INFO: task kworker/u8:8:173 blocked for more than 150 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:8 state:D stack:19560 pid:173 tgid:173 ppid:2 task_flags:0x4208060 flags:0x00080000
Workqueue: netns cleanup_net
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
netdev_run_todo+0x10d3/0x12a0 net/core/dev.c:11756
default_device_exit_batch+0x966/0x9e0 net/core/dev.c:13113
ops_exit_list net/core/net_namespace.c:205 [inline]
ops_undo_list+0x4b4/0x8d0 net/core/net_namespace.c:252
cleanup_net+0x575/0x810 net/core/net_namespace.c:702
process_one_work+0x93a/0x12b0 kernel/workqueue.c:3326
process_scheduled_works kernel/workqueue.c:3409 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3490
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task syz-executor:9924 blocked for more than 150 seconds.
Tainted: G L syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:24136 pid:9924 tgid:9924 ppid:1 task_flags:0x400140 flags:0x00080002
Call Trace:
context_switch kernel/sched/core.c:5510 [inline]
__schedule+0x1709/0x5530 kernel/sched/core.c:7234
__schedule_loop kernel/sched/core.c:7311 [inline]
rt_mutex_schedule+0x76/0xf0 kernel/sched/core.c:7607
rt_mutex_slowlock_block+0x55c/0x680 kernel/locking/rtmutex.c:1670
__rt_mutex_slowlock kernel/locking/rtmutex.c:1747 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1787 [inline]
rt_mutex_slowlock+0x2d4/0x780 kernel/locking/rtmutex.c:1827
__rt_mutex_lock kernel/locking/rtmutex.c:1842 [inline]
__mutex_lock_common kernel/locking/rtmutex_api.c:560 [inline]
mutex_lock_nested+0x168/0x1d0 kernel/locking/rtmutex_api.c:578
rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
setup_net+0x2fb/0x350 net/core/net_namespace.c:463
copy_net_ns+0x4f9/0x720 net/core/net_namespace.c:579
create_new_namespaces+0x3f0/0x6b0 kernel/nsproxy.c:132
unshare_nsproxy_namespaces+0x149/0x190 kernel/nsproxy.c:234
ksys_unshare+0x57d/0xa00 kernel/fork.c:3268
__do_sys_unshare kernel/fork.c:3342 [inline]
__se_sys_unshare kernel/fork.c:3340 [inline]
__x64_sys_unshare+0x38/0x50 kernel/fork.c:3340
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f02b152f127
RSP: 002b:00007ffc0aa526d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f02b17b5f40 RCX: 00007f02b152f127
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f02b17b67b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffc0aa52918 R15: 0000000000000000
Showing all locks held in the system:
3 locks held by kworker/0:0/9:
#0: ffff88813fe4b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc900000e7c60 ((fqdir_free_work).work){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#2: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
7 locks held by ktimers/0/16:
#0: ffffffff8de591e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#2: ffff8880b86284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff8880b86284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: hrtimer_cpu_base_lock_expiry kernel/time/hrtimer.c:1650 [inline]
#2: ffff8880b86284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: hrtimer_run_softirq+0x7f/0x260 kernel/time/hrtimer.c:2109
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 net/mac80211/util.c:807
#5: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#5: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __ieee80211_beacon_get+0x34/0x1820 net/mac80211/tx.c:5740
#6: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#6: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: get_partial_node_bulk mm/slub.c:3772 [inline]
#6: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x89/0x5b0 mm/slub.c:7173
4 locks held by pr/legacy/17:
#0: ffffffff8dfb5280 (console_lock){+.+.}-{0:0}, at: legacy_kthread_func+0x1a3/0x250 kernel/printk/printk.c:3711
#1: ffffffff8de9cb78 (console_srcu){....}-{0:0}, at: rcu_try_lock_acquire include/linux/rcupdate.h:305 [inline]
#1: ffffffff8de9cb78 (console_srcu){....}-{0:0}, at: srcu_read_lock_nmisafe include/linux/srcu.h:428 [inline]
#1: ffffffff8de9cb78 (console_srcu){....}-{0:0}, at: console_srcu_read_lock kernel/printk/printk.c:291 [inline]
#1: ffffffff8de9cb78 (console_srcu){....}-{0:0}, at: console_flush_one_record+0xfa/0xb50 kernel/printk/printk.c:3246
