INFO: task syz-executor:14540 blocked for more than 145 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:21688 pid:14540 tgid:14540 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5402 [inline]
__schedule+0x16f9/0x5500 kernel/sched/core.c:7204
__schedule_loop kernel/sched/core.c:7283 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7579
rt_mutex_slowlock_block+0x508/0x680 kernel/locking/rtmutex.c:1666
__rt_mutex_slowlock kernel/locking/rtmutex.c:1743 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1783 [inline]
rt_mutex_slowlock+0x2dc/0x780 kernel/locking/rtmutex.c:1823
__rt_mutex_lock kernel/locking/rtmutex.c:1838 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
new_device_store+0x13c/0x710 drivers/net/netdevsim/bus.c:184
kernfs_fop_write_iter+0x3b0/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x629/0xba0 fs/read_write.c:688
ksys_write+0x156/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7ffad192d68e
RSP: 002b:00007ffe6d4fc5d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055558fa57500 RCX: 00007ffad192d68e
RDX: 0000000000000003 RSI: 00007ffe6d4fc660 RDI: 0000000000000005
RBP: 00007ffad1a03616 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 00007ffe6d4fc660 R14: 00007ffad2714620 R15: 0000000000000003
INFO: task syz-executor:14994 blocked for more than 145 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:21416 pid:14994 tgid:14994 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5402 [inline]
__schedule+0x16f9/0x5500 kernel/sched/core.c:7204
__schedule_loop kernel/sched/core.c:7283 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7579
rt_mutex_slowlock_block+0x508/0x680 kernel/locking/rtmutex.c:1666
__rt_mutex_slowlock kernel/locking/rtmutex.c:1743 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1783 [inline]
rt_mutex_slowlock+0x2dc/0x780 kernel/locking/rtmutex.c:1823
__rt_mutex_lock kernel/locking/rtmutex.c:1838 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
del_device_store+0xd7/0x370 drivers/net/netdevsim/bus.c:234
kernfs_fop_write_iter+0x3b0/0x540 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x629/0xba0 fs/read_write.c:688
ksys_write+0x156/0x270 fs/read_write.c:740
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f05b50fd68e
RSP: 002b:00007ffd1e432078 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055555d20e500 RCX: 00007f05b50fd68e
RDX: 0000000000000001 RSI: 00007ffd1e432100 RDI: 0000000000000005
RBP: 00007f05b51d35f2 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd1e432100 R14: 00007f05b5ee4620 R15: 0000000000000003
Showing all locks held in the system:
6 locks held by ksoftirqd/0/15:
#0: ffffffff8de613c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#1: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 net/core/dev.c:6667
#3: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#3: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: ip6_input+0x23/0x270 net/ipv6/ip6_input.c:544
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:242 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:316
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: ip6_route_output_flags+0x2e/0x5e0 net/ipv6/route.c:2714
5 locks held by ksoftirqd/1/31:
#0: ffffffff8de613c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#1: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x271/0xc60 net/core/dev.c:6667
#3: ffff8880b8728418 (hrtimer_bases.lock){-...}-{2:2}, at: lock_hrtimer_base kernel/time/hrtimer.c:191 [inline]
#3: ffff8880b8728418 (hrtimer_bases.lock){-...}-{2:2}, at: hrtimer_start_range_ns+0x8c/0x3f0 kernel/time/hrtimer.c:1501
#4: ffffffff99a72570 (&obj_hash[i].lock){-...}-{2:2}, at: debug_object_activate+0xa8/0x3a0 lib/debugobjects.c:845
1 lock held by khungtaskd/39:
#0: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#0: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6777
4 locks held by kworker/u8:4/67:
#0: ffff88801b69e138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc9000152fc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffffffff8f380c60 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 net/core/net_namespace.c:673
#3: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
#3: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x940 net/core/net_namespace.c:248
5 locks held by kworker/u8:8/834:
#0: ffff88801eed1938 ((wq_completion)writeback){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc9000555fc40 ((work_completion)(&(&wb->dwork)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffff888035e960d0 (&type->s_umount_key#33){++++}-{4:4}, at: super_trylock_shared+0x20/0xf0 fs/super.c:565
#3: ffff888035f00cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: percpu_down_read include/linux/percpu-rwsem.h:77 [inline]
#3: ffff888035f00cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages_down_read fs/ext4/ext4.h:1811 [inline]
#3: ffff888035f00cd8 (&sbi->s_writepages_rwsem){++++}-{0:0}, at: ext4_writepages+0x205/0x3b0 fs/ext4/inode.c:3041
#4: ffffffff8e111470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#4: ffffffff8e111470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294
#0: ffffffff8e111470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#0: ffffffff8e111470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294
