INFO: task syz-executor:16834 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:22088 pid:16834 tgid:16834 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7643
rt_mutex_slowlock_block+0x55e/0x690 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f341adfe98e
RSP: 002b:00007ffd5d53cd18 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055558d6c4500 RCX: 00007f341adfe98e
RDX: 0000000000000001 RSI: 00007ffd5d53cda0 RDI: 0000000000000005
RBP: 00007f341aed58a7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffd5d53cda0 R14: 00007f341bbf4620 R15: 0000000000000003
INFO: task syz-executor:16887 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:20808 pid:16887 tgid:16887 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7643
rt_mutex_slowlock_block+0x55e/0x690 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6a1c9ce98e
RSP: 002b:00007ffc981abb68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055559071c500 RCX: 00007f6a1c9ce98e
RDX: 0000000000000001 RSI: 00007ffc981abbf0 RDI: 0000000000000005
RBP: 00007f6a1caa58a7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc981abbf0 R14: 00007f6a1d7c4620 R15: 0000000000000003
INFO: task syz-executor:16902 blocked for more than 143 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:21544 pid:16902 tgid:16902 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x16d9/0x5700 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7643
rt_mutex_slowlock_block+0x55e/0x690 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_sysca
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f63e5efe98e
RSP: 002b:00007ffdf7b65c38 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555593dda500 RCX: 00007f63e5efe98e
RDX: 0000000000000001 RSI: 00007ffdf7b65cc0 RDI: 0000000000000005
RBP: 00007f63e5fd58a7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffdf7b65cc0 R14: 00007f63e6cf4620 R15: 0000000000000003
Showing all locks held in the system:
locks held by rcuc/0/20: 4, last CPU#0:
#0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3d/0x420 kernel/softirq.c:186
#1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x261/0xc50 net/core/dev.c:6727
#2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:249 [inline]
#2: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:323
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#3: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: ip_route_output_key_hash+0xd8/0x2a0 net/ipv4/route.c:2733
locks held by khungtaskd/38: 1, last CPU#1:
#0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8e1c3ac0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6837
locks held by kworker/1:3/5316: 3, on CPU#1:
#0: ffff88813ff27938 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88813ff27938 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88813ff27938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#0: ffff88813ff27938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
#1: ffffc9000156fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc9000156fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc9000156fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#1: ffffc9000156fc40 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
#2: ffffffff8e1c9d30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by getty/5341: 2, on CPU#0:
#0: ffff888028e190a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc900044cb2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
locks held by kworker/u8:26/14014: 5, on CPU#0:
#0: ffff88801aeb0938 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#0: ffff88801aeb0938 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffff88801aeb0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#0: ffff88801aeb0938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
#1: ffffc900103efc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
#1: ffffc900103efc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#1: ffffc900103efc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3352 [inline]
#1: ffffc900103efc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3470
#2: ffffffff8f5c33e0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677
#3: ffff88805efd9978 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_destruct+0x116/0x310 drivers/net/wireguard/device.c:249
#4: ffffffff8e1c9d30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/16523: 7, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88803828c878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
#4: ffff88803fd05160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
#4: ffff88803fd05160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
#4: ffff88803fd05160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369
#5: ffff88802b1a6310 (&devlink->lock_key#20){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 drivers/net/netdevsim/dev.c:1724
#6: ffffffff8e1c9d30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz.6.2444/16801: 1, on CPU#1:
#0: ffffffff8e1c9d30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/16834: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff888029e2ec78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/16887: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88807d807078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/16902: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88805f44b478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz.8.2481/16988: 2, on CPU#1:
#0: ffffffff8f5c33e0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x524/0x780 net/core/net_namespace.c:578
#1: ffffffff8e1c9d30 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3904