#2: ffffffff99bbecf8 (&port_lock_key){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffffffff99bbecf8 (&port_lock_key){+.+.}-{3:3}, at: uart_port_lock_irqsave include/linux/serial_core.h:719 [inline]
#2: ffffffff99bbecf8 (&port_lock_key){+.+.}-{3:3}, at: serial8250_console_write+0x17c/0x1b40 drivers/tty/serial/8250/8250_port.c:3338
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
4 locks held by rcuc/0/21:
#0: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x261/0xc50 net/core/dev.c:6670
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:242 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:316
#3: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x4e2/0x5b0 mm/slub.c:7220
3 locks held by rcuc/1/29:
#0: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: process_backlog+0x261/0xc50 net/core/dev.c:6670
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: nf_hook include/linux/netfilter.h:242 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: NF_HOOK+0x9e/0x3c0 include/linux/netfilter.h:316
7 locks held by ktimers/1/30:
#0: ffffffff8de591e0 (local_bh){.+.+}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#2: ffff8880b87284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff8880b87284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: hrtimer_cpu_base_lock_expiry kernel/time/hrtimer.c:1650 [inline]
#2: ffff8880b87284f8 (&base->softirq_expiry_lock){+...}-{3:3}, at: hrtimer_run_softirq+0x7f/0x260 kernel/time/hrtimer.c:2109
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: ieee80211_iterate_active_interfaces_atomic+0x2a/0x180 net/mac80211/util.c:807
#5: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#5: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#5: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __ieee80211_beacon_get+0x34/0x1820 net/mac80211/tx.c:5740
#6: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#6: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: get_partial_node_bulk mm/slub.c:3772 [inline]
#6: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x89/0x5b0 mm/slub.c:7173
1 lock held by khungtaskd/39:
#0: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#0: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#0: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6777
4 locks held by kworker/u8:5/90:
#0: ffff8880331bc938 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90002effc60 ((work_completion)(&(&bat_priv->bla.work)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: batadv_bla_periodic_work+0x32b/0xb70 net/batman-adv/bridge_loop_avoidance.c:1513
#3: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: get_partial_node_bulk mm/slub.c:3772 [inline]
#3: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x89/0x5b0 mm/slub.c:7173
2 locks held by kworker/u8:6/152:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90003937c60 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
4 locks held by kworker/u8:8/173:
#0: ffff88801b696138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90003907c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#2: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:673
#3: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
1 lock held by klogd/4970:
#0: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#0: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: get_partial_node_bulk mm/slub.c:3772 [inline]
#0: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x89/0x5b0 mm/slub.c:7173
2 locks held by getty/5369:
#0: ffff888036c3a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90003cbe2e0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x460/0x1360 drivers/tty/n_tty.c:2211
4 locks held by kworker/1:3/5633:
#0: ffff88803749f538 ((wq_completion)wg-crypt-wg0#2){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90005287c60 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ((typeof((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))))((unsigned long)((__typeof_unqual__(*((worker))) *)(( unsigned long)((worker)))) + (((__per_cpu_offset[(cpu)]))))); })->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: sched_balance_domains+0xe8/0x880 kernel/sched/fair.c:13778
2 locks held by kworker/1:4/5733:
#0: ffff88813fe4b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc9000593fc60 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
2 locks held by kworker/u8:26/8262:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90005277c60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
2 locks held by kworker/u8:27/8263:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90004367c60 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
2 locks held by syz-executor/9924:
#0: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575
#1: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}
, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
2 locks held by syz-executor/10009:
#0: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575
#1: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
3 locks held by kworker/u9:1/10040:
#0: ffff88803dd2e938 ((wq_completion)hci11#2){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90003f17c60 ((work_completion)(&hdev->cmd_work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#2: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: get_partial_node_bulk mm/slub.c:3772 [inline]
#2: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x89/0x5b0 mm/slub.c:7173
2 locks held by syz-executor/10046:
#0: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575
#1: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
2 locks held by syz-executor/10056:
#0: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575
#1: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
2 locks held by syz-executor/10190:
#0: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575
#1: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
2 locks held by syz-executor/10248:
#0: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575
#1: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
2 locks held by syz-executor/10304:
#0: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575
#1: ffffffff8dfc92b0 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x530 kernel/rcu/tree.c:3857
3 locks held by syz-executor/10356:
#0: ffff888064958f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
#0: ffff888064958f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x22a/0x5b0 net/bluetooth/hci_core.c:2681
#1: ffff8880649580b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x61f/0x10a0 net/bluetooth/hci_sync.c:5367
#2: ffffffff8f50bb38 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2149 [inline]
#2: ffffffff8f50bb38 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0x99/0x260 net/bluetooth/hci_conn.c:2733
4 locks held by syz-executor/10391:
#0: ffff88802f4b0f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:500 [inline]
#0: ffff88802f4b0f80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x22a/0x5b0 net/bluetooth/hci_core.c:2681
#1: ffff88802f4b00b0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x61f/0x10a0 net/bluetooth/hci_sync.c:5367
#2: ffffffff8f50bb38 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2149 [inline]
#2: ffffffff8f50bb38 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0x99/0x260 net/bluetooth/hci_conn.c:2733
#3: ffff888064afab70 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x9f/0x520 net/bluetooth/l2cap_core.c:1780
4 locks held by kworker/0:6/10396:
#0: ffff88813fe4b938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90003db7c60 (drain_vmap_work){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#2: ffffffff8e0e9f58 (vmap_purge_lock){+.+.}-{4:4}, at: drain_vmap_area_work+0x17/0x40 mm/vmalloc.c:2460
#3: ffffffff8e0f1828 (init_mm.page_table_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffffffff8e0f1828 (init_mm.page_table_lock){+.+.}-{3:3}, at: kasan_depopulate_vmalloc_pte+0x17/0x90 mm/kasan/shadow.c:476
5 locks held by syz-executor/10431:
#0: ffffffff8f378dc0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4e2/0x720 net/core/net_namespace.c:575
#1: ffffffff8f3880f8 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d5/0x820 net/ipv4/ip_tunnel.c:1149
#2: ffff8880411bd070 (&dev->lock){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2852 [inline]
#2: ffff8880411bd070 (&dev->lock){+.+.}-{4:4}, at: netif_napi_add_weight include/linux/netdevice.h:2884 [inline]
