INFO: task kworker/u4:7:1308 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:7 state:D stack:22872 pid:1308 ppid:2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 linkwatch_event+0xe/0x60 net/core/link_watch.c:286 process_one_work kernel/workqueue.c:2634 [inline] process_scheduled_works+0xa5d/0x15d0 kernel/workqueue.c:2711 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 INFO: task dhcpcd:5436 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:20968 pid:5436 ppid:5435 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 devinet_ioctl+0x30c/0x1c40 net/ipv4/devinet.c:1101 inet_ioctl+0x42b/0x560 net/ipv4/af_inet.c:1000 sock_do_ioctl+0xfc/0x310 net/socket.c:1219 sock_ioctl+0x5ba/0x7e0 net/socket.c:1340 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f6ea3e41378 RSP: 002b:00007ffd5d144b98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 00007f6ea3e41378 RDX: 00007ffd5d154d90 RSI: 0000000000008914 RDI: 0000000000000015 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd5d164f30 R13: 00007f6ea3d416c8 R14: 0000000000000028 R15: 0000000000008914 INFO: task syz-executor:12231 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22248 pid:12231 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:78 [inline] rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 netlink_rcv_skb+0x241/0x4d0 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x751/0x8d0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x4a9/0x6b0 net/socket.c:2200 __do_sys_sendto net/socket.c:2212 [inline] __se_sys_sendto net/socket.c:2208 [inline] __x64_sys_sendto+0xde/0xf0 net/socket.c:2208 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fda45d5b78e RSP: 002b:00007ffcae9c9638 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00005555922fa500 RCX: 00007fda45d5b78e RDX: 0000000000000060 RSI: 00007fda46b44670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007ffcae9c96b4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fda46b44670 R15: 0000000000000000 INFO: task syz.2.2315:12322 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.2315 state:D stack:25800 pid:12322 ppid:5780 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 ppp_create_interface drivers/net/ppp/ppp_generic.c:3360 [inline] ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1070 [inline] ppp_ioctl+0x6d2/0x1a90 drivers/net/ppp/ppp_generic.c:743 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f19fd79aeb9 RSP: 002b:00007f19fe739028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f19fda15fa0 RCX: 00007f19fd79aeb9 RDX: 000000110c230000 RSI: 00000000c004743e RDI: 0000000000000006 RBP: 00007f19fd808c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f19fda16038 R14: 00007f19fda15fa0 R15: 00007ffc43a33c98 INFO: task syz.2.2315:12324 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.2315 state:D stack:29128 pid:12324 ppid:5780 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 ppp_ioctl+0xe0/0x1a90 drivers/net/ppp/ppp_generic.c:739 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f19fd79aeb9 RSP: 002b:00007f19fe718028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f19fda16090 RCX: 00007f19fd79aeb9 RDX: 0000000000000000 RSI: 0000000040047440 RDI: 0000000000000006 RBP: 00007f19fd808c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f19fda16128 R14: 00007f19fda16090 R15: 00007ffc43a33c98 INFO: task syz.2.2315:12327 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.2315 state:D stack:25800 pid:12327 ppid:5780 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 wext_ioctl_dispatch+0x115/0x600 net/wireless/wext-core.c:1015 wext_handle_ioctl+0x117/0x1d0 net/wireless/wext-core.c:1077 sock_ioctl+0x15d/0x7e0 net/socket.c:1272 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f19fd79aeb9 RSP: 002b:00007f19fe6f7028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f19fda16180 RCX: 00007f19fd79aeb9 RDX: 0000200000000000 RSI: 0000000000008b04 RDI: 000000000000000d RBP: 00007f19fd808c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f19fda16218 R14: 00007f19fda16180 R15: 00007ffc43a33c98 INFO: task syz.1.2316:12334 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.2316 state:D stack:25320 pid:12334 ppid:5770 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 tun_detach drivers/net/tun.c:698 [inline] tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511 __fput+0x234/0x970 fs/file_table.c:384 task_work_run+0x1d4/0x260 kernel/task_work.c:245 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302 do_syscall_64+0x61/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f04f519aeb9 RSP: 002b:00007ffd70d80348 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f04f5417da0 RCX: 00007f04f519aeb9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f04f5417da0 R08: 0000000000000006 R09: 0000000000000000 R10: 00007f04f5417cb0 R11: 0000000000000246 R12: 0000000000075482 R13: 00007f04f541618c R14: 000000000007524d R15: 00007f04f5416180 INFO: task syz.1.2316:12335 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.2316 state:D stack:27016 pid:12335 ppid:5770 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 tun_detach drivers/net/tun.c:698 [inline] tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511 __fput+0x234/0x970 fs/file_table.c:384 __do_sys_close fs/open.c:1573 [inline] __se_sys_close+0x15f/0x220 fs/open.c:1558 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f04f519aeb9 RSP: 002b:00007f04f6074028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 00007f04f5415fa0 