Extracting prog: 10m34.182833201s Minimizing prog: 1h41m37.613468963s Simplifying prog options: 14m17.583787988s Extracting C: 5m14.446089718s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program crashed: INFO: task hung in addrconf_dad_work single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-sendmsg$nl_route detailed listing: executing program 0: socket(0x10, 0x803, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r1, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r1, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, 0x0, &(0x7f0000000400)) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, 0x0, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x3c}}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[], 0x3c}}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r2, @ANYBLOB], 0x3c}}, 0x0) program did not crash testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=8m13.500690453s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program crashed: INFO: task hung in linkwatch_event a never seen crash title: INFO: task hung in linkwatch_event, ignore testing program (duration=8m13.500690453s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket$nl_route-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x14) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffffffff00000000", @ANYRES32=r2, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}}, 0x0) program did not crash reproducing took 2h11m43.82637337s repro crashed as (corrupted=false): INFO: task kworker/0:0:7 blocked for more than 143 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:22880 pid:7 ppid:2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137 process_one_work+0x898/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task dhcpcd:3918 blocked for more than 143 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:20960 pid:3918 ppid:3917 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 devinet_ioctl+0x288/0x1af0 net/ipv4/devinet.c:1081 inet_ioctl+0x2c9/0x400 net/ipv4/af_inet.c:1008 sock_do_ioctl+0xd3/0x2f0 net/socket.c:1204 sock_ioctl+0x4ed/0x6e0 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd0ec17e378 RSP: 002b:00007ffe1ba2c8d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 00007fd0ec17e378 RDX: 00007ffe1ba3cad0 RSI: 0000000000008914 RDI: 0000000000000011 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe1ba4cc70 R13: 00007fd0ec07e6c8 R14: 0000000000000028 R15: 0000000000008914 INFO: task kworker/1:4:4287 blocked for more than 143 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:4 state:D stack:23688 pid:4287 ppid:2 flags:0x00004000 Workqueue: events switchdev_deferred_process_work Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104 process_one_work+0x898/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/1:10:4325 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:10 state:D stack:23488 pid:4325 ppid:2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137 process_one_work+0x898/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:5:4383 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:5 state:D stack:24768 pid:4383 ppid:2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 linkwatch_event+0xa/0x50 net/core/link_watch.c:263 process_one_work+0x898/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor:10317 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22144 pid:10317 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x44f/0x5c0 net/socket.c:2153 __do_sys_sendto net/socket.c:2165 [inline] __se_sys_sendto net/socket.c:2161 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2161 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd9e13907fc RSP: 002b:00007ffee16d5ba0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fd9e20e4620 RCX: 00007fd9e13907fc RDX: 0000000000000040 RSI: 00007fd9e20e4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffee16d5bf4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fd9e20e4670 R15: 0000000000000000 INFO: task syz-executor:10322 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22144 pid:10322 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 devinet_ioctl+0x288/0x1af0 net/ipv4/devinet.c:1081 inet_ioctl+0x2c9/0x400 net/ipv4/af_inet.c:1008 sock_do_ioctl+0xd3/0x2f0 net/socket.c:1204 sock_ioctl+0x4ed/0x6e0 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f5ea918e56b RSP: 002b:00007ffc25d23160 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffc25d23280 RCX: 00007f5ea918e56b RDX: 00007ffc25d231e0 RSI: 0000000000008914 RDI: 0000000000000005 RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000022 R13: 0000000000000047 R14: 00007f5ea9ee4620 R15: 00007ffc25d231e0 INFO: task syz-executor:10323 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22080 pid:10323 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x44f/0x5c0 net/socket.c:2153 __do_sys_sendto net/socket.c:2165 [inline] __se_sys_sendto net/socket.c:2161 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2161 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff34d1907fc RSP: 