff8dfd0788 (rcu_state){+.+.}-{0:0}, at: rcu_boost_kthread+0x2fb/0x4b0 kernel/rcu/tree_plugin.h:1231 4 locks held by rcuc/0/21: #0: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 net/core/dev.c:6667 #2: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #2: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #2: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:242 [inline] #2: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:316 #3: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #3: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: alloc_from_new_slab+0x2f5/0x4a0 mm/slub.c:4396 7 locks held by ktimers/1/30: #0: ffffffff8de61600 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #2: ffff8880b87284b8 (&base->softirq_expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff8880b87284b8 (&base->softirq_expiry_lock){+...}-{3:3}, at: hrtimer_cpu_base_lock_expiry kernel/time/hrtimer.c:1650 [inline] #2: ffff8880b87284b8 (&base->softirq_expiry_lock){+...}-{3:3}, at: hrtimer_run_softirq+0x7f/0x260 kernel/time/hrtimer.c:2109 #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 #4: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #4: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #4: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 net/mac80211/util.c:807 #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __ieee80211_beacon_get+0x36/0x1860 net/mac80211/tx.c:5667 #6: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #6: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: alloc_from_new_slab+0x2f5/0x4a0 mm/slub.c:4396 5 locks held by ksoftirqd/1/31: #0: ffffffff8de61600 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163 #2: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #2: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #2: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 net/core/dev.c:6667 #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:242 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:316 #4: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #4: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: alloc_from_new_slab+0x2f5/0x4a0 mm/slub.c:4396 1 lock held by khungtaskd/39: #0: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6777 5 locks held by kworker/u8:4/68: #0: ffff888032a7a938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc9000153fc40 ((work_completion)(&(&forw_packet_aggr->delayed_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 #2: ffff88804057f1b8 (&hard_iface->bat_iv.ogm_buff_mutex){+.+.}-{4:4}, at: batadv_iv_ogm_schedule+0xe8/0x1020 net/batman-adv/bat_iv_ogm.c:903 #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule_buff net/batman-adv/bat_iv_ogm.c:867 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: batadv_iv_ogm_schedule+0x890/0x1020 net/batman-adv/bat_iv_ogm.c:904 #4: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #4: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: alloc_from_new_slab+0x2f5/0x4a0 mm/slub.c:4396 2 locks held by kworker/u8:7/750: #0: ffff88813fe84138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc90004cefc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 5 locks held by kworker/u8:12/1422: #0: ffff88813fe84138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc90006417c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 #2: ffff88803f150310 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbd0 drivers/net/netdevsim/dev.c:909 #3: ffff88803a5ebd20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #3: ffff88803a5ebd20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline] #3: ffff88803a5ebd20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbd0 drivers/net/netdevsim/dev.c:922 #4: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #4: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #4: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #4: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 3 locks held by kworker/u8:13/3337: #0: ffff88803d89b138 ((wq_completion)wg-kex-wg0#3){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc9000f7f7c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 #2: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: alloc_from_new_slab+0x2f5/0x4a0 mm/slub.c:4396 2 locks held by kworker/u8:14/3341: #0: ffff88813fe84138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc9000f8e7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 1 lock held by udevd/4981: #0: ffff8880376f4208 (&ep->lock){+.+.}-{3:3}, at: spin_lock_irq include/linux/spinlock_rt.h:96 [inline] #0: ffff8880376f4208 (&ep->lock){+.+.}-{3:3}, at: ep_poll fs/eventpoll.c:2321 [inline] #0: ffff8880376f4208 (&ep->lock){+.+.}-{3:3}, at: do_epoll_wait+0x843/0xbc0 fs/eventpoll.c:2785 2 locks held by getty/5368: #0: ffff888035b730a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc90003cd32e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13a0 drivers/tty/n_tty.c:2211 4 locks held by kworker/u9:4/5624: #0: ffff888083ec7938 ((wq_completion)hci7#2){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc9000487fc40 ((work_completion)(&hdev->cmd_work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 #2: ffffffff8e111030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline] #2: ffffffff8e111030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294 #3: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #3: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: __slab_free+0xf1/0x2a0 mm/slub.c:5592 3 locks held by kworker/1:4/5730: #0: ffff88813fe4b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc90004c2fc40 (drain_vmap_work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 #2: ffffffff8e0f1038 (vmap_purge_lock){+.