INFO: task kworker/u8:16:8245 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:16 state:D stack:21160 pid:8245 tgid:8245 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 linkwatch_event+0xe/0x60 net/core/link_watch.c:313 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task kworker/u8:9:24158 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:9 state:D stack:27264 pid:24158 tgid:24158 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: ipv6_addrconf addrconf_verify_work Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5830 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 rtnl_net_lock include/linux/rtnetlink.h:134 [inline] addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4795 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Showing all locks held in the system: locks held by kworker/0:1/10: 3, on CPU#0: #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900000f7c40 (deferred_process_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900000f7c40 (deferred_process_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900000f7c40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900000f7c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104 locks held by khungtaskd/32: 1, last CPU#0: #0: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:2/43: 4, last CPU#1: #0: ffff88804ed23948 ((wq_completion)krds_cp_wq#13/3){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88804ed23948 ((wq_completion)krds_cp_wq#13/3){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88804ed23948 ((wq_completion)krds_cp_wq#13/3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88804ed23948 ((wq_completion)krds_cp_wq#13/3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90000b37c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90000b37c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88803889bc80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888043529de0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888043529de0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:3/49: 4, last CPU#0: #0: ffff88807c89d148 ((wq_completion)krds_cp_wq#13/1){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807c89d148 ((wq_completion)krds_cp_wq#13/1){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807c89d148 ((wq_completion)krds_cp_wq#13/1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807c89d148 ((wq_completion)krds_cp_wq#13/1){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90000b97c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000b97c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000b97c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90000b97c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888054aa6a80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff88804352aba0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff88804352aba0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:5/144: 4, last CPU#0: #0: ffff88807c89d948 ((wq_completion)krds_cp_wq#13/2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807c89d948 ((wq_completion)krds_cp_wq#13/2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807c89d948 ((wq_completion)krds_cp_wq#13/2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807c89d948 ((wq_completion)krds_cp_wq#13/2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90002e17c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002e17c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002e17c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90002e17c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88803b78fc80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888033dbb960 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888033dbb960 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:11/3045: 4, last CPU#0: #0: ffff88807cae6948 ((wq_completion)krds_cp_wq#18/0#2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807cae6948 ((wq_completion)krds_cp_wq#18/0#2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807cae6948 ((wq_completion)krds_cp_wq#18/0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807cae6948 ((wq_completion)krds_cp_wq#18/0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000dfefc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000dfefc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000dfefc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000dfefc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888038899580 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #3: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #3: ffffffff8ff5a320 (rcu_read_lock){....}-{1:3}, at: __inet_dev_addr_type+0x159/0x560 net/ipv4/fib_frontend.c:241 locks held by dhcpcd/5299: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x2fb/0x1c50 net/ipv4/devinet.c:1110 locks held by getty/5395: 2, on CPU#1: #0: ffff8880376620a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc9000322e2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by kworker/u8:13/5941: 3, last CPU#0: #0: ffff888078009148 ((wq_completion)krds_cp_wq#13/7){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff888078009148 ((wq_completion)krds_cp_wq#13/7){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff888078009148 ((wq_completion)krds_cp_wq#13/7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff888078009148 ((wq_completion)krds_cp_wq#13/7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000528fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000528fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000528fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000528fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88803889b080 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:14/8243: 3, last CPU#0: #0: ffff88807800f148 ((wq_completion)krds_cp_wq#13/6){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807800f148 ((wq_completion)krds_cp_wq#13/6){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807800f148 ((wq_completion)krds_cp_wq#13/6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807800f148 ((wq_completion)krds_cp_wq#13/6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000e227c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e227c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e227c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000e227c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88803889b380 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by kworker/u8:16/8245: 3, on CPU#1: #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9001b297c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9001b297c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9001b297c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9001b297c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by kworker/u8:17/8246: 4, last CPU#0: #0: ffff88807800d148 ((wq_completion)krds_cp_wq#13/4){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807800d148 ((wq_completion)krds_cp_wq#13/4){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807800d148 ((wq_completion)krds_cp_wq#13/4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807800d148 ((wq_completion)krds_cp_wq#13/4){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000e16fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e16fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e16fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000e16fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88803889b980 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888033dbd4e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888033dbd4e0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/1:14/8571: 3, on CPU#1: #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813ff4ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90009667c40 (netdev_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90009667c40 (netdev_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90009667c40 (netdev_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90009667c40 (netdev_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: netdev_lock_ops_compat include/net/netdev_lock.h:94 [inline] #2: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: netdev_work_proc+0x209/0x780 net/core/netdev_work.c:146 locks held by kworker/u8:19/10372: 4, last CPU#0: #0: ffff88807800e148 ((wq_completion)krds_cp_wq#13/5){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807800e148 ((wq_completion)krds_cp_wq#13/5){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807800e148 ((wq_completion)krds_cp_wq#13/5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807800e148 ((wq_completion)krds_cp_wq#13/5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000df9fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000df9fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000df9fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000df9fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88803889b680 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888043528260 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888043528260 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:22/14326: 3, last CPU#0: #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000206fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000206fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000206fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000206fc40 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888036fc4258 (&devlink->lock_key#6){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xb30 drivers/net/netdevsim/dev.c:834 locks held by syz-executor/17141: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3608 locks held by syz-executor/18023: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3608 locks held by syz-executor/18854: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3608 locks held by syz-executor/19789: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3608 locks held by syz.0.4290/24059: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3608 locks held by kworker/u8:1/24098: 2, last CPU#1: #0: ffff88803209e948 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88803209e948 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88803209e948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88803209e948 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90003cc7c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003cc7c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003cc7c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90003cc7c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:4/24101: 5, last CPU#0: #0: ffff88801cec6148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801cec6148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801cec6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801cec6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900091ffc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900091ffc40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900091ffc40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900091ffc40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff9147d5e8 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677 #3: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline] #3: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x28e/0x8f0 net/core/net_namespace.c:249 #4: ffffffff8ff609a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #4: ffffffff8ff609a8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2cb/0x760 kernel/rcu/tree_exp.h:966 locks held by kworker/u8:6/24103: 3, last CPU#0: #0: ffff88807c89c948 ((wq_completion)krds_cp_wq#13/0#2){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88807c89c948 ((wq_completion)krds_cp_wq#13/0#2){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88807c89c948 ((wq_completion)krds_cp_wq#13/0#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88807c89c948 ((wq_completion)krds_cp_wq#13/0#2){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90003c8fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90003c8fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90003c8fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90003c8fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888054aa6d80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by syz-executor/24136: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 net/core/rtnetlink.c:4251 locks held by syz-executor/24152: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24156: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by kworker/u8:9/24158: 3, on CPU#0: #0: ffff88801d786148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801d786148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801d786148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801d786148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000686fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000686fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000686fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000686fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4795 locks held by kworker/u8:10/24171: 2, last CPU#0: #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88813fe0c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000687fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000687fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000687fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000687fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by syz-executor/24175: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz.3.4315/24189: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:654 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 drivers/net/tun.c:3608 locks held by syz-executor/24194: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24199: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24205: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24207: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24216: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24226: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24235: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24241: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24242: 1, on CPU#0: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/24250: 1, on CPU#1: #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff9148c2a0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:377 [inline] watchdog+0x1073/0x10f0 kernel/hung_task.c:598 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 24098 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 Workqueue: bat_events batadv_tt_purge RIP: 0010:ktime_get+0x1f5/0x220 kernel/time/timekeeping.c:1011 Code: c7 c7 20 41 f8 8f eb b3 e8 78 67 13 00 f3 90 8b 2d a0 ed 17 1a 40 f6 c5 01 75 ed e8 65 67 13 00 e9 77 fe ff ff e8 5b 67 13 00 <4c> 01 e3 48 89 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 d6 0a 50 0a cc RSP: 0018:ffffc90000a08e28 EFLAGS: 00000046 RAX: ffffffff81b5ae75 RBX: 000000002f5aada2 RCX: ffff88807b405dc0 RDX: 8000000000000100 RSI: 0000000000000100 RDI: 0000000000000040 RBP: 00000000000285b8 R08: 0000000000000100 R09: 0000000000000001 R10: 0000000000000003 R11: 8000000000000100 R12: 000000c642363118 R13: ffffffffffffffff R14: 0000000000000018 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff88812371f000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f90e8155000 CR3: 000000000fd48000 CR4: 00000000003526f0 Call Trace: clockevents_program_event+0x290/0x630 kernel/time/clockevents.c:363 hrtimer_update_softirq_timer kernel/time/hrtimer.c:1344 [inline] hrtimer_run_softirq+0x255/0x2e0 kernel/time/hrtimer.c:2152 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 do_softirq+0x77/0xd0 kernel/softirq.c:569 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 spin_unlock_bh include/linux/spinlock.h:407 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2880 [inline] batadv_tt_purge+0x4ee/0xa40 net/batman-adv/translation-table.c:4270 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245