locks held by syz-executor/17049: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88807f4cd478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17091: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88803b12ac78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17164: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff888060021478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17184: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88805e5a4c78 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17205: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff8880911d4878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17225: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff888033e95478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17248: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff8880911d6878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17267: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff888038637078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17298: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88805dea8878 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17350: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88803eafe478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17377: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff88808e260078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
locks held by syz-executor/17397: 4, on CPU#1:
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
#0: ffff888035dac510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
#1: ffff888097d5a078 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
#2: ffff8880293fe5a8 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
#3: ffffffff8ee428b8 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
=============================================
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 38 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123
nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66
trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline]
__sys_info lib/sys_info.c:157 [inline]
sys_info+0x135/0x170 lib/sys_info.c:165
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 11370 Comm: kworker/u8:21 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:__bfs kernel/locking/lockdep.c:1769 [inline]
RIP: 0010:__bfs_backwards kernel/locking/lockdep.c:1876 [inline]
RIP: 0010:check_irq_usage kernel/locking/lockdep.c:2812 [inline]
RIP: 0010:check_prev_add kernel/locking/lockdep.c:3185 [inline]
RIP: 0010:check_prevs_add kernel/locking/lockdep.c:3300 [inline]
RIP: 0010:validate_chain kernel/locking/lockdep.c:3924 [inline]
RIP: 0010:__lock_acquire+0x188f/0x2e40 kernel/locking/lockdep.c:5254
Code: 00 00 0f 83 8d 01 00 00 4e 8b 3c e5 60 d9 aa 95 ff c0 25 ff 0f 00 00 89 05 1e 8a 09 14 4d 85 ff 0f 84 bf 01 00 00 49 8b 47 10 <48> 85 c0 0f 84 8b 0d 00 00 8b 0d 0a 8a 09 14 39 48 5c 0f 84 6f ff
RSP: 0018:ffffc90007c0dad0 EFLAGS: 00000082
RAX: ffffffff934fe7a8 RBX: 00000000000003cd RCX: ffffffff9638fbc8
RDX: ffffffff962e2c98 RSI: ffff88802d29eb40 RDI: ffff88802d29ddc0
RBP: c16e00190697258e R08: 00000000000003cd R09: 0000000000000020
R10: 0000000000000000 R11: ffffffff81a22540 R12: 0000000000000016
R13: ffffffff934bd4e0 R14: ffff88802d29eb40 R15: ffffffff9638fbc8
FS: 0000000000000000(0000) GS:ffff888125bd6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000562eeae0b660 CR3: 000000000dfb0000 CR4: 00000000003526f0
Call Trace:
lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5908
do_write_seqcount_begin_nested include/linux/seqlock.h:478 [inline]
do_write_seqcount_begin include/linux/seqlock.h:504 [inline]
psi_write_begin+0xa9/0x160 kernel/sched/psi.c:183
psi_task_change+0xc9/0x320 kernel/sched/psi.c:919
psi_enqueue kernel/sched/stats.h:159 [inline]
enqueue_task+0x341/0x410 kernel/sched/core.c:2196
activate_task kernel/sched/core.c:2234 [inline]
ttwu_do_activate+0x1c8/0x640 kernel/sched/core.c:3834
ttwu_queue kernel/sched/core.c:4087 [inline]
try_to_wake_up+0x7b1/0x1430 kernel/sched/core.c:4425
rt_mutex_wake_up_q kernel/locking/rtmutex.c:574 [inline]
rt_mutex_slowunlock+0x5ff/0xa30 kernel/locking/rtmutex.c:1483
rt_spin_unlock+0x10f/0x200 kernel/locking/spinlock_rt.c:84
spin_unlock_irqrestore include/linux/spinlock_rt.h:141 [inline]
get_partial_node_bulk mm/slub.c:3878 [inline]
__refill_objects_node+0x1e8/0x5a0 mm/slub.c:7269
refill_objects+0x56/0x350 mm/slub.c:7397
refill_sheaf mm/slub.c:2885 [inline]
__pcs_replace_empty_main+0x339/0x690 mm/slub.c:4774
alloc_from_pcs mm/slub.c:4850 [inline]
slab_alloc_node mm/slub.c:4984 [inline]
kmem_cache_alloc_node_noprof+0x4f1/0x660 mm/slub.c:5068
__alloc_skb+0x1db/0x7a0 net/core/skbuff.c:704
alloc_skb include/linux/skbuff.h:1384 [inline]
synproxy_send_client_synack+0x175/0xde0 net/netfilter/nf_synproxy_core.c:463
nft_synproxy_eval_v4+0x362/0x4e0 net/netfilter/nft_synproxy.c:59
nft_synproxy_do_eval+0x335/0x550 net/netfilter/nft_synproxy.c:141
expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
nft_do_chain+0x48d/0x1b10 net/netfilter/nf_tables_core.c:285
nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162
nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
nf_hook include/linux/netfilter.h:280 [inline]
NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:323
NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325
__netif_receive_skb_one_core net/core/dev.c:6264 [inline]
__netif_receive_skb net/core/dev.c:6377 [inline]
process_backlog+0x564/0xc50 net/core/dev.c:6728
__napi_poll+0xae/0x550 net/core/dev.c:7787
napi_poll net/core/dev.c:7850 [inline]
net_rx_action+0x621/0xd70 net/core/dev.c:8007
handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645
__do_softirq kernel/softirq.c:679 [inline]
__local_bh_enable_ip+0x16f/0x2b0 kernel/softirq.c:325
local_bh_enable include/linux/bottom_half.h:33 [inline]
spin_unlock_bh include/linux/spinlock_rt.h:122 [inline]
cfg80211_inform_single_bss_data+0x135d/0x1bf0 net/wireless/scan.c:2426
cfg80211_inform_bss_data+0x263/0x3cc0 net/wireless/scan.c:3266
cfg80211_inform_bss_frame_data+0x3c7/0x840 net/wireless/scan.c:3358
ieee80211_bss_info_update+0x791/0xa50 net/mac80211/scan.c:230
ieee80211_rx_bss_info net/mac80211/ibss.c:1065 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1546 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1ce3/0x2c40 net/mac80211/ibss.c:1573
ieee80211_iface_process_skb net/mac80211/iface.c:1769 [inline]
ieee80211_iface_work+0x78a/0x1010 net/mac80211/iface.c:1823
cfg80211_wiphy_work+0x29e/0x420 net/wireless/core.c:541
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551
kthread+0x38b/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245