INFO: task syz-executor:19102 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:25448 pid:19102 tgid:19102 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 rwsem_down_write_slowpath+0x874/0x10d0 kernel/locking/rwsem.c:1215 __down_write_common kernel/locking/rwsem.c:1347 [inline] __down_write kernel/locking/rwsem.c:1356 [inline] down_write+0x1b7/0x200 kernel/locking/rwsem.c:1632 rdma_dev_exit_net+0x8b/0x430 drivers/infiniband/core/device.c:1156 ops_exit_list net/core/net_namespace.c:200 [inline] ops_undo_list+0x451/0x8f0 net/core/net_namespace.c:253 setup_net+0x2f6/0x350 net/core/net_namespace.c:459 copy_net_ns+0x536/0x770 net/core/net_namespace.c:582 create_new_namespaces+0x3f0/0x6b0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0x144/0x190 kernel/nsproxy.c:234 ksys_unshare+0x532/0x890 kernel/fork.c:3293 __do_sys_unshare kernel/fork.c:3359 [inline] __se_sys_unshare kernel/fork.c:3357 [inline] __x64_sys_unshare+0x38/0x50 kernel/fork.c:3357 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fba75ba0827 RSP: 002b:00007fff82628d08 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fba75e25f40 RCX: 00007fba75ba0827 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007fba75e267b8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000008 R13: 0000000000000003 R14: 00007fff82628f48 R15: 0000000000000000 INFO: task syz-executor:19269 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:26416 pid:19269 tgid:19269 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 rwsem_down_read_slowpath+0x6d8/0x980 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0x97/0x320 kernel/locking/rwsem.c:1576 rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 ops_init+0x35d/0x5d0 net/core/net_namespace.c:137 setup_net+0x118/0x350 net/core/net_namespace.c:443 copy_net_ns+0x536/0x770 net/core/net_namespace.c:582 create_new_namespaces+0x3f0/0x6b0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0x144/0x190 kernel/nsproxy.c:234 ksys_unshare+0x532/0x890 kernel/fork.c:3293 __do_sys_unshare kernel/fork.c:3359 [inline] __se_sys_unshare kernel/fork.c:3357 [inline] __x64_sys_unshare+0x38/0x50 kernel/fork.c:3357 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1e7aba0827 RSP: 002b:00007ffe8d89b058 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f1e7ae25f40 RCX: 00007f1e7aba0827 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007f1e7ae267b8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000008 R13: 0000000000000003 R14: 00007ffe8d89b298 R15: 0000000000000000 INFO: task syz-executor:19288 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:26616 pid:19288 tgid:19288 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 rwsem_down_read_slowpath+0x6d8/0x980 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0x97/0x320 kernel/locking/rwsem.c:1576 rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 ops_init+0x35d/0x5d0 net/core/net_namespace.c:137 setup_net+0x118/0x350 net/core/net_namespace.c:443 copy_net_ns+0x536/0x770 net/core/net_namespace.c:582 create_new_namespaces+0x3f0/0x6b0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0x144/0x190 kernel/nsproxy.c:234 ksys_unshare+0x532/0x890 kernel/fork.c:3293 __do_sys_unshare kernel/fork.c:3359 [inline] __se_sys_unshare kernel/fork.c:3357 [inline] __x64_sys_unshare+0x38/0x50 kernel/fork.c:3357 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb3dd7a0827 RSP: 002b:00007ffe8f04d128 EFLAGS: 00000202 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fb3dda25f40 RCX: 00007fb3dd7a0827 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007fb3dda267b8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 R13: 0000000000000003 R14: 00007ffe8f04d368 R15: 0000000000000000 INFO: task syz-executor:19304 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:26616 pid:19304 tgid:19304 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 rwsem_down_read_slowpath+0x6d8/0x980 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0x97/0x320 kernel/locking/rwsem.c:1576 rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 ops_init+0x35d/0x5d0 net/core/net_namespace.c:137 setup_net+0x118/0x350 net/core/net_namespace.c:443 copy_net_ns+0x536/0x770 net/core/net_namespace.c:582 create_new_namespaces+0x3f0/0x6b0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0x144/0x190 kernel/nsproxy.c:234 ksys_unshare+0x532/0x890 kernel/fork.c:3293 __do_sys_unshare kernel/fork.c:3359 [inline] __se_sys_unshare kernel/fork.c:3357 [inline] __x64_sys_unshare+0x38/0x50 kernel/fork.c:3357 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc206ba0827 RSP: 002b:00007ffcef257198 EFLAGS: 00000202 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007fc206e25f40 RCX: 00007fc206ba0827 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007fc206e267b8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 R13: 0000000000000003 R14: 00007ffcef2573d8 R15: 0000000000000000 INFO: task syz-executor:19316 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:26616 pid:19316 tgid:19316 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 rwsem_down_read_slowpath+0x6d8/0x980 kernel/locking/rwsem.c:1114 __down_read_common kernel/locking/rwsem.c:1291 [inline] __down_read kernel/locking/rwsem.c:1304 [inline] down_read+0x97/0x320 kernel/locking/rwsem.c:1576 rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 ops_init+0x35d/0x5d0 net/core/net_namespace.c:137 setup_net+0x118/0x350 net/core/net_namespace.c:443 copy_net_ns+0x536/0x770 net/core/net_namespace.c:582 create_new_namespaces+0x3f0/0x6b0 kernel/nsproxy.c:132 unshare_nsproxy_namespaces+0x144/0x190 kernel/nsproxy.c:234 ksys_unshare+0x532/0x890 kernel/fork.c:3293 __do_sys_unshare kernel/fork.c:3359 [inline] __se_sys_unshare kernel/fork.c:3357 [inline] __x64_sys_unshare+0x38/0x50 kernel/fork.c:3357 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f19b93a0827 RSP: 002b:00007ffc54278e48 EFLAGS: 00000206 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 00007f19b9625f40 RCX: 00007f19b93a0827 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 00007f19b96267b8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000008 R13: 0000000000000003 R14: 00007ffc54279088 R15: 0000000000000000 Showing all locks held in the system: locks held by pr/ttyS0/31: 1, last CPU#0: #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:314 [inline] #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:493 [inline] #0: ffffffff8fc33858 (console_srcu){....}-{0:0}, at: console_srcu_read_lock+0x30/0x60 kernel/printk/printk.c:291 locks held by khungtaskd/32: 1, last CPU#1: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/43: 3, last CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90000b37c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88803593b258 (&devlink->lock_key#5){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:8/267: 4, last CPU#1: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000323fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000323fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000323fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000323fc40 ((work_completion)(&rdev->wiphy_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888044a50800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6990 [inline] #2: ffff888044a50800 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0xb4/0x420 net/wireless/core.c:596 #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: ieee80211_sta_active_ibss+0xc7/0x330 net/mac80211/ibss.c:628 locks held by udevd/4992: 4, last CPU#0: #0: ffffffff8fe33fd0 (dup_mmap_sem){++++}-{0:0}, at: dup_mm kernel/fork.c:1542 [inline] #0: ffffffff8fe33fd0 (dup_mmap_sem){++++}-{0:0}, at: copy_mm+0x10a/0x470 kernel/fork.c:1595 #1: ffff88807f7fc080 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #1: ffff88807f7fc080 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x195/0x1dc0 mm/mmap.c:1716 #2: ffff888027764cc0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: mmap_write_lock_nested include/linux/mmap_lock.h:552 [inline] #2: ffff888027764cc0 (&mm->mmap_lock/1){+.+.}-{4:4}, at: dup_mmap+0x221/0x1dc0 mm/mmap.c:1723 #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x240 mm/pgtable-generic.c:290 locks held by getty/5377: 2, on CPU#1: #0: ffff88803430a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by syz-executor/5610: 2, last CPU#0: #0: ffff88803829ccc0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:600 [inline] #0: ffff88803829ccc0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1299 #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: is_bpf_text_address+0x26/0x2b0 kernel/bpf/core.c:750 locks held by kworker/u9:3/5635: 5, on CPU#1: #0: ffff888030890148 ((wq_completion)hci5){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888030890148 ((wq_completion)hci5){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888030890148 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888030890148 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000402fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000402fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000402fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000402fc40 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88804a6c0ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x242/0x430 net/bluetooth/hci_sync.c:337 #3: ffff88804a6c00b8 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x9d1/0x1170 net/bluetooth/hci_sync.c:6054 #4: ffffffff8fd60328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #4: ffffffff8fd60328 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2cb/0x760 kernel/rcu/tree_exp.h:966 locks held by kworker/u8:14/13696: 3, last CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006457c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006457c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006457c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90006457c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888029003258 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by kworker/u8:17/13699: 2, last CPU#0: #0: ffff8880342ed948 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880342ed948 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880342ed948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff8880342ed948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000633fc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000633fc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000633fc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000633fc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:21/13705: 3, last CPU#0: #0: ffff888038590148 ((wq_completion)krds_cp_wq#2/0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888038590148 ((wq_completion)krds_cp_wq#2/0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888038590148 ((wq_completion)krds_cp_wq#2/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888038590148 ((wq_completion)krds_cp_wq#2/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005d27c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005d27c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005d27c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005d27c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888055651280 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:24/13708: 4, on CPU#0: #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000561fc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000561fc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000561fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000561fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677 #3: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_exit_net+0x8b/0x430 drivers/infiniband/core/device.c:1156 locks held by kworker/u8:28/16443: 4, last CPU#0: #0: ffff88807de83948 ( (wq_completion)krds_cp_wq#16/0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] (wq_completion)krds_cp_wq#16/0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] (wq_completion)krds_cp_wq#16/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] (wq_completion)krds_cp_wq#16/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000de07c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000de07c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000de07c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000de07c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88807c5c8980 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff8880b843bea0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:677 #3: ffff8880b843bea0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2d/0x160 kernel/sched/core.c:677 locks held by kworker/u8:29/16444: 6, last CPU#1: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000de27c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000de27c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000de27c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000de27c40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888029003258 (&devlink->lock_key#7){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 #3: ffff8880553914e0 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:347 [inline] #3: ffff8880553914e0 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:787 [inline] #3: ffff8880553914e0 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x19e/0xb30 drivers/net/netdevsim/dev.c:847 #4: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: hrtimer_interrupt+0xfd/0xaa0 kernel/time/hrtimer.c:2233 #5: ffffffff9baa6708 (&____s->seqcount#2){----}-{0:0}, at: ktime_get+0x45/0x220 kernel/time/timekeeping.c:1004 locks held by kworker/u8:30/16445: 2, on CPU#1: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000dac7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000dac7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000dac7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000dac7c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:40/17650: 2, on CPU#0: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005297c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005297c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005297c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005297c40 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by syz-executor/19102: 2, on CPU#1: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_exit_net+0x8b/0x430 drivers/infiniband/core/device.c:1156 locks held by syz.3.3209/19181: 5, last CPU#0: #0: ffffffff9be09968 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:164 [inline] #0: ffffffff9be09968 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] #0: ffffffff9be09968 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv+0x33d/0xa40 drivers/infiniband/core/netlink.c:259 #1: ffffffff90fd7d28 (link_ops_rwsem){++++}-{4:4}, at: nldev_newlink+0x42b/0x650 drivers/infiniband/core/nldev.c:1849 #2: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: enable_device_and_get+0xff/0x3e0 drivers/infiniband/core/device.c:1365 #3: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: add_compat_devs drivers/infiniband/core/device.c:1058 [inline] #3: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: enable_device_and_get+0x27c/0x3e0 drivers/infiniband/core/device.c:1381 #4: ffff888082a31020 (&device->compat_devs_mutex){+.+.