#2: ffff8880411bd070 (&dev->lock){+.+.}-{4:4}, at: netif_napi_add include/linux/netdevice.h:2902 [inline]
#2: ffff8880411bd070 (&dev->lock){+.+.}-{4:4}, at: gro_cells_init+0x1ca/0x270 net/core/gro_cells.c:94
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __local_bh_disable_ip+0x3c/0x420 kernel/softirq.c:163
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: sched_balance_domains+0xe8/0x880 kernel/sched/fair.c:13778
2 locks held by kworker/u8:0/10464:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc90003ec7c60 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
1 lock held by udevd/10470:
#0: ffff888037865208 (&ep->lock){+.+.}-{3:3}, at: spin_lock_irq include/linux/spinlock_rt.h:96 [inline]
#0: ffff888037865208 (&ep->lock){+.+.}-{3:3}, at: ep_poll fs/eventpoll.c:2344 [inline]
#0: ffff888037865208 (&ep->lock){+.+.}-{3:3}, at: do_epoll_wait+0x849/0xaa0 fs/eventpoll.c:2811
1 lock held by syz-executor/10477:
#0: ffffffff8f3880f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
#0: ffffffff8f3880f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
#0: ffffffff8f3880f8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a3/0x1bd0 net/core/rtnetlink.c:4158
4 locks held by kworker/u9:4/10480:
#0: ffff888064f47138 ((wq_completion)hci15#2){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc9000157fc60 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#2: ffff8880615dc0b0 (&hdev->lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x96/0x950 net/bluetooth/hci_event.c:3730
#3: ffffffff8f50bb38 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:2134 [inline]
#3: ffffffff8f50bb38 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_remote_features_evt+0x53d/0x950 net/bluetooth/hci_event.c:3764
6 locks held by kworker/u8:1/10501:
#0: ffff88813fe8c138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#1: ffffc900015afc60 ((work_completion)(&(&nsim_dev->trap_data->trap_report_dw)->work)){+.+.}-{0:0}, at: process_one_work+0x8cd/0x12b0 kernel/workqueue.c:3301
#2: ffff88803bf1a310 (&devlink->lock_key#2){+.+.}-{4:4}, at: nsim_dev_trap_report_work+0x57/0xcb0 drivers/net/netdevsim/dev.c:909
#3: ffff88803cf46d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#3: ffff88803cf46d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report drivers/net/netdevsim/dev.c:862 [inline]
#3: ffff88803cf46d20 (&nsim_trap_data->trap_lock){+.+.}-{3:3}, at: nsim_dev_trap_report_work+0x1e0/0xcb0 drivers/net/netdevsim/dev.c:922
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#4: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
#5: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#5: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: get_partial_node_bulk mm/slub.c:3772 [inline]
#5: ffff88801eaee858 (&n->list_lock){+.+.}-{3:3}, at: __refill_objects_node+0x89/0x5b0 mm/slub.c:7173
3 locks held by syz-executor/10503:
#0: ffff88803ed73a30 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:554 [inline]
#0: ffff88803ed73a30 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1e0/0x4e0 mm/util.c:579
#1: ffffffff8e10a070 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
#1: ffffffff8e10a070 (remove_cache_srcu){.+.+}-{0:0}, at: srcu_read_lock+0x27/0x60 include/linux/srcu.h:294
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#2: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
4 locks held by syz.3.1334/10514:
#0: ffff88803968acb0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_lock include/linux/mmap_lock.h:592 [inline]
#0: ffff88803968acb0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x1a4/0x9f0 mm/mmap.c:1284
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __pte_offset_map+0x29/0x200 mm/pgtable-generic.c:290
#2: ffff8880212e6598 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock_rt.h:45 [inline]
#2: ffff8880212e6598 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: pte_offset_map_lock+0x13d/0x210 mm/pgtable-generic.c:404
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: __rt_spin_lock kernel/locking/spinlock_rt.c:50 [inline]
#3: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rt_spin_lock+0x1e0/0x400 kernel/locking/spinlock_rt.c:57
