syzbot

INFO: task syz.4.3987:17304 blocked for more than 143 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.3987      state:D stack:24184 pid:17304 tgid:17300 ppid:14747  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5260 [inline]
 __schedule+0xfe4/0x5e10 kernel/sched/core.c:6867
 __schedule_loop kernel/sched/core.c:6949 [inline]
 schedule+0xdd/0x390 kernel/sched/core.c:6964
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7021
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0xc9a/0x1b90 kernel/locking/mutex.c:776
 netdev_wait_allrefs_any net/core/dev.c:11574 [inline]
 netdev_run_todo+0xcd5/0x12c0 net/core/dev.c:11694
 ops_exit_rtnl_list net/core/net_namespace.c:189 [inline]
 ops_undo_list+0x904/0xab0 net/core/net_namespace.c:248
 setup_net+0x1fa/0x3a0 net/core/net_namespace.c:462
 copy_net_ns+0x46f/0x7c0 net/core/net_namespace.c:581
 create_new_namespaces+0x3ea/0xab0 kernel/nsproxy.c:130
 unshare_nsproxy_namespaces+0xc3/0x1f0 kernel/nsproxy.c:226
 ksys_unshare+0x455/0xab0 kernel/fork.c:3171
 __do_sys_unshare kernel/fork.c:3242 [inline]
 __se_sys_unshare kernel/fork.c:3240 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3240
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f62e559aeb9
RSP: 002b:00007f62e6380028 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f62e5816090 RCX: 00007f62e559aeb9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080
RBP: 00007f62e5608c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f62e5816128 R14: 00007f62e5816090 R15: 00007ffff98a5138
 </TASK>

Showing all locks held in the system:
1 lock held by pool_workqueue_/3:
 #0: ffffffff8e5ef8f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x27f/0x3c0 kernel/rcu/tree_exp.h:311
4 locks held by kworker/0:1/10:
 #0: ffff88813fe16948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc900000f7c98 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x91/0x10e0 net/wireless/reg.c:2453
 #3: ffff888079c40788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6360 [inline]
 #3: ffff888079c40788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_leave_invalid_chans net/wireless/reg.c:2441 [inline]
 #3: ffff888079c40788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_check_chans_work+0x12c/0x10e0 net/wireless/reg.c:2456
1 lock held by khungtaskd/31:
 #0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8e5e3120 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184 kernel/locking/lockdep.c:6775
4 locks held by kworker/R-bat_e/3411:
4 locks held by syz-executor/5812:
 #0: ffff88802acfba88 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x11d/0x5a0 mm/mmap_lock.c:259
 #1: ffff888031268518 (sb_pagefaults){.+.+}-{0:0}, at: do_page_mkwrite+0x17a/0x440 mm/memory.c:3531
 #2: ffff88807e17c8e0 (mapping.invalidate_lock#2){++++}-{4:4}, at: filemap_invalidate_lock_shared include/linux/fs.h:1092 [inline]
 #2: ffff88807e17c8e0 (mapping.invalidate_lock#2){++++}-{4:4}, at: ext4_page_mkwrite+0x36c/0x1980 fs/ext4/inode.c:6670
 #3: ffff88807e17c5d0 (&ei->i_data_sem){++++}-{4:4}, at: ext4_da_map_blocks fs/ext4/inode.c:1961 [inline]
 #3: ffff88807e17c5d0 (&ei->i_data_sem){++++}-{4:4}, at: ext4_da_get_block_prep+0x738/0x1240 fs/ext4/inode.c:2027
2 locks held by kworker/u10:0/13669:
 #0: ffff88813fe29148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc9000b9a7c98 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
3 locks held by kworker/u10:1/13674:
3 locks held by kworker/u10:2/13676:
3 locks held by kworker/u10:3/13685:
3 locks held by kworker/u10:4/13705:
 #0: ffff88801c29f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc9000b1e7c98 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff903dcef0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xab/0x830 net/core/net_namespace.c:670
2 locks held by kworker/u10:5/14252:
 #0: ffff88813fe29148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc9000489fc98 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
3 locks held by kworker/0:4/14749:
3 locks held by kworker/u10:6/14812:
2 locks held by syz.4.3987/17304:
 #0: ffffffff903dcef0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x451/0x7c0 net/core/net_namespace.c:577
