INFO: task kworker/u4:4:978 blocked for more than 143 seconds.
Not tainted 5.15.0-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:4 state:D stack:24464 pid: 978 ppid: 2 flags:0x00004000
Workqueue: nbd-del nbd_dev_remove_work
Call Trace:
context_switch kernel/sched/core.c:4969 [inline]
__schedule+0xa9a/0x4940 kernel/sched/core.c:6250
schedule+0xd2/0x260 kernel/sched/core.c:6323
blk_mq_freeze_queue_wait+0x112/0x160 block/blk-mq.c:178
del_gendisk+0x598/0x860 block/genhd.c:623
nbd_dev_remove+0x3c/0xf0 drivers/block/nbd.c:252
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8b983b60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
2 locks held by kworker/u4:4/978:
#0: ffff88801a6b3938 ((wq_completion)nbd-del){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff88801a6b3938 ((wq_completion)nbd-del){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff88801a6b3938 ((wq_completion)nbd-del){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff88801a6b3938 ((wq_completion)nbd-del){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
#0: ffff88801a6b3938 ((wq_completion)nbd-del){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
#0: ffff88801a6b3938 ((wq_completion)nbd-del){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
#1: ffffc900043cfdb0 ((work_completion)(&nbd->remove_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
2 locks held by systemd-udevd/2972:
1 lock held by in:imklog/6227:
2 locks held by kworker/u4:8/15555:
4 locks held by kworker/u4:9/2309:
#0: ffff8881449d2938 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff8881449d2938 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff8881449d2938 ((wq_completion)netns){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff8881449d2938 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:635 [inline]
#0: ffff8881449d2938 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:662 [inline]
#0: ffff8881449d2938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2269
#1: ffffc9000497fdb0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2273
#2: ffffffff8d0f55d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xb00 net/core/net_namespace.c:555
#3: ffffffff8d108d28 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x15/0x190 drivers/net/wireguard/device.c:402
2 locks held by syz-executor.5/5347:
#0: ffffffff8b9f8028 (event_mutex){+.+.}-{3:3}, at: perf_trace_destroy+0x23/0xf0 kernel/trace/trace_event_perf.c:241
#1: ffffffff8b98cee8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
#1: ffffffff8b98cee8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d5/0x620 kernel/rcu/tree_exp.h:836
2 locks held by syz-executor.5/5352:
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:210 [inline]
watchdog+0xc1d/0xf50 kernel/hung_task.c:295
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 15555 Comm: kworker/u4:8 Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: phy21 ieee80211_iface_work
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:85 [inline]
RIP: 0010:lock_release+0xcb/0x720 kernel/locking/lockdep.c:5650
Code: 48 0f a3 1d f7 ea 13 0c 0f 82 60 04 00 00 48 c7 c3 0c 1b 71 8d 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 0f b6 14 02 <48> 89 d8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 5b 05 00 00 44
RSP: 0018:ffffc90000007c78 EFLAGS: 00000013
RAX: dffffc0000000000 RBX: ffffffff8d711b0c RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000010204 RDI: 0000000000000000
RBP: 1ffff92000000f91 R08: 0000000000000000 R09: ffffffff8d70e6d7
R10: fffffbfff1ae1cda R11: 0000000000000000 R12: ffffffff9052eda0
R13: ffffffff898e0280 R14: 1ffff92000000fad R15: ffff88807ba9aa88
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6491112010 CR3: 000000007b57b000 CR4: 0000000000350ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline]
_raw_spin_unlock_irqrestore+0x16/0x70 kernel/locking/spinlock.c:194
debug_object_deactivate lib/debugobjects.c:757 [inline]
debug_object_deactivate+0x264/0x300 lib/debugobjects.c:723
debug_hrtimer_deactivate kernel/time/hrtimer.c:425 [inline]
debug_deactivate kernel/time/hrtimer.c:481 [inline]
__run_hrtimer kernel/time/hrtimer.c:1653 [inline]
__hrtimer_run_queues+0x3f8/0xe50 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
__sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:unwind_next_frame+0x27/0x1ce0 arch/x86/kernel/unwind_orc.c:418
Code: 0f 1f 00 48 b8 00 00 00 00 00 fc ff df 41 57 41 56 49 89 fe 41 55 41 54 55 53 48 81 ec a0 00 00 00 48 c7 44 24 40 b3 8a b5 41 <48> 8d 5c 24 40 48 c7 44 24 48 09 50 16 8b 48 c1 eb 03 48 c7 44 24
RSP: 0018:ffffc9000ab67120 EFLAGS: 00000282
RAX: dffffc0000000000 RBX: ffffffff8165f8a0 RCX: 0000000000000000
RDX: 1ffff9200156ce6e RSI: ffffffff814c7e82 RDI: ffffc9000ab671f8
RBP: ffffc9000ab67280 R08: ffffffff8e789f74 R09: 0000000000000001
R10: fffff5200156ce4a R11: 000000000008608a R12: ffffc9000ab672b0
R13: 0000000000000000 R14: ffffc9000ab671f8 R15: ffff888019400f00
arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x1e/0x50 mm/kasan/common.c:38
__kasan_record_aux_stack+0xf5/0x120 mm/kasan/generic.c:348
kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3550
cfg80211_update_known_bss+0x833/0xa60 net/wireless/scan.c:1663
cfg80211_bss_update+0xef/0x2070 net/wireless/scan.c:1710
cfg80211_inform_single_bss_frame_data+0x6e8/0xee0 net/wireless/scan.c:2425
cfg80211_inform_bss_frame_data+0xa7/0xb50 net/wireless/scan.c:2458
ieee80211_bss_info_update+0x35b/0xb30 net/mac80211/scan.c:190
ieee80211_rx_bss_info net/mac80211/ibss.c:1119 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1610 [inline]
ieee80211_ibss_rx_queued_mgmt+0x19cf/0x3130 net/mac80211/ibss.c:1639
ieee80211_iface_process_skb net/mac80211/iface.c:1466 [inline]
ieee80211_iface_work+0xa65/0xd00 net/mac80211/iface.c:1520
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2298
worker_thread+0x658/0x11f0 kernel/workqueue.c:2445
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
----------------
Code disassembly (best guess):
0: 48 0f a3 1d f7 ea 13 bt %rbx,0xc13eaf7(%rip) # 0xc13eaff
7: 0c
8: 0f 82 60 04 00 00 jb 0x46e
e: 48 c7 c3 0c 1b 71 8d mov $0xffffffff8d711b0c,%rbx
15: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
1c: fc ff df
1f: 48 89 da mov %rbx,%rdx
22: 48 c1 ea 03 shr $0x3,%rdx
26: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx
* 2a: 48 89 d8 mov %rbx,%rax <-- trapping instruction
2d: 83 e0 07 and $0x7,%eax
30: 83 c0 03 add $0x3,%eax
33: 38 d0 cmp %dl,%al
35: 7c 08 jl 0x3f
37: 84 d2 test %dl,%dl
39: 0f 85 5b 05 00 00 jne 0x59a
3f: 44 rex.R