1 lock held by modprobe/10517:
#0: ffff888039689f30 (&mm->mmap_lock){++++}-{4:4}, at: mmap_read_trylock include/linux/mmap_lock.h:611 [inline]
#0: ffff888039689f30 (&mm->mmap_lock){++++}-{4:4}, at: get_mmap_lock_carefully mm/mmap_lock.c:441 [inline]
#0: ffff888039689f30 (&mm->mmap_lock){++++}-{4:4}, at: lock_mm_and_find_vma+0x36/0x340 mm/mmap_lock.c:501
2 locks held by modprobe/10516:
#0: ffff8880396891b0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:554 [inline]
#0: ffff8880396891b0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x1e0/0x4e0 mm/util.c:579
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
#1: ffffffff8dfc30c0 (rcu_read_lock){....}-{1:3}, at: unwind_next_frame+0x8f/0x2550 arch/x86/kernel/unwind_orc.c:495
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 39 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:122
nmi_trigger_cpumask_backtrace+0x17a/0x380 lib/nmi_backtrace.c:65
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
__sys_info lib/sys_info.c:158 [inline]
sys_info+0x135/0x170 lib/sys_info.c:166
check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
watchdog+0xfd7/0x1030 kernel/hung_task.c:561
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 29 Comm: rcuc/1 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)}
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:__lock_release kernel/locking/lockdep.c:5528 [inline]
RIP: 0010:lock_release+0xc4/0x3c0 kernel/locking/lockdep.c:5891
Code: 67 8d e8 af 69 90 09 65 ff 05 50 ac d4 10 c7 44 24 24 01 00 00 00 83 3d a9 bc eb 0d 00 0f 84 90 01 00 00 41 8b 87 00 0c 00 00 <85> c0 0f 84 17 01 00 00 4c 89 6c 24 18 48 89 5c 24 08 44 8d 60 ff
RSP: 0018:ffffc90000a3e9e8 EFLAGS: 00000002
RAX: 0000000000000006 RBX: 0000000000000202 RCX: 0000000000000046
RDX: 0000000000000003 RSI: ffffffff8d67304b RDI: ffffffff8baa6380
RBP: 0000000000000001 R08: ffffffff8f8c72f7 R09: 1ffffffff1f18e5e
R10: dffffc0000000000 R11: fffffbfff1f18e5f R12: 1ffff11003bd0858
R13: ffffffff8b337547 R14: ffffffff8dfc30c0 R15: ffff88801de83e00
FS: 0000000000000000(0000) GS:ffff888125fcd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ff2c9f3a440 CR3: 0000000036462000 CR4: 00000000003526f0
Call Trace:
rcu_lock_release include/linux/rcupdate.h:310 [inline]
rcu_read_unlock include/linux/rcupdate.h:871 [inline]
rt_spin_unlock+0x163/0x200 kernel/locking/spinlock_rt.c:102
spin_unlock_bh include/linux/spinlock_rt.h:115 [inline]
rt_add_uncached_list net/ipv4/route.c:1533 [inline]
rt_set_nexthop+0x67b/0xa70 net/ipv4/route.c:-1
__mkroute_output net/ipv4/route.c:2678 [inline]
ip_route_output_key_hash_rcu+0x185c/0x2720 net/ipv4/route.c:2872
ip_route_output_key_hash+0x18d/0x2a0 net/ipv4/route.c:2702
__ip_route_output_key include/net/route.h:169 [inline]
ip_route_output_flow+0x2a/0x150 net/ipv4/route.c:2929
ip_route_output_key include/net/route.h:179 [inline]
ip_route_me_harder+0x762/0xfe0 net/ipv4/netfilter.c:54
synproxy_send_tcp+0x347/0x670 net/netfilter/nf_synproxy_core.c:434
synproxy_send_client_synack+0x89b/0xde0 net/netfilter/nf_synproxy_core.c:487
nft_synproxy_eval_v4+0x362/0x4e0 net/netfilter/nft_synproxy.c:59
nft_synproxy_do_eval+0x335/0x550 net/netfilter/nft_synproxy.c:141
expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
nft_do_chain+0x48d/0x1b10 net/netfilter/nf_tables_core.c:285
nft_do_chain_inet+0x360/0x4b0 net/netfilter/nft_chain_filter.c:162
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_slow+0xc5/0x220 net/netfilter/core.c:619
nf_hook include/linux/netfilter.h:273 [inline]
NF_HOOK+0x21f/0x3c0 include/linux/netfilter.h:316
NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6207 [inline]
__netif_receive_skb net/core/dev.c:6320 [inline]
process_backlog+0x564/0xc50 net/core/dev.c:6671
__napi_poll+0xae/0x550 net/core/dev.c:7730
napi_poll net/core/dev.c:7793 [inline]
net_rx_action+0x621/0xd70 net/core/dev.c:7950
handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626
__do_softirq kernel/softirq.c:660 [inline]
__local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_do_batch kernel/rcu/tree.c:2664 [inline]
rcu_core kernel/rcu/tree.c:2897 [inline]
rcu_cpu_kthread+0x99f/0x1480 kernel/rcu/tree.c:2985
smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245