INFO: task kworker/u8:68:11889 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:68 state:D stack:20520 pid:11889 tgid:11889 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: netns cleanup_net
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x171d/0x5800 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7668
rt_mutex_slowlock_block+0x540/0x6a0 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:562 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:580
rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
netdev_run_todo+0x2fc/0x1060 net/core/dev.c:11826
nsim_destroy+0x42b/0x800 drivers/net/netdevsim/netdev.c:1205
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1472
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1710
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:963
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:584
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task syz.7.2137:12557 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.7.2137 state:D stack:22664 pid:12557 tgid:12557 ppid:10524 task_flags:0x40044c flags:0x00080003
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x171d/0x5800 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7668
rt_mutex_slowlock_block+0x540/0x6a0 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:562 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:580
rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
netdev_run_todo+0x2fc/0x1060 net/core/dev.c:11826
tun_detach drivers/net/tun.c:656 [inline]
tun_chr_close+0x13f/0x1c0 drivers/net/tun.c:3592
__fput+0x41f/0xa80 fs/file_table.c:512
fput_close_sync+0x11f/0x240 fs/file_table.c:618
filp_close_sync+0x6e/0xa0 fs/open.c:1573
close_files fs/file.c:572 [inline]
put_files_struct+0x233/0x3d0 fs/file.c:584
do_exit+0x715/0x2340 kernel/exit.c:984
do_group_exit+0x22d/0x2f0 kernel/exit.c:1130
get_signal+0x121b/0x12c0 kernel/signal.c:3112
arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f97b6f1e559
RSP: 002b:00007ffc3d7aa9f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007ffc3d7aaae0 RCX: 00007f97b6f1e559
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00000000000708f8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2cb20000 R11: 0000000000000246 R12: 00007ffc3d7aab20
R13: 00007f97b71a5fac R14: 0000000000070a45 R15: 00007f97b71a5fa0
INFO: task syz-executor:12572 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
Blocked by coredump.
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:19832 pid:12572 tgid:12572 ppid:1 task_flags:0x40054c flags:0x00080003
Call Trace:
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x171d/0x5800 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7668
rt_mutex_slowlock_block+0x540/0x6a0 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:562 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:580
rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
netdev_run_todo+0x2fc/0x1060 net/core/dev.c:11826
tun_detach drivers/net/tun.c:656 [inline]
tun_chr_close+0x13f/0x1c0 drivers/net/tun.c:3592
__fput+0x41f/0xa80 fs/file_table.c:512
fput_close_sync+0x11f/0x240 fs/file_table.c:618
filp_close_sync+0x6e/0xa0 fs/open.c:1573
close_files fs/file.c:572 [inline]
put_files_struct+0x233/0x3d0 fs/file.c:584
do_exit+0x715/0x2340 kernel/exit.c:984
do_group_exit+0x22d/0x2f0 kernel/exit.c:1130
get_signal+0x121b/0x12c0 kernel/signal.c:3112
arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f03fb47ed8e
RSP: 002b:00007ffe11dce038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 0000000000000028 RBX: 0000555575196500 RCX: 00007f03fb47ed8e
RDX: 0000000000000028 RSI: 00007f03fc274670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffe11dce0b4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f03fc274670 R15: 0000000000000000
Showing all locks held in the system:
locks held by rcuc/0/19: 3, last CPU#0:
#0: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#1: ffff8880b843dc40 ((process_queue_bh_lock)){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#1: ffff8880b843dc40 ((process_queue_bh_lock)){+...}-{3:3}, at: process_backlog+0x4d4/0xc50 net/core/dev.c:6768
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
locks held by rcuc/1/27: 4, last CPU#1:
#0: ffffffff8f259580 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#1: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#2: ffffffff8f3c3ea0 (rcu_callback){....}-{0:0}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#2: ffffffff8f3c3ea0 (rcu_callback){....}-{0:0}, at: rcu_cpu_kthread+0x217/0x1740 kernel/rcu/tree.c:3000
#3: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
#3: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
locks held by khungtaskd/38: 1, last CPU#0:
#0: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871
locks held by kworker/u8:17/3327: 3, on CPU#1:
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc9000e65fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc9000e65fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc9000e65fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc9000e65fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
locks held by getty/5345: 2, on CPU#0:
#0: ffff8880372c00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900044db2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
locks held by kworker/u8:26/10005: 2, last CPU#1:
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc9000a317c40 ((work_completion)(&pool->idle_cull_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc9000a317c40 ((work_completion)(&pool->idle_cull_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc9000a317c40 ((work_completion)(&pool->idle_cull_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc9000a317c40 ((work_completion)(&pool->idle_cull_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
locks held by kworker/u8:35/10018: 2, on CPU#1:
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88813fe2c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc9000773fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc9000773fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc9000773fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc9000773fc40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
locks held by kworker/u8:38/10022: 3, on CPU#1:
#0: ffff888033966138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff888033966138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff888033966138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff888033966138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc900078ffc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc900078ffc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc900078ffc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc900078ffc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline]