RCX: 00007f04f519aeb9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 00007f04f5208c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f04f5416038 R14: 00007f04f5415fa0 R15: 00007ffd70d801e8 INFO: task syz.3.2319:12346 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.2319 state:D stack:25768 pid:12346 ppid:5777 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 netlink_dump+0x78f/0xe50 net/netlink/af_netlink.c:2263 __netlink_dump_start+0x5f1/0x810 net/netlink/af_netlink.c:2372 netlink_dump_start include/linux/netlink.h:338 [inline] rtnetlink_rcv_msg+0xe1d/0xfa0 net/core/rtnetlink.c:6428 netlink_rcv_skb+0x241/0x4d0 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x751/0x8d0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x5ba/0x960 net/socket.c:2594 ___sys_sendmsg+0x2a6/0x360 net/socket.c:2648 __sys_sendmsg net/socket.c:2677 [inline] __do_sys_sendmsg net/socket.c:2686 [inline] __se_sys_sendmsg+0x1c2/0x2b0 net/socket.c:2684 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f106d39aeb9 RSP: 002b:00007f106e177028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f106d615fa0 RCX: 00007f106d39aeb9 RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 RBP: 00007f106d408c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f106d616038 R14: 00007f106d615fa0 R15: 00007ffd4e116288 INFO: task syz.3.2319:12347 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.2319 state:D stack:24424 pid:12347 ppid:5777 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5381 [inline] __schedule+0x1553/0x45a0 kernel/sched/core.c:6700 schedule+0xbd/0x170 kernel/sched/core.c:6774 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747 wext_ioctl_dispatch+0x115/0x600 net/wireless/wext-core.c:1015 wext_handle_ioctl+0x117/0x1d0 net/wireless/wext-core.c:1077 sock_ioctl+0x15d/0x7e0 net/socket.c:1272 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f106d39aeb9 RSP: 002b:00007f106b5f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f106d616090 RCX: 00007f106d39aeb9 RDX: 0000200000000000 RSI: 0000000000008b14 RDI: 0000000000000008 RBP: 00007f106d408c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f106d616128 R14: 00007f106d616090 R15: 00007ffd4e116288 Future hung task reports are suppressed, see sysctl kernel.hung_task_warnings Showing all locks held in the system: 3 locks held by kworker/0:1/9: #0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline] #0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711 #1: ffffc900000e7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline] #1: ffffc900000e7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711 #2: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x92/0xd90 net/wireless/reg.c:2463 1 lock held by khungtaskd/28: #0: ffffffff8d131fe0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline] #0: ffffffff8d131fe0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline] #0: ffffffff8d131fe0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633 5 locks held by kworker/u4:2/36: #0: ffff888017c73938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline] #0: ffff888017c73938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711 #1: ffffc90000acfd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline] #1: ffffc90000acfd00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711 #2: ffffffff8e3b3150 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 net/core/net_namespace.c:606 #3: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xf2/0xa80 net/core/dev.c:11652 #4: ffff8880b8e3c018 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:559 3 locks held by kworker/u4:7/1308: #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline] #0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711 #1: ffffc90004ddfd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline] #1: ffffc90004ddfd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711 #2: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286 1 lock held by dhcpcd/5436: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x30c/0x1c40 net/ipv4/devinet.c:1101 2 locks held by getty/5532: #0: ffff88802d0060a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x433/0x1390 drivers/tty/n_tty.c:2217 3 locks held by kworker/u4:0/9482: #0: ffff88802c337d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline] #0: ffff88802c337d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711 #1: ffffc900052cfd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline] #1: ffffc900052cfd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2711 #2: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4718 2 locks held by kworker/u4:1/11470: 1 lock held by syz-executor/12231: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 2 locks held by syz.2.2315/12322: #0: ffffffff8dbe24a8 (ppp_mutex){+.+.}-{3:3}, at: ppp_ioctl+0xe0/0x1a90 drivers/net/ppp/ppp_generic.c:739 #1: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: ppp_create_interface drivers/net/ppp/ppp_generic.c:3360 [inline] #1: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1070 [inline] #1: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: ppp_ioctl+0x6d2/0x1a90 drivers/net/ppp/ppp_generic.c:743 1 lock held by syz.2.2315/12324: #0: ffffffff8dbe24a8 (ppp_mutex){+.+.