002b:00007fffff5ac3d0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007ff34dee4620 RCX: 00007ff34d1907fc RDX: 0000000000000028 RSI: 00007ff34dee4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007fffff5ac424 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007ff34dee4670 R15: 0000000000000000 INFO: task syz-executor:10324 blocked for more than 145 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22144 pid:10324 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 ieee80211_register_hw+0x2c52/0x38c0 net/mac80211/main.c:1394 mac80211_hwsim_new_radio+0x28c2/0x4c40 drivers/net/wireless/mac80211_hwsim.c:4582 hwsim_new_radio_nl+0xafa/0xce0 drivers/net/wireless/mac80211_hwsim.c:5176 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x5f2/0x780 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x44f/0x5c0 net/socket.c:2153 __do_sys_sendto net/socket.c:2165 [inline] __se_sys_sendto net/socket.c:2161 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2161 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f9bcb1907fc RSP: 002b:00007ffc021486a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f9bcbee4620 RCX: 00007f9bcb1907fc RDX: 0000000000000024 RSI: 00007f9bcbee4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffc021486f4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f9bcbee4670 R15: 0000000000000000 INFO: task syz.4.2931:10533 blocked for more than 145 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.2931 state:D stack:25856 pid:10533 ppid:10089 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x59b/0x970 net/socket.c:2519 ___sys_sendmsg+0x21c/0x290 net/socket.c:2573 __sys_sendmsg net/socket.c:2602 [inline] __do_sys_sendmsg net/socket.c:2611 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2609 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f05e638e969 RSP: 002b:00007f05e61ff038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f05e65b5fa0 RCX: 00007f05e638e969 RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 RBP: 00007f05e6410ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f05e65b5fa0 R15: 00007ffceb642a88 Showing all locks held in the system: 3 locks held by kworker/0:0/7: #0: ffff88814c9d5538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc900000c7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8c92b4b0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8c92bcd0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 3 locks held by kworker/1:1/27: #0: ffff888017471938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90000a3fd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x8b/0xd80 net/wireless/reg.c:2499 1 lock held by khungtaskd/28: #0: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513 5 locks held by kworker/u4:4/56: #0: ffff888017616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90001577d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db27790 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x132/0xb80 net/core/net_namespace.c:594 #3: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xe5/0xa50 net/core/dev.c:11477 #4: ffffffff8c9306c0 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x48/0x600 kernel/rcu/tree.c:4019 1 lock held by klogd/3612: #0: ffff8880b8f3aa58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537 1 lock held by dhcpcd/3918: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x288/0x1af0 net/ipv4/devinet.c:1081 2 locks held by getty/4019: #0: ffff888030084098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000325e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41b/0x1380 drivers/tty/n_tty.c:2198 3 locks held by kworker/1:4/4287: #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90003be7d00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104 3 locks held by kworker/1:10/4325: #0: ffff88814c9d5538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90003d77d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137 3 locks held by kworker/u4:5/4383: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90003337d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263 1 lock held by syz-executor/10317: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10322: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x288/0x1af0 net/ipv4/devinet.c:1081 1 lock held by syz-executor/10323: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 3 locks held by syz-executor/10324: #0: ffffffff8db94130 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860 #1: ffffffff8db93f48 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #1: ffffffff8db93f48 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x103/0x780 net/netlink/genetlink.c:848 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_register_hw+0x2c52/0x38c0 net/mac80211/main.c:1394 1 lock held by