 #1: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: netdev_wait_allrefs_any net/core/dev.c:11574 [inline]
 #1: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: netdev_run_todo+0xcd5/0x12c0 net/core/dev.c:11694
4 locks held by kworker/u10:7/17395:
 #0: ffff8880340f9148 ((wq_completion)ext4-rsv-conversion){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90002fa7c98 ((work_completion)(&ei->i_rsv_conversion_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffff88803126c950 (jbd2_handle){++++}-{0:0}, at: start_this_handle+0xfaa/0x13a0 fs/jbd2/transaction.c:444
 #3: ffff88807e17c5d0 (&ei->i_data_sem){++++}-{4:4}, at: ext4_map_blocks+0x469/0x13c0 fs/ext4/inode.c:815
3 locks held by kworker/u10:8/17396:
3 locks held by kworker/u10:9/17398:
8 locks held by kworker/u10:10/17431:
3 locks held by kworker/u10:11/17441:
 #0: ffff88814d907148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90003dafc98 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734
4 locks held by kworker/u10:12/17442:
2 locks held by syz.1.4034/17444:
 #0: ffff88802c1926f0 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: __netlink_dump_start+0x150/0x990 net/netlink/af_netlink.c:2404
 #1: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #1: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x18f/0x1f0 net/core/rtnetlink.c:6826
1 lock held by syz.1.4034/17446:
 #0: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x6fd/0x1070 net/core/dev_ioctl.c:868
1 lock held by syz.1.4034/17447:
 #0: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: dev_ioctl+0x6fd/0x1070 net/core/dev_ioctl.c:868
4 locks held by kworker/u10:13/17451:
1 lock held by syz-executor/17453:
 #0: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #0: ffffffff903f5828 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x18b0 net/ipv4/devinet.c:978
6 locks held by kworker/u11:6/17468:
 #0: ffff888079a01948 ((wq_completion)hci4#2){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc90019aa7c98 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
 #2: ffff888077434ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x18a/0x470 net/bluetooth/hci_sync.c:331
 #3: ffff8880774340c0 (&hdev->lock){+.+.}-{4:4}, at: hci_abort_conn_sync+0x141/0xb20 net/bluetooth/hci_sync.c:5703
 #4: ffffffff9068e8e8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2128 [inline]
 #4: ffffffff9068e8e8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_failed+0x119/0x360 net/bluetooth/hci_conn.c:1336
 #5: ffff8880782b3b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x760 net/bluetooth/l2cap_core.c:1763
2 locks held by kworker/u10:14/17491:
 #0: ffff88813fe29148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc900043ffc98 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
2 locks held by kworker/u10:15/17492:
 #0: ffff88813fe29148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x11ae/0x1840 kernel/workqueue.c:3232
 #1: ffffc9000417fc98 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x927/0x1840 kernel/workqueue.c:3233
4 locks held by kworker/u10:16/17497:
1 lock held by modprobe/17498:
2 locks held by modprobe/17499:
4 locks held by kworker/u10:17/17500:
2 locks held by dhcpcd/17501:
 #0: ffff888025fde260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline]
 #0: ffff888025fde260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197
 #1: ffffffff8e5ef8f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x19e/0x3c0 kernel/rcu/tree_exp.h:343
1 lock held by dhcpcd/17502:
 #0: ffff888025fdc260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline]
 #0: ffff888025fdc260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197
1 lock held by dhcpcd/17503:
 #0: ffff888025c08260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline]
 #0: ffff888025c08260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197
1 lock held by dhcpcd/17504:
 #0: ffff888025bfc260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1700 [inline]
 #0: ffff888025bfc260 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf50 net/packet/af_packet.c:3197
2 locks held by kworker/u10:18/17506:
1 lock held by kworker/u10:19/17507:

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x12d/0x151 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x1d7/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x141/0x190 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xcc3/0xfe0 kernel/hung_task.c:515
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 3411 Comm: kworker/R-bat_e Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Workqueue: bat_events batadv_tt_purge
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:109 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:127 [inline]
RIP: 0010:lock_is_held_type+0x51/0x140 kernel/locking/lockdep.c:5936
Code: 57 41 56 41 55 41 54 55 53 48 83 ec 08 65 48 8b 2d 7c c9 6f 08 8b 95 2c 0b 00 00 85 d2 0f 85 a7 00 00 00 48 89 fb 41 89 f4 9c <41> 5d fa 48 c7 c7 c9 21 d3 8d e8 90 16 00 00 65 ff 05 81 10 70 08
RSP: 0000:ffffc90000006880 EFLAGS: 00000246
RAX: 00000000ffffffff RBX: ffffffff8e5e3120 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffff8e5e3120
RBP: ffff8880315a9e80 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000ffffffff
R13: ffff88805cc160df R14: ffff888078020000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881245e3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f37ed4f5e9c CR3: 0000000065ffa000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __in6_dev_get include/net/addrconf.h:347 [inline]
 ip6_ignore_linkdown include/net/addrconf.h:448 [inline]
 find_match net/ipv6/route.c:780 [inline]
 __find_rr_leaf+0x66f/0x1070 net/ipv6/route.c:868
 find_rr_leaf net/ipv6/route.c:889 [inline]
 rt6_select net/ipv6/route.c:933 [inline]
 fib6_table_lookup+0x50f/0xa10 net/ipv6/route.c:2244
 ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2280
 pol_lookup_func include/net/ip6_fib.h:617 [inline]
 __fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]
 fib6_rule_action+0x762/0x910 net/ipv6/fib6_rules.c:275
 fib_rules_lookup+0x418/0x1080 net/core/fib_rules.c:339
 fib6_rule_lookup+0x18b/0x720 net/ipv6/fib6_rules.c:112
 ip6_route_input_lookup net/ipv6/route.c:2349 [inline]
 ip6_route_input+0x662/0xc50 net/ipv6/route.c:2652
 ip6_rcv_finish_core.isra.0+0x1a9/0x5a0 net/ipv6/ip6_input.c:66
 ip6_rcv_finish+0x130/0x550 net/ipv6/ip6_input.c:77
 ip_sabotage_in+0x21e/0x290 net/bridge/br_netfilter_hooks.c:990
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_slow+0xbf/0x220 net/netfilter/core.c:623
 nf_hook.constprop.0+0x2a6/0x750 include/linux/netfilter.h:273
 NF_HOOK include/linux/netfilter.h:316 [inline]
 ipv6_rcv+0xa4/0x610 net/ipv6/ip6_input.c:311
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6152
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6265
 netif_receive_skb_internal net/core/dev.c:6351 [inline]
 netif_receive_skb+0x139/0x760 net/core/dev.c:6410
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70
 br_handle_frame_finish+0x84f/0x1f00 net/bridge/br_input.c:235
 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1167
 br_nf_pre_routing_finish_ipv6+0x769/0xfb0 net/bridge/br_netfilter_ipv6.c:154
 NF_HOOK include/linux/netfilter.h:318 [inline]
 br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x93b/0x1510 net/bridge/br_netfilter_hooks.c:508
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xcdd/0x1520 net/bridge/br_input.c:442
 __netif_receive_skb_core.constprop.0+0x6d7/0x3460 net/core/dev.c:6039
 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6150
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6265
 process_backlog+0x37a/0x1580 net/core/dev.c:6617
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7681
 napi_poll net/core/dev.c:7744 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:7896
 handle_softirqs+0x1ea/0x910 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xac/0xe0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 batadv_tt_local_purge+0x21c/0x3d0 net/batman-adv/translation-table.c:1315
 batadv_tt_purge+0x8b/0xbd0 net/batman-adv/translation-table.c:3509
 process_one_work+0x9c2/0x1840 kernel/workqueue.c:3257
 process_scheduled_works kernel/workqueue.c:3340 [inline]
 rescuer_thread+0x8f1/0xf40 kernel/workqueue.c:3528
 kthread+0x3b3/0x730 kernel/kthread.c:463
 ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>