}-{3:3}, at: ppp_ioctl+0xe0/0x1a90 drivers/net/ppp/ppp_generic.c:739 1 lock held by syz.2.2315/12327: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: wext_ioctl_dispatch+0x115/0x600 net/wireless/wext-core.c:1015 1 lock held by syz.1.2316/12334: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511 1 lock held by syz.1.2316/12335: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511 2 locks held by syz.3.2319/12346: #0: ffff888074846690 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0xf4/0x810 net/netlink/af_netlink.c:2336 #1: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0x78f/0xe50 net/netlink/af_netlink.c:2263 1 lock held by syz.3.2319/12347: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: wext_ioctl_dispatch+0x115/0x600 net/wireless/wext-core.c:1015 1 lock held by syz-executor/12349: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12353: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12357: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12363: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12367: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12371: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12375: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12380: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12385: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12390: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 1 lock held by syz-executor/12397: #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline] #0: ffffffff8e3c0308 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6469 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline] watchdog+0xf3d/0xf80 kernel/hung_task.c:379 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 5130 Comm: klogd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 RIP: 0010:__kasan_check_read+0xa/0x20 mm/kasan/shadow.c:31 Code: 48 c7 c7 6d 5c a2 8c 4c 89 e6 eb 0a 48 c7 c7 05 34 84 8c 48 89 de e8 15 7e 99 08 31 ed eb d4 cc f3 0f 1e fa 89 f6 48 8b 0c 24 <31> d2 e9 df ea ff ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 RSP: 0018:ffffc90000007a90 EFLAGS: 00000046 RAX: 0000000000000000 RBX: 000000000000944d RCX: ffffffff815f2367 RDX: 0000000000000009 RSI: 0000000000000008 RDI: ffffffff8e8adfa8 RBP: 1ffff110171c781f R08: ffffffff8e8adfaf R09: 1ffffffff1d15bf5 R10: dffffc0000000000 R11: fffffbfff1d15bf6 R12: dffffc0000000000 R13: 0000002b1435c4df R14: ffff88807e6e8000 R15: 0000000000000000 FS: 00007f8558be2c80(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056118cc2e000 CR3: 000000007e9f6000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000008d24 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] cpumask_test_cpu include/linux/cpumask.h:504 [inline] cpu_online include/linux/cpumask.h:1082 [inline] trace_sched_stat_runtime include/trace/events/sched.h:517 [inline] update_curr_task+0x47/0x310 kernel/sched/fair.c:1178 update_curr+0x4a6/0x7f0 kernel/sched/fair.c:1218 enqueue_entity+0x5f/0x11c0 kernel/sched/fair.c:5310 enqueue_task_fair+0x18d/0x850 kernel/sched/fair.c:6776 enqueue_task+0x182/0x2b0 kernel/sched/core.c:2102 activate_task kernel/sched/core.c:2132 [inline] ttwu_do_activate+0x1d6/0x7d0 kernel/sched/core.c:3786 ttwu_queue kernel/sched/core.c:4028 [inline] try_to_wake_up+0x68a/0x1190 kernel/sched/core.c:4349 hrtimer_wakeup+0x4e/0x60 kernel/time/hrtimer.c:1986 __run_hrtimer kernel/time/hrtimer.c:1750 [inline] __hrtimer_run_queues+0x52a/0xc40 kernel/time/hrtimer.c:1814 hrtimer_interrupt+0x3c9/0x9c0 kernel/time/hrtimer.c:1876 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline] __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline] sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687 RIP: 0010:stack_access_ok arch/x86/kernel/unwind_orc.c:-1 [inline] RIP: 0010:deref_stack_reg arch/x86/kernel/unwind_orc.c:403 [inline] RIP: 0010:unwind_next_frame+0xf3d/0x2970 arch/x86/kernel/unwind_orc.c:585 Code: 84 c1 0f 84 fd 01 00 00 49 8d 46 08 48 39 d8 0f 97 c1 4c 39 f8 0f 96 c0 84 c1 48 8b 6c 24 10 0f 84 ab 05 00 00 e8 53 cf 4b 00 <4c> 8b 24 24 49 bd 00 00 00 00 00 fc ff df e9 9c 06 00 00 48 89 9c RSP: 0018:ffffc900032a72f0 EFLAGS: 00000293 RAX: ffffffff813b455d RBX: ffffc900032a0000 RCX: ffff88807e6e8000 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: ffffc900032a7478 R08: ffff88807e6e8000 R09: 0000000000000003 R10: 0000000000000004 R11: 0000000000000000 R12: 1ffff92000654e86 R13: 1ffff92000654e87 R14: ffffc900032a7420 R15: ffffc900032a8000 __unwind_start+0x66a/0x7e0 arch/x86/kernel/unwind_orc.c:760 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xf8/0x190 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook+0x6e/0x4b0 mm/slab.h:767 slab_alloc_node mm/slub.c:3495 [inline] kmem_cache_alloc_node+0x14c/0x320 mm/slub.c:3540 __alloc_skb+0x103/0x2c0 net/core/skbuff.c:643 alloc_skb include/linux/skbuff.h:1284 [inline] alloc_skb_with_frags+0xca/0x7b0 net/core/skbuff.c:6334 sock_alloc_send_pskb+0x883/0x9a0 net/core/sock.c:2821 unix_dgram_sendmsg+0x5a2/0x16d0 net/unix/af_unix.c:2001 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] __sys_sendto+0x4a9/0x6b0 net/socket.c:2200 __do_sys_sendto net/socket.c:2212 [inline] __se_sys_sendto net/socket.c:2208 [inline] __x64_sys_sendto+0xde/0xf0 net/socket.c:2208 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f8558d32407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc7d480230 EFLAGS: 00000202 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f8558be2c80 RCX: 00007f8558d32407 RDX: 000000000000005c RSI: 00007ffc7d480370 RDI: 0000000000000003 RBP: 00007ffc7d4807a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffc7d4807b8 R13: 00007ffc7d480370 R14: 0000000000000041 R15: 00007ffc7d480370