syz.4.2931/10533: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10542: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10549: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10553: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10554: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10558: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10562: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10569: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10573: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10574: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10576: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10583: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10590: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10592: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10597: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10598: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.1.140-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106 nmi_cpu_backtrace+0x3f4/0x470 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xeee/0xf30 kernel/hung_task.c:377 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 3605 Comm: syslogd Not tainted 6.1.140-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:task_on_rq_migrating kernel/sched/sched.h:2077 [inline] RIP: 0010:activate_task kernel/sched/core.c:2084 [inline] RIP: 0010:ttwu_do_activate+0x193/0x340 kernel/sched/core.c:3699 Code: e8 b4 03 00 be 04 00 00 00 e8 c9 25 7a 00 f0 ff 8b e8 b4 03 00 ba 09 00 00 00 49 8d 5e 68 49 89 dc 49 c1 ec 03 43 0f b6 04 2c <84> c0 0f 85 97 00 00 00 41 8b 46 68 83 f8 02 b8 49 00 00 00 0f 44 RSP: 0018:ffffc9000d8977b8 EFLAGS: 00000806 RAX: 0000000000000000 RBX: ffff88807d8e59a8 RCX: 675229ad216f5c00 RDX: 0000000000000009 RSI: ffffffff8a6c1180 RDI: ffffffff8abf1260 RBP: 0000000000000010 R08: ffffffff8f7cd008 R09: ffffffff8f7cd018 R10: ffffffff8f7cd010 R11: ffffffff8f7cd003 R12: 1ffff1100fb1cb35 R13: dffffc0000000000 R14: ffff88807d8e5940 R15: ffff8880b8e3aa40 FS: 00007f447282cc80(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056553977d9e8 CR3: 000000007f902000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ttwu_queue kernel/sched/core.c:3904 [inline] try_to_wake_up+0x5de/0x1080 kernel/sched/core.c:4227 autoremove_wake_function+0x13/0xf0 kernel/sched/wait.c:419 __wake_up_common+0x2a4/0x4e0 kernel/sched/wait.c:107 __wake_up_common_lock kernel/sched/wait.c:138 [inline] __wake_up_sync_key+0x10d/0x180 kernel/sched/wait.c:208 __unix_dgram_recvmsg+0x497/0xd50 net/unix/af_unix.c:2454 sock_recvmsg_nosec net/socket.c:1022 [inline] sock_recvmsg net/socket.c:1040 [inline] sock_read_iter+0x2bf/0x370 net/socket.c:1121 call_read_iter include/linux/fs.h:2259 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x434/0x920 fs/read_write.c:470 ksys_read+0x143/0x240 fs/read_write.c:613 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f447297c407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc9dcad950 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f447282cc80 RCX: 00007f447297c407 RDX: 00000000000000ff RSI: 000055e15c2e1950 RDI: 0000000000000000 RBP: 000055e15c2e1910 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000055e15c2e1982 R13: 0000000000000000 R14: 000055e15c2e1950 R15: 000055e153edad98 final repro crashed as (corrupted=false): INFO: task kworker/0:0:7 blocked for more than 143 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:0 state:D stack:22880 pid:7 ppid:2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137 process_one_work+0x898/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task dhcpcd:3918 blocked for more than 143 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:20960 pid:3918 ppid:3917 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 devinet_ioctl+0x288/0x1af0 net/ipv4/devinet.c:1081 inet_ioctl+0x2c9/0x400 net/ipv4/af_inet.c:1008 sock_do_ioctl+0xd3/0x2f0 net/socket.c:1204 sock_ioctl+0x4ed/0x6e0 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd0ec17e378 RSP: 002b:00007ffe1ba2c8d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 00007fd0ec17e378 RDX: 00007ffe1ba3cad0 RSI: 0000000000008914 RDI: 0000000000000011 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe1ba4cc70 R13: 00007fd0ec07e6c8 R14: 0000000000000028 R15: 0000000000008914 INFO: task kworker/1:4:4287 blocked for more than 143 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:4 state:D stack:23688 pid:4287 ppid:2 flags:0x00004000 Workqueue: events switchdev_deferred_process_work Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104 process_one_work+0x898/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/1:10:4325 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:10 state:D stack:23488 pid:4325 ppid:2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137 process_one_work+0x898/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:5:4383 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:5 state:D stack:24768 pid:4383 ppid:2 flags:0x00004000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 linkwatch_event+0xa/0x50 net/core/link_watch.c:263 process_one_work+0x898/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor:10317 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22144 pid:10317 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x44f/0x5c0 net/socket.c:2153 __do_sys_sendto