#1: ffff88801eaeba58 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#1: ffff88801eaeba58 (&n->list_lock){+.+.}-{3:3}, at: __slab_free+0xf1/0x2a0 mm/slub.c:5592
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#2: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
2 locks held by dhcpcd/5271:
#0: ffff8880855b6928 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: netlink_dump+0xe2/0xe10 net/netlink/af_netlink.c:2273
#1: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#1: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dump_ifinfo+0xa31/0x1450 net/core/rtnetlink.c:2554
2 locks held by getty/5364:
#0: ffff888035eb40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003cc62e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x462/0x13a0 drivers/tty/n_tty.c:2211
2 locks held by kworker/u8:15/6169:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc900015cfc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
3 locks held by kworker/u8:13/8221:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc9000475fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
3 locks held by kworker/1:9/8510:
#0: ffff88813fe4f938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc900059efc40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
5 locks held by kworker/u8:19/11224:
#0: ffff888032b8d138 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc90007b9fc40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffffffff8de613c0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#3: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#4: ffff888070251358 (key#18){+...}-{3:3}, at: spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
#4: ffff888070251358 (key#18){+...}-{3:3}, at: batadv_tt_global_purge net/batman-adv/translation-table.c:2270 [inline]
#4: ffff888070251358 (key#18){+...}-{3:3}, at: batadv_tt_purge+0x138/0xa10 net/batman-adv/translation-table.c:3550
6 locks held by kworker/u8:21/11238:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc90007b6fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffff888064874310 (&devlink->lock_key#23){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbd0 drivers/net/netdevsim/dev.c:909
#3: ffff88803bad1120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88803bad1120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff88803bad1120 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbd0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa6/0x2550 arch/x86/kernel/unwind_orc.c:495
6 locks held by kworker/u8:22/11240:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc90007c0fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffff888022b66310 (&devlink->lock_key#19){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xbd0 drivers/net/netdevsim/dev.c:909
#3: ffff888036f81520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff888036f81520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff888036f81520 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1ad/0xbd0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
#5: ffffffff8dfcac60 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0xa6/0x2550 arch/x86/kernel/unwind_orc.c:495
3 locks held by kworker/u8:23/11243:
#0: ffff88802def9138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc90007a17c40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#2: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4761
4 locks held by syz-executor/14540:
#0: ffff88803580a480 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline]
#0: ffff88803580a480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 fs/read_write.c:684
#1: ffff88805e662478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 fs/kernfs/file.c:343
#2: ffff888029517968 (kn->active#53){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff888029517968 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 fs/kernfs/file.c:344
#3: ffffffff8ec05258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x710 drivers/net/netdevsim/bus.c:184
5 locks held by kworker/u9:2/14546:
#0: ffff88801abe5138 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_one_work+0x897/0x1630 kernel/workqueue.c:3293
#1: ffffc900042e7c40 ((work_completion)(&hdev->cmd_work)){+.+.}-{0:0}, at: process_one_work+0x8be/0x1630 kernel/workqueue.c:3294
#2: ffffffff8e111470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#2: ffffffff8e111470 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294
#3: ffff88801eaeba58 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88801eaeba58 (&n->list_lock){+.+.}-{3:3}, at: __slab_free+0xf1/0x2a0 mm/slub.c:5592
#4: ffff8880b863b8a0 (&rq->__lock){-...}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:661
7 locks held by syz-executor/14866:
#0: ffff88803580a480 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline]
#0: ffff88803580a480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 fs/read_write.c:684
#1: ffff88805f4e9878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 fs/kernfs/file.c:343
#2: ffff888029517878 (kn->active#52){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff888029517878 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 fs/kernfs/file.c:344
#3: ffffffff8ec05258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 drivers/net/netdevsim/bus.c:234