}-{4:4}, at: add_one_compat_dev+0xf0/0x640 drivers/infiniband/core/device.c:976 locks held by syz-executor/19269: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19288: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19304: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19311: 3, on CPU#1: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19316: 3, on CPU#1: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19368: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19392: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19409: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19428: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19434: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19483: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19517: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19537: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19557: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19559: 3, on CPU#0: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by syz-executor/19616: 3, on CPU#1: #0: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x51f/0x770 net/core/net_namespace.c:578 #1: ffffffff90fc8e48 (devices_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x1fb/0x2f0 drivers/infiniband/core/device.c:1221 #2: ffffffff90fc9008 (rdma_nets_rwsem){++++}-{4:4}, at: rdma_dev_init_net+0x233/0x2f0 drivers/infiniband/core/device.c:1226 locks held by modprobe/19654: 2, last CPU#0: #0: ffff888037aa2800 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #0: ffff888037aa2800 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1dd/0x4e0 mm/util.c:579 #1: ffff88807bff4388 (&anon_vma->rwsem){++++}-{4:4}, at: anon_vma_lock_read mm/internal.h:310 [inline] #1: ffff88807bff4388 (&anon_vma->rwsem){++++}-{4:4}, at: validate_mm+0x1f2/0x4f0 mm/vma.c:724 locks held by modprobe/19656: 2, last CPU#0: #0: ffff888069cc2800 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:562 [inline] #0: ffff888069cc2800 (&mm->mmap_lock){++++}-{4:4}, at: map_vdso+0x69/0x6a0 arch/x86/entry/vdso/vma.c:162 #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1216 [inline] #1: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd2/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 19656 Comm: modprobe Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 RIP: 0010:asm_sysvec_apic_timer_interrupt+0x0/0x20 arch/x86/include/asm/idtentry.h:674 Code: 56 6a f7 0a e9 d1 06 00 00 90 f3 0f 1e fa 0f 01 ca fc 6a ff e8 51 05 00 00 48 89 c4 48 89 e7 e8 66 69 f7 0a e9 b1 06 00 00 90 0f 1e fa 0f 01 ca fc 6a ff e8 31 05 00 00 48 89 c4 48 89 e7 e8 RSP: 0018:ffffc90000a08d78 EFLAGS: 00000093 RAX: ffffffff81b506f3 RBX: 000a9e23d3e82e4c RCX: ffff888036681f40 RDX: 8000000000000101 RSI: 0000000000000018 RDI: 0000000000000040 RBP: 0000000000023b96 R08: 0000000000000100 R09: 1ffffffff22f9957 R10: dffffc0000000000 R11: fffffbfff22f9958 R12: 000000aed2a61127 R13: ffffffffffffffff R14: 0000000000000018 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff888123b52000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005574debf4630 CR3: 0000000037366000 CR4: 00000000003526f0 Call Trace: RIP: 0010:check_kcov_mode kernel/kcov.c:179 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x18/0x80 kernel/kcov.c:213 Code: cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 65 48 8b 0d c8 79 d4 12 65 48 8b 15 c8 79 d4 12 c2 00 01 00 ff 74 29 89 d6 81 e6 00 01 00 0f 81 fe 00 01 00 00 RSP: 0018:ffffc90000a08da0 EFLAGS: 00000293 timekeeping_cycles_to_ns kernel/time/timekeeping.c:477 [inline] timekeeping_get_ns kernel/time/timekeeping.c:482 [inline] ktime_get+0x103/0x220 kernel/time/timekeeping.c:1006 gate_get_time net/sched/act_gate.c:30 [inline] gate_timer_func+0x1dc/0x450 net/sched/act_gate.c:108 __run_hrtimer kernel/time/hrtimer.c:2075 [inline] __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2132 hrtimer_run_softirq+0x1e3/0x2e0 kernel/time/hrtimer.c:2149 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 __do_softirq kernel/softirq.c:703 [inline] invoke_softirq kernel/softirq.c:542 [inline] __irq_exit_rcu+0xc6/0x220 kernel/softirq.c:786 irq_exit_rcu+0x9/0x30 kernel/softirq.c:809 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__asan_memcpy+0x54/0x70 mm/kasan/shadow.c:109 Code: c0 74 2c 4c 89 ff 48 89 de ba 01 00 00 00 4c 89 e1 e8 20 e4 ff ff 84 c0 74 15 4c 89 ff 4c 89 f6 48 89 da 5b 41 5c 41 5e 41 5f 77 49 be 09 31 c0 5b 41 5c 41 5e 41 5f c3 cc cc cc cc cc 0f 1f RSP: 0018:ffffc9000206e6d8 EFLAGS: 00000202 RAX: 1ffff9200040de01 RBX: 0000000000000040 RCX: ffffffff8bef8aa1 RDX: 0000000000000040 RSI: ffff888057713480 RDI: ffff88823bf92080 RBP: ffffc9000206f070 R08: ffff88823bf920bf R09: 1ffff110477f2417 R10: dffffc0000000000 R11: ffffed10477f2418 R12: dffffc0000000000 R13: ffffc9000206f100 R14: ffffc9000206f138 R15: ffffc9000206f120 mas_wr_node_store lib/maple_tree.c:3223 [inline] mas_wr_store_entry+0x4b91/0x7cf0 lib/maple_tree.c:3606 mas_store_prealloc+0x803/0xc20 lib/maple_tree.c:5031 vma_iter_store_new mm/vma.h:716 [inline] vma_complete+0x208/0x970 mm/vma.c:403 __split_vma+0x8fb/0xa60 mm/vma.c:613 vms_gather_munmap_vmas+0x4e3/0x1370 mm/vma.c:1528 __mmap_setup mm/vma.c:2561 [inline] __mmap_region mm/vma.c:2884 [inline] mmap_region+0x925/0x25b0 mm/vma.c:2989 do_mmap+0xe0a/0x1300 mm/mmap.c:573 vm_mmap_pgoff+0x272/0x4e0 mm/util.c:581 ksys_mmap_pgoff+0x4dc/0x760 mm/mmap.c:619 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f95086c0242 Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 46 40 01 00 16 00 RSP: 002b:00007ffd4102f3f8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 00007f9508668000 RCX: 00007f95086c0242 RDX: 0000000000000001 RSI: 0000000000028000 RDI: 00007f9508668000 RBP: 0000000000000812 R08: 0000000000000000 R09: 0000000000096000 R10: 0000000000000812 R11: 0000000000000206 R12: 00007ffd4102f480 R13: 00007f95086940c0 R14: 00007ffd4102f800 R15: 00000fffa8205e82