INFO: task kworker/u8:5:974 blocked for more than 143 seconds. Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:5 state:D stack:23536 pid:974 tgid:974 ppid:2 flags:0x00004000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 cangw_pernet_exit_batch+0x15/0xa0 net/can/gw.c:1257 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 cleanup_net+0x5b7/0xbb0 net/core/net_namespace.c:640 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task kworker/u8:10:2518 blocked for more than 144 seconds. Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:10 state:D stack:23760 pid:2518 tgid:2518 ppid:2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 linkwatch_event+0x51/0xc0 net/core/link_watch.c:276 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 INFO: task syz-executor:15416 blocked for more than 144 seconds. Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:25024 pid:15416 tgid:15416 ppid:1 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 rtnl_lock net/core/rtnetlink.c:79 [inline] rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1357 netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x47f/0x4e0 net/socket.c:2204 __do_sys_sendto net/socket.c:2216 [inline] __se_sys_sendto net/socket.c:2212 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2212 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb1b9f7b74c RSP: 002b:00007ffca9965360 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fb1bac44620 RCX: 00007fb1b9f7b74c RDX: 000000000000003c RSI: 00007fb1bac44670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffca99653b4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fb1bac44670 R15: 0000000000000000 INFO: task syz.0.4735:15483 blocked for more than 145 seconds. Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.4735 state:D stack:27472 pid:15483 tgid:15479 ppid:5260 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 tun_detach drivers/net/tun.c:698 [inline] tun_chr_close+0x3e/0x230 drivers/net/tun.c:3510 __fput+0x408/0xbb0 fs/file_table.c:422 task_work_run+0x14e/0x250 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xaa3/0x2bb0 kernel/exit.c:882 do_group_exit+0xd3/0x2a0 kernel/exit.c:1031 get_signal+0x25fd/0x2770 kernel/signal.c:2917 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1b1a5799b9 RSP: 002b:00007f1b1b40e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 00007f1b1a716058 RCX: 00007f1b1a5799b9 RDX: 0000000020000940 RSI: 00000000000089f3 RDI: 0000000000000003 RBP: 00007f1b1a5e78d8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f1b1a716058 R15: 00007ffffeaced08 INFO: task syz-executor:15498 blocked for more than 145 seconds. Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:27072 pid:15498 tgid:15498 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 register_nexthop_notifier+0x1b/0x70 net/ipv4/nexthop.c:3872 ops_init+0xb9/0x650 net/core/net_namespace.c:139 setup_net+0x435/0xb40 net/core/net_namespace.c:343 copy_net_ns+0x2fb/0x700 net/core/net_namespace.c:508 create_new_namespaces+0x3ea/0xad0 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228 ksys_unshare+0x419/0x970 kernel/fork.c:3328 __do_sys_unshare kernel/fork.c:3399 [inline] __se_sys_unshare kernel/fork.c:3397 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3397 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fa67257b117 RSP: 002b:00007fffbc8a25e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fa672715f40 RCX: 00007fa67257b117 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007fa672716a38 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000000c R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000009 INFO: task syz-executor:15504 blocked for more than 146 seconds. Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:27072 pid:15504 tgid:15504 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 register_nexthop_notifier+0x1b/0x70 net/ipv4/nexthop.c:3872 ops_init+0xb9/0x650 net/core/net_namespace.c:139 setup_net+0x435/0xb40 net/core/net_namespace.c:343 copy_net_ns+0x2fb/0x700 net/core/net_namespace.c:508 create_new_namespaces+0x3ea/0xad0 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228 ksys_unshare+0x419/0x970 kernel/fork.c:3328 __do_sys_unshare kernel/fork.c:3399 [inline] __se_sys_unshare kernel/fork.c:3397 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3397 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f7dafd7b117 RSP: 002b:00007ffe26f3c218 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f7daff15f40 RCX: 00007f7dafd7b117 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007f7daff16a38 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000000c R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000009 INFO: task syz-executor:15510 blocked for more than 147 seconds. Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:27008 pid:15510 tgid:15510 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 register_nexthop_notifier+0x1b/0x70 net/ipv4/nexthop.c:3872 ops_init+0xb9/0x650 net/core/net_namespace.c:139 setup_net+0x435/0xb40 net/core/net_namespace.c:343 copy_net_ns+0x2fb/0x700 net/core/net_namespace.c:508 create_new_namespaces+0x3ea/0xad0 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228 ksys_unshare+0x419/0x970 kernel/fork.c:3328 __do_sys_unshare kernel/fork.c:3399 [inline] __se_sys_unshare kernel/fork.c:3397 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3397 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f920df7b117 RSP: 002b:00007fff434af408 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f920e115f40 RCX: 00007f920df7b117 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007f920e116a38 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000000c R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000009 INFO: task syz-executor:15513 blocked for more than 147 seconds. Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:26208 pid:15513 tgid:15513 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5188 [inline] __schedule+0xe37/0x5490 kernel/sched/core.c:6529 __schedule_loop kernel/sched/core.c:6606 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6621 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6678 __mutex_lock_common kernel/locking/mutex.c:684 [inline] __mutex_lock+0x5b8/0x9c0 kernel/locking/mutex.c:752 register_nexthop_notifier+0x1b/0x70 net/ipv4/nexthop.c:3872 ops_init+0xb9/0x650 net/core/net_namespace.c:139 setup_net+0x435/0xb40 net/core/net_namespace.c:343 copy_net_ns+0x2fb/0x700 net/core/net_namespace.c:508 create_new_namespaces+0x3ea/0xad0 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228 ksys_unshare+0x419/0x970 kernel/fork.c:3328 __do_sys_unshare kernel/fork.c:3399 [inline] __se_sys_unshare kernel/fork.c:3397 [inline] __x64_sys_unshare+0x31/0x40 kernel/fork.c:3397 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f765417b117 RSP: 002b:00007ffc80e98208 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f7654315f40 RCX: 00007f765417b117 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007f7654316a38 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 000000000000000c R13: 0000000000000003 R14: 0000000000000009 R15: 0000000000000009 Showing all locks held in the system: 5 locks held by kworker/1:0/25: 1 lock held by khungtaskd/30: #0: ffffffff8ddb5ba0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:326 [inline] #0: ffffffff8ddb5ba0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline] #0: ffffffff8ddb5ba0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x75/0x340 kernel/locking/lockdep.c:6626 4 locks held by kworker/u8:5/974: #0: ffff8880166e3148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc9000413fd80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fa0cbd0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xbb/0xbb0 net/core/net_namespace.c:594 #3: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: cangw_pernet_exit_batch+0x15/0xa0 net/can/gw.c:1257 5 locks held by kworker/1:2/1176: 3 locks held by kworker/u8:10/2518: #0: ffff888015889148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc900092efd80 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:276 2 locks held by getty/4975: #0: ffff88802b5a60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc900031232f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xfc8/0x1490 drivers/tty/n_tty.c:2211 2 locks held by kworker/1:3/5301: 2 locks held by kworker/1:5/5313: 3 locks held by kworker/u8:0/13670: #0: ffff88802ab85948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1277/0x1b40 kernel/workqueue.c:3206 #1: ffffc900033f7d80 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1b40 kernel/workqueue.c:3207 #2: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734 1 lock held by syz-executor/15416: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 2 locks held by syz.2.4722/15457: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3e/0x230 drivers/net/tun.c:3510 #1: ffffffff8fb1d828 (flowtable_lock){+.+.}-{3:3}, at: nf_flow_table_cleanup+0x81/0x3d0 net/netfilter/nf_flow_table_core.c:593 1 lock held by syz.0.4735/15483: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3e/0x230 drivers/net/tun.c:3510 1 lock held by syz.1.4736/15487: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3e/0x230 drivers/net/tun.c:3510 1 lock held by syz.4.4740/15496: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3e/0x230 drivers/net/tun.c:3510 2 locks held by syz-executor/15498: #0: ffffffff8fa0cbd0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2d6/0x700 net/core/net_namespace.c:504 #1: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x1b/0x70 net/ipv4/nexthop.c:3872 2 locks held by syz-executor/15504: #0: ffffffff8fa0cbd0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2d6/0x700 net/core/net_namespace.c:504 #1: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x1b/0x70 net/ipv4/nexthop.c:3872 2 locks held by syz-executor/15510: #0: ffffffff8fa0cbd0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2d6/0x700 net/core/net_namespace.c:504 #1: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x1b/0x70 