net/socket.c:2165 [inline] __se_sys_sendto net/socket.c:2161 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2161 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fd9e13907fc RSP: 002b:00007ffee16d5ba0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fd9e20e4620 RCX: 00007fd9e13907fc RDX: 0000000000000040 RSI: 00007fd9e20e4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffee16d5bf4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fd9e20e4670 R15: 0000000000000000 INFO: task syz-executor:10322 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22144 pid:10322 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 devinet_ioctl+0x288/0x1af0 net/ipv4/devinet.c:1081 inet_ioctl+0x2c9/0x400 net/ipv4/af_inet.c:1008 sock_do_ioctl+0xd3/0x2f0 net/socket.c:1204 sock_ioctl+0x4ed/0x6e0 net/socket.c:1321 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f5ea918e56b RSP: 002b:00007ffc25d23160 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007ffc25d23280 RCX: 00007f5ea918e56b RDX: 00007ffc25d231e0 RSI: 0000000000008914 RDI: 0000000000000005 RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000022 R13: 0000000000000047 R14: 00007f5ea9ee4620 R15: 00007ffc25d231e0 INFO: task syz-executor:10323 blocked for more than 144 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22080 pid:10323 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x44f/0x5c0 net/socket.c:2153 __do_sys_sendto net/socket.c:2165 [inline] __se_sys_sendto net/socket.c:2161 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2161 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff34d1907fc RSP: 002b:00007fffff5ac3d0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007ff34dee4620 RCX: 00007ff34d1907fc RDX: 0000000000000028 RSI: 00007ff34dee4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007fffff5ac424 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007ff34dee4670 R15: 0000000000000000 INFO: task syz-executor:10324 blocked for more than 145 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22144 pid:10324 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 ieee80211_register_hw+0x2c52/0x38c0 net/mac80211/main.c:1394 mac80211_hwsim_new_radio+0x28c2/0x4c40 drivers/net/wireless/mac80211_hwsim.c:4582 hwsim_new_radio_nl+0xafa/0xce0 drivers/net/wireless/mac80211_hwsim.c:5176 genl_family_rcv_msg_doit+0x22e/0x320 net/netlink/genetlink.c:756 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline] genl_rcv_msg+0x5f2/0x780 net/netlink/genetlink.c:850 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x44f/0x5c0 net/socket.c:2153 __do_sys_sendto net/socket.c:2165 [inline] __se_sys_sendto net/socket.c:2161 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2161 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f9bcb1907fc RSP: 002b:00007ffc021486a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f9bcbee4620 RCX: 00007f9bcb1907fc RDX: 0000000000000024 RSI: 00007f9bcbee4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffc021486f4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f9bcbee4670 R15: 0000000000000000 INFO: task syz.4.2931:10533 blocked for more than 145 seconds. Not tainted 6.1.140-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.2931 state:D stack:25856 pid:10533 ppid:10089 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561 schedule+0xb9/0x180 kernel/sched/core.c:6637 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x59b/0x970 net/socket.c:2519 ___sys_sendmsg+0x21c/0x290 net/socket.c:2573 __sys_sendmsg net/socket.c:2602 [inline] __do_sys_sendmsg net/socket.c:2611 [inline] __se_sys_sendmsg+0x19e/0x270 net/socket.c:2609 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f05e638e969 RSP: 002b:00007f05e61ff038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f05e65b5fa0 RCX: 00007f05e638e969 RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000004 RBP: 00007f05e6410ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f05e65b5fa0 R15: 00007ffceb642a88 Showing all locks held in the system: 3 locks held by kworker/0:0/7: #0: ffff88814c9d5538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc900000c7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8c92b4b0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8c92bcd0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 3 locks held by kworker/1:1/27: #0: ffff888017471938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90000a3fd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x8b/0xd80 net/wireless/reg.c:2499 1 lock held by khungtaskd/28: #0: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8c92ab20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513 5 locks held by kworker/u4:4/56: #0: ffff888017616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90001577d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db27790 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x132/0xb80 net/core/net_namespace.c:594 #3: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xe5/0xa50 net/core/dev.c:11477 #4: ffffffff8c9306c0 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x48/0x600 