+.}-{4:4}, at: drain_vmap_area_work+0x17/0x40 mm/vmalloc.c:2429 2 locks held by kworker/0:7/5822: #0: ffff88813fe4b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc900052efc40 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 2 locks held by kworker/u8:18/7937: #0: ffff88813fe84138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc9000ef3fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 2 locks held by kworker/u8:26/7945: #0: ffff88813fe84138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293 #1: ffffc9000efafc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294 1 lock held by syz.4.955/9597: #0: ffffffff8dfd0db0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz.5.956/9602: #0: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __update_page_owner_free_handle+0x2e/0x470 mm/page_owner.c:283 1 lock held by syz.3.958/9608: #0: ffffffff8dfd0db0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 1 lock held by syz.1.959/9621: #0: ffffffff8dfd0db0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 kernel/rcu/tree.c:3828 4 locks held by syz-executor/9628: #0: ffff8880703f0f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline] #0: ffff8880703f0f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716 #1: ffff8880703f00b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5359 #2: ffffffff8f502a98 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline] #2: ffffffff8f502a98 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2736 #3: ffff888032ccf370 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x92/0x570 net/bluetooth/l2cap_core.c:1779 3 locks held by syz-executor/9637: #0: ffff88802aeb0f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline] #0: ffff88802aeb0f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716 #1: ffff88802aeb00b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5359 #2: ffffffff8f502a98 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline] #2: ffffffff8f502a98 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2736 3 locks held by syz-executor/9643: #0: ffff888044384f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline] #0: ffff888044384f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716 #1: ffff8880443840b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5359 #2: ffffffff8f502a98 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2151 [inline] #2: ffffffff8f502a98 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 net/bluetooth/hci_conn.c:2736 1 lock held by syz-executor/9668: #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: write_lock_irq include/linux/rwlock_rt.h:115 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: exit_notify kernel/exit.c:772 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: do_exit+0x79d/0x22c0 kernel/exit.c:1016 2 locks held by syz-executor/9670: #0: ffff888035de8f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline] #0: ffff888035de8f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5a0 net/bluetooth/hci_core.c:2716 #1: ffff888035de80b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x10e0 net/bluetooth/hci_sync.c:5359 2 locks held by syz-executor/9674: #0: ffffffff8f370540 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:575 #1: ffffffff8f37fa78 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146 5 locks held by syz-executor/9678: #0: ffffffff8f370540 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:575 #1: ffffffff8f37fa78 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146 #2: ffff88804f704628 (&idev->mc_lock){+.+.}-{4:4}, at: __ipv6_dev_mc_inc+0x4e/0xa50 net/ipv6/mcast.c:943 #3: ffffffff8e111030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline] #3: ffffffff8e111030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294 #4: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #4: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: __slab_free+0xf1/0x2a0 mm/slub.c:5592 1 lock held by udevd/9704: #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: write_lock_irq include/linux/rwlock_rt.h:115 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: exit_notify kernel/exit.c:772 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: do_exit+0x79d/0x22c0 kernel/exit.c:1016 1 lock held by udevd/9724: #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: write_lock_irq include/linux/rwlock_rt.h:115 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: exit_notify kernel/exit.c:772 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: do_exit+0x79d/0x22c0 kernel/exit.c:1016 10 locks held by udevd/9725: #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: write_lock_irq include/linux/rwlock_rt.h:115 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: exit_notify kernel/exit.c:772 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: do_exit+0x79d/0x22c0 kernel/exit.c:1016 #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #1: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rt_write_lock+0x86/0x220 kernel/locking/spinlock_rt.c:244 #2: ffff888037614498 (&sighand->siglock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff888037614498 (&sighand->siglock){+.+.}-{3:3}, at: do_notify_parent+0xa8a/0xe60 kernel/signal.c:2230 #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 #4: ffff888037614520 (&sighand->signalfd_wqh){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #4: ffff888037614520 (&sighand->signalfd_wqh){+.+.