net/ipv4/nexthop.c:3872 2 locks held by syz-executor/15513: #0: ffffffff8fa0cbd0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2d6/0x700 net/core/net_namespace.c:504 #1: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x1b/0x70 net/ipv4/nexthop.c:3872 1 lock held by syz-executor/15519: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15524: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15530: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15535: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15538: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15541: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15553: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15559: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15566: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15572: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 1 lock held by syz-executor/15579: #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:79 [inline] #0: ffffffff8fa22368 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6644 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] watchdog+0xf0c/0x1240 kernel/hung_task.c:379 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 26 Comm: kworker/1:0H Not tainted 6.11.0-rc3-syzkaller-00156-gd7a5aa4b3c00 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Workqueue: kblockd blk_mq_requeue_work RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x70 kernel/kcov.c:209 Code: be b0 01 00 00 e8 a0 ff ff ff 31 c0 c3 cc cc cc cc 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1e fa 65 48 8b 15 d4 62 79 7e 65 8b 05 d5 62 79 7e a9 00 01 RSP: 0000:ffffc90000a181b0 EFLAGS: 00000082 RAX: 0000000000010102 RBX: ffffffff869ca63e RCX: ffffffff8134153e RDX: ffff8880182f3c00 RSI: 0000000000000000 RDI: 0000000000000007 RBP: ffffc90000a18250 R08: 0000000000000007 R09: 0000000000000000 R10: ffffffff869ca63e R11: 0000000000000000 R12: ffffc90000a181c0 R13: ffffffff817615a0 R14: ffffc90000a18280 R15: ffff8880182f3c00 FS: 0000000000000000(0000) GS:ffff8880b9300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2c6fdff8 CR3: 000000000db7c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0xd8/0x170 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kfree+0x12a/0x3b0 mm/slub.c:4594 dummy_timer+0x1750/0x38d0 drivers/usb/gadget/udc/dummy_hcd.c:1981 __run_hrtimer kernel/time/hrtimer.c:1689 [inline] __hrtimer_run_queues+0x20c/0xcc0 kernel/time/hrtimer.c:1753 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1815 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline] __sysvec_apic_timer_interrupt+0x10f/0x450 arch/x86/kernel/apic/apic.c:1049 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x43/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:mac80211_hwsim_rx+0x199/0x6c0 drivers/net/wireless/virtual/mac80211_hwsim.c:1745 Code: 0f 85 db 04 00 00 48 83 83 48 3f 00 00 01 48 8d bb 58 3f 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 90 04 00 00 48 8d 7d 70 4c 8b a3 58 3f 00 00 48 b8 00 00 00 RSP: 0000:ffffc90000a18a60 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff888023a4b0a0 RCX: ffffffff869c7fd3 RDX: 1ffff11004749dff RSI: ffffc90000a18bc0 RDI: ffff888023a4eff8 RBP: ffff88802a3ed000 R08: 00061fc2d386e753 R09: 000000c3a3f4f147 R10: 00061fc2d386e753 R11: 000000c3a3f4f147 R12: ffff88807ae08c50 R13: 1ffff9200014314f R14: 0000000000000080 R15: ffff888023a4b0b8 mac80211_hwsim_tx_frame_no_nl.isra.0+0xbfe/0x12f0 drivers/net/wireless/virtual/mac80211_hwsim.c:1876 mac80211_hwsim_tx_frame+0x1eb/0x2a0 drivers/net/wireless/virtual/mac80211_hwsim.c:2215 __mac80211_hwsim_beacon_tx drivers/net/wireless/virtual/mac80211_hwsim.c:2232 [inline] mac80211_hwsim_beacon_tx+0x592/0xa00 drivers/net/wireless/virtual/mac80211_hwsim.c:2315 __iterate_interfaces+0x2d0/0x5d0 net/mac80211/util.c:772 ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:808 mac80211_hwsim_beacon+0x105/0x200 drivers/net/wireless/virtual/mac80211_hwsim.c:2345 __run_hrtimer kernel/time/hrtimer.c:1689 [inline] __hrtimer_run_queues+0x20c/0xcc0 kernel/time/hrtimer.c:1753 hrtimer_run_softirq+0x17d/0x350 kernel/time/hrtimer.c:1770 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline] sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1043 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:__might_resched+0x4/0x5e0 kernel/sched/core.c:8418 Code: 8d 00 e9 50 ff ff ff 48 c7 c7 34 14 13 90 e8 73 47 8d 00 eb a4 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> b8 00 00 00 00 00 fc ff df 41 57 41 56 41 55 41 89 f5 41 54 49 RSP: 0000:ffffc90000a0fcc0 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888018286100 RCX: ffffffff815527d5 RDX: 0000000000000000 RSI: 0000000000000cc0 RDI: ffffffff8b4bb0c0 RBP: 0000000000000001 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880182f3c00 R13: 0000000000000000 R14: 0000000000000000 R15: ffff888016eb3c00 process_one_work+0xbc0/0x1b40 kernel/workqueue.c:3264 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244