kernel/rcu/tree.c:4019 1 lock held by klogd/3612: #0: ffff8880b8f3aa58 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537 1 lock held by dhcpcd/3918: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x288/0x1af0 net/ipv4/devinet.c:1081 2 locks held by getty/4019: #0: ffff888030084098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000325e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41b/0x1380 drivers/tty/n_tty.c:2198 3 locks held by kworker/1:4/4287: #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90003be7d00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104 3 locks held by kworker/1:10/4325: #0: ffff88814c9d5538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90003d77d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137 3 locks held by kworker/u4:5/4383: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #1: ffffc90003337d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263 1 lock held by syz-executor/10317: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10322: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x288/0x1af0 net/ipv4/devinet.c:1081 1 lock held by syz-executor/10323: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 3 locks held by syz-executor/10324: #0: ffffffff8db94130 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860 #1: ffffffff8db93f48 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline] #1: ffffffff8db93f48 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x103/0x780 net/netlink/genetlink.c:848 #2: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_register_hw+0x2c52/0x38c0 net/mac80211/main.c:1394 1 lock held by syz.4.2931/10533: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10542: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10549: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10553: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10554: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10558: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10562: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10569: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10573: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10574: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10576: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10583: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10590: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10592: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10597: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 1 lock held by syz-executor/10598: #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8db34428 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.1.140-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106 nmi_cpu_backtrace+0x3f4/0x470 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xeee/0xf30 kernel/hung_task.c:377 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 3605 Comm: syslogd Not tainted 6.1.140-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 RIP: 0010:task_on_rq_migrating kernel/sched/sched.h:2077 [inline] RIP: 0010:activate_task kernel/sched/core.c:2084 [inline] RIP: 0010:ttwu_do_activate+0x193/0x340 kernel/sched/core.c:3699 Code: e8 b4 03 00 be 04 00 00 00 e8 c9 25 7a 00 f0 ff 8b e8 b4 03 00 ba 09 00 00 00 49 8d 5e 68 49 89 dc 49 c1 ec 03 43 0f b6 04 2c <84> c0 0f 85 97 00 00 00 41 8b 46 68 83 f8 02 b8 49 00 00 00 0f 44 RSP: 0018:ffffc9000d8977b8 EFLAGS: 00000806 RAX: 0000000000000000 RBX: ffff88807d8e59a8 RCX: 675229ad216f5c00 RDX: 0000000000000009 RSI: ffffffff8a6c1180 RDI: ffffffff8abf1260 RBP: 0000000000000010 R08: ffffffff8f7cd008 R09: ffffffff8f7cd018 R10: ffffffff8f7cd010 R11: ffffffff8f7cd003 R12: 1ffff1100fb1cb35 R13: dffffc0000000000 R14: ffff88807d8e5940 R15: ffff8880b8e3aa40 FS: 00007f447282cc80(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056553977d9e8 CR3: 000000007f902000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ttwu_queue kernel/sched/core.c:3904 [inline] try_to_wake_up+0x5de/0x1080 kernel/sched/core.c:4227 autoremove_wake_function+0x13/0xf0 kernel/sched/wait.c:419 __wake_up_common+0x2a4/0x4e0 kernel/sched/wait.c:107 __wake_up_common_lock kernel/sched/wait.c:138 [inline] __wake_up_sync_key+0x10d/0x180 kernel/sched/wait.c:208 __unix_dgram_recvmsg+0x497/0xd50 net/unix/af_unix.c:2454 sock_recvmsg_nosec net/socket.c:1022 [inline] sock_recvmsg net/socket.c:1040 [inline] sock_read_iter+0x2bf/0x370 net/socket.c:1121 call_read_iter include/linux/fs.h:2259 [inline] new_sync_read fs/read_write.c:389 [inline] vfs_read+0x434/0x920 fs/read_write.c:470 ksys_read+0x143/0x240 fs/read_write.c:613 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f447297c407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc9dcad950 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007f447282cc80 RCX: 00007f447297c407 RDX: 00000000000000ff RSI: 000055e15c2e1950 RDI: 0000000000000000 RBP: 000055e15c2e1910 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000055e15c2e1982 R13: 0000000000000000 R14: 000055e15c2e1950 R15: 000055e153edad98