}-{3:3}, at: __wake_up_common_lock+0x2f/0x1e0 kernel/sched/wait.c:124 #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 #6: ffff8880376f4208 (&ep->lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #6: ffff8880376f4208 (&ep->lock){+.+.}-{3:3}, at: ep_poll_callback+0x79/0x800 fs/eventpoll.c:1462 #7: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #7: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #7: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #7: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 #8: ffff8880376f40d8 (&ep->wq){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #8: ffff8880376f40d8 (&ep->wq){+.+.}-{3:3}, at: __wake_up_common_lock+0x2f/0x1e0 kernel/sched/wait.c:124 #9: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #9: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #9: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline] #9: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57 1 lock held by udevd/9727: #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: write_lock_irq include/linux/rwlock_rt.h:115 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: exit_notify kernel/exit.c:772 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: do_exit+0x79d/0x22c0 kernel/exit.c:1016 1 lock held by udevd/9728: #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: write_lock_irq include/linux/rwlock_rt.h:115 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: exit_notify kernel/exit.c:772 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: do_exit+0x79d/0x22c0 kernel/exit.c:1016 1 lock held by udevd/9730: #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: write_lock_irq include/linux/rwlock_rt.h:115 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: exit_notify kernel/exit.c:772 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: do_exit+0x79d/0x22c0 kernel/exit.c:1016 6 locks held by syz-executor/9738: #0: ffff888035bc8480 (sb_writers#4){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:494 #1: ffff88804010bf30 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1069 [inline] #1: ffff88804010bf30 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: __start_dirop fs/namei.c:2914 [inline] #1: ffff88804010bf30 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: start_dirop fs/namei.c:2938 [inline] #1: ffff88804010bf30 (&type->i_mutex_dir_key#3/1){+.+.}-{4:4}, at: filename_create+0x200/0x370 fs/namei.c:4939 #2: ffff888035be4108 (&journal->j_state_lock){++++}-{3:3}, at: write_lock include/linux/rwlock_rt.h:92 [inline] #2: ffff888035be4108 (&journal->j_state_lock){++++}-{3:3}, at: start_this_handle+0x130d/0x2290 fs/jbd2/transaction.c:389 #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #3: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rt_write_lock+0x86/0x220 kernel/locking/spinlock_rt.c:244 #4: ffffffff8e782dc0 (fill_pool_map-wait-type-override){+.+.}-{3:3}, at: debug_objects_fill_pool+0xa7/0x110 lib/debugobjects.c:751 #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline] #5: ffffffff8dfcabc0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa6/0x2550 arch/x86/kernel/unwind_orc.c:495 1 lock held by modprobe/9739: #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: write_lock_irq include/linux/rwlock_rt.h:115 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: exit_notify kernel/exit.c:772 [inline] #0: ffffffff8dc0a0a8 (tasklist_lock){++++}-{3:3}, at: do_exit+0x79d/0x22c0 kernel/exit.c:1016 3 locks held by modprobe/9740: #0: ffff8880320cacb0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:554 [inline] #0: ffff8880320cacb0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x237/0x4f0 mm/util.c:579 #1: ffffffff8e111030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline] #1: ffffffff8e111030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294 #2: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #2: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: __slab_free+0xf1/0x2a0 mm/slub.c:5592 2 locks held by modprobe/9741: #0: ffffffff8e111030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline] #0: ffffffff8e111030 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294 #1: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline] #1: ffff88801eaf6858 (&n->list_lock){+.+.}-{3:3}, at: __slab_free+0xf1/0x2a0 mm/slub.c:5592 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:119 nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd3/0x1030 kernel/hung_task.c:561 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64 Code: 6b 61 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 93 8f 1c 00 fb f4 0c cb 03 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 RSP: 0018:ffffc900001e7e20 EFLAGS: 00000246 RAX: 0000000000259a17 RBX: ffffffff8199d71a RCX: 0000000080000001 RDX: 0000000000000001 RSI: ffffffff8d63c144 RDI: ffffffff8ba9cd80 RBP: ffffc900001e7f10 R08: ffff8880b8733d5b R09: 1ffff110170e67ab R10: dffffc0000000000 R11: ffffed10170e67ac R12: 0000000000000001 R13: 1ffff11003adeba0 R14: 0000000000000001 R15: 1ffff11003adeba0 FS: 0000000000000000(0000) GS:ffff888125fec000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056166fc2b120 CR3: 0000000037640000 CR4: 00000000003526f0 Call Trace: arch_safe_halt arch/x86/kernel/process.c:766 [inline] default_idle+0x9/0x20 arch/x86/kernel/process.c:767 default_idle_call+0x72/0xb0 kernel/sched/idle.c:122 cpuidle_idle_call kernel/sched/idle.c:199 [inline] do_idle+0x36a/0x5f0 kernel/sched/idle.c:352 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:451 start_secondary+0x101/0x110 arch/x86/kernel/smpboot.c:312 common_startup_64+0x13e/0x157