#2: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4770
locks held by kworker/u8:63/11884: 4, last CPU#1:
#0: ffff888034068938 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff888034068938 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff888034068938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff888034068938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc90006cdfc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90006cdfc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90006cdfc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc90006cdfc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#3: ffff8880b853dc40 ((process_queue_bh_lock)){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff8880b853dc40 ((process_queue_bh_lock)){+...}-{3:3}, at: process_backlog+0x4d4/0xc50 net/core/dev.c:6768
locks held by kworker/u8:68/11889: 6, on CPU#1:
#0: ffff88801bef0938 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88801bef0938 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88801bef0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#0: ffff88801bef0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#1: ffffc90006d6fc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc90006d6fc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc90006d6fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3361 [inline]
#1: ffffc90006d6fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3479
#2: ffffffff907c90a0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677
#3: ffff888026ad0160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#3: ffff888026ad0160 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline]
#3: ffff888026ad0160 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x420 net/devlink/core.c:581
#4: ffff8880269b4310 (&devlink->lock_key){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:314 [inline]
#4: ffff8880269b4310 (&devlink->lock_key){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline]
#4: ffff8880269b4310 (&devlink->lock_key){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x142/0x420 net/devlink/core.c:581
#5: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz.5.2129/12522: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12527: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz.7.2137/12557: 1, on CPU#1:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12565: 1, on CPU#1:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12572: 1, on CPU#1:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12624: 1, on CPU#1:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz.4.2156/12667: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12672: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12697: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12705: 1, on CPU#1:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12713: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12726: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12776: 1, on CPU#1:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12786: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12813: 1, on CPU#1:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12821: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12845: 1, on CPU#0:
#0: ffffffff8f3c9ff0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/12876: 1, on CPU#1:
#0: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#0: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline]
#0: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219
locks held by syz-executor/12901: 2, on CPU#1:
#0: ffffffff8ff37048 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8ff37048 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8ff37048 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:595
#1: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline]
#1: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219
locks held by syz-executor/12918: 2, on CPU#1:
#0: ffffffff90d40288 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff90d40288 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff90d40288 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:595
#1: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline]
#1: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc10/0x1c30 net/core/rtnetlink.c:4219
locks held by syz-executor/12948: 2, on CPU#1:
#0: ffffffff907c90a0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x524/0x780 net/core/net_namespace.c:578
#1: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock_killable include/linux/rtnetlink.h:149 [inline]
#1: ffffffff907d78f8 (rtnl_mutex){+.+.}-{4:4}, at: register_netdev+0x18/0x60 net/core/dev.c:11663
locks held by modprobe/12982: 3, last CPU#0:
#0: ffff888041785eb8 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline]
#0: ffff888041785eb8 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1e0/0x4e0 mm/util.c:579
#1: ffffffff8f511930 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:198 [inline]
#1: ffffffff8f511930 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:305
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#2: ffffffff8f3c3d80 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e2/0x400 kernel/locking/spinlock_rt.c:57
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 11877 Comm: kworker/u8:56 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound nsim_dev_trap_report_work
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:1164 [inline]
RIP: 0010:debug_check_no_obj_freed+0x19d/0x450 lib/debugobjects.c:1201
Code: 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 4c 89 e7 e8 e7 67 58 fd 49 8b 2c 24 48 3b 6c 24 38 0f 92 c0 48 39 6c 24 40 0f 96 c1 <08> c1 75 92 4d 8d 67 10 4c 89 e0 48 c1 e8 03 48 b9 00 00 00 00 00
RSP: 0018:ffffc90006bef860 EFLAGS: 00000006
RAX: 1ffff110057cb201 RBX: 0000000000000000 RCX: dffffc0000000000
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90006bef7c0
RBP: ffff88802c9e0640 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000d7def8 R12: ffff88802be59750
R13: 1ffff110057cb2e7 R14: 0000000000000013 R15: ffff88802be59738
FS: 0000000000000000(0000) GS:ffff8881248b8000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa95fb46eb8 CR3: 000000006127e000 CR4: 00000000003526f0
Call Trace:
slab_free_hook mm/slub.c:2679 [inline]
slab_free mm/slub.c:6509 [inline]
kfree+0x13e/0x6d0 mm/slub.c:6802
skb_kfree_head net/core/skbuff.c:1083 [inline]
skb_free_head net/core/skbuff.c:1095 [inline]
skb_release_data+0x82e/0xa80 net/core/skbuff.c:1122
skb_release_all net/core/skbuff.c:1197 [inline]
__kfree_skb+0x5d/0x210 net/core/skbuff.c:1211
nsim_dev_trap_report drivers/net/netdevsim/dev.c:817 [inline]
nsim_dev_trap_report_work+0x879/0xcb0 drivers/net/netdevsim/dev.c:847
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245