#4: ffff888060169160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1102 [inline]
#4: ffff888060169160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
#4: ffff888060169160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 drivers/base/dd.c:1369
#5: ffff8880835ee310 (&devlink->lock_key#30){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 drivers/net/netdevsim/dev.c:1799
#6: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x16b/0x7f0 drivers/net/netdevsim/netdev.c:1188
4 locks held by syz-executor/14994:
#0: ffff88803580a480 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline]
#0: ffff88803580a480 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x22d/0xba0 fs/read_write.c:684
#1: ffff888061279c78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1df/0x540 fs/kernfs/file.c:343
#2: ffff888029517878 (kn->active#52){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff888029517878 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x232/0x540 fs/kernfs/file.c:344
#3: ffffffff8ec05258 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd7/0x370 drivers/net/netdevsim/bus.c:234
2 locks held by syz-executor/15293:
#0: ffffffff8f380c60 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:575
#1: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d5/0x850 net/ipv4/ip_tunnel.c:1146
2 locks held by syz-executor/15309:
#0: ffffffff8f380c60 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:575
#1: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
#1: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x940 net/core/net_namespace.c:248
2 locks held by syz-executor/15312:
#0: ffffffff8f380c60 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:575
#1: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d5/0x850 net/ipv4/ip_tunnel.c:1146
2 locks held by syz-executor/15327:
#0: ffffffff8f380c60 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:575
#1: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#1: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2103
1 lock held by syz.8.1632/15406:
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x3bf/0x1e30 drivers/net/tun.c:3147
1 lock held by syz-executor/15408:
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978
1 lock held by syz-executor/15414:
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978
1 lock held by syz-executor/15419:
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978
1 lock held by syz-executor/15428:
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978
1 lock held by syz-executor/15436:
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
#0: ffffffff8f390178 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 net/ipv4/devinet.c:978
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd3/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 30 Comm: ktimers/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:hlock_class kernel/locking/lockdep.c:229 [inline]
RIP: 0010:__lock_acquire+0xa47/0x2d10 kernel/locking/lockdep.c:5236
Code: ec 0d 00 75 13 48 8d 3d 87 7a ef 0d 48 c7 c6 79 4c 76 8d 67 48 0f b9 3a 90 31 c0 48 83 78 40 00 0f 84 7f 1d 00 00 41 8b 45 20 <25> ff 1f 00 00 48 0f a3 05 1c 35 dc 11 73 10 48 69 c0 c8 00 00 00
RSP: 0018:ffffc90000a4e8b0 EFLAGS: 00000086
RAX: 000000000002000b RBX: 000000003e60f9ee RCX: 000000004f8ecec4
RDX: 00000000d03d8cec RSI: 00000000fe995ddf RDI: ffff88801de89f00
RBP: f2beb25d00000000 R08: ffffffff8176c406 R09: ffffffff8dfcac60
R10: ffffc90000a4ebb8 R11: ffffffff81b02a50 R12: ffff88801de8abf0
R13: ffff88801de8abf0 R14: ffff88801de89f00 R15: 0000000000000006
FS: 0000000000000000(0000) GS:ffff888125fcd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe4713f8060 CR3: 00000000372d6000 CR4: 00000000003526f0
Call Trace:
lock_acquire+0x106/0x350 kernel/locking/lockdep.c:5870
rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
rcu_read_lock include/linux/rcupdate.h:838 [inline]
class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
unwind_next_frame+0xc3/0x2550 arch/x86/kernel/unwind_orc.c:495
arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
save_dst_trace_buffer+0x108/0x5b0 net/core/dst.c:102
ip6_route_output_flags+0x3df/0x5e0 net/ipv6/route.c:-1
ip6_route_output include/net/ip6_route.h:100 [inline]
__nf_ip6_route+0x42/0xd0 net/ipv6/netfilter.c:102
nf_ip6_route include/linux/netfilter_ipv6.h:57 [inline]
synproxy_send_tcp_ipv6+0x275/0x6d0 net/netfilter/nf_synproxy_core.c:838
synproxy_send_client_synack_ipv6+0x814/0xcb0 net/netfilter/nf_synproxy_core.c:900
nft_synproxy_eval_v6+0x34a/0x4e0 net/netfilter/nft_synproxy.c:91
nft_synproxy_do_eval+0x3ce/0x580 net/netfilter/nft_synproxy.c:146
expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
nft_do_chain+0x48d/0x1ae0 net/netfilter/nf_tables_core.c:285
nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316
ip6_input+0x16a/0x270 net/ipv6/ip6_input.c:545
NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6204 [inline]
__netif_receive_skb net/core/dev.c:6317 [inline]
process_backlog+0x3ce/0xc60 net/core/dev.c:6668
__napi_poll+0xab/0x550 net/core/dev.c:7727
napi_poll net/core/dev.c:7790 [inline]
net_rx_action+0x696/0xe00 net/core/dev.c:7947
handle_softirqs+0x1de/0x6d0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
run_ktimerd+0x69/0x100 kernel/softirq.c:1155
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245