INFO: task dhcpcd:5288 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:25288 pid:5288 tgid:5288 ppid:1 task_flags:0x400140 flags:0x00080000 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 vlan_ioctl_handler+0xf0/0x630 net/8021q/vlan.c:517 sock_ioctl+0x612/0x7e0 net/socket.c:1413 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1ae97fe378 RSP: 002b:00007fff68656e38 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000055784a0edd60 RCX: 00007f1ae97fe378 RDX: 00007fff68656e40 RSI: 0000000000008982 RDI: 000000000000000f RBP: 00007fff68656e40 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 R13: 000055784a01fdf8 R14: 00007fff68667250 R15: 000055784a0edd60 INFO: task kworker/u8:13:8131 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:13 state:D stack:23640 pid:8131 tgid:8131 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: events_unbound linkwatch_event Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 linkwatch_event+0xe/0x60 net/core/link_watch.c:313 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz-executor:15465 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:26616 pid:15465 tgid:15465 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5583 [inline] __schedule+0x17dd/0x5820 kernel/sched/core.c:7382 __schedule_loop kernel/sched/core.c:7459 [inline] schedule+0x164/0x2b0 kernel/sched/core.c:7474 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7531 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x7c4/0x15a0 kernel/locking/mutex.c:821 rtnl_net_lock include/linux/rtnetlink.h:134 [inline] inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7169 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2576 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x8ef/0xa80 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x7f0/0xb20 net/netlink/af_netlink.c:1920 sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800 __sock_sendmsg net/socket.c:818 [inline] __sys_sendto+0x408/0x5a0 net/socket.c:2283 __do_sys_sendto net/socket.c:2290 [inline] __se_sys_sendto net/socket.c:2286 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2286 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8b6415fd8e RSP: 002b:00007fff0f813ca8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000555556439500 RCX: 00007f8b6415fd8e RDX: 0000000000000028 RSI: 00007f8b64f54670 RDI: 0000000000000003 RBP: 0000000000000001 R08: 00007fff0f813d24 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 00007f8b64f54670 R15: 0000000000000000 Showing all locks held in the system: locks held by kworker/u8:0/12: 4, last CPU#1: #0: ffff88802473b148 ((wq_completion)krds_cp_wq#1/5){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802473b148 ((wq_completion)krds_cp_wq#1/5){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802473b148 ((wq_completion)krds_cp_wq#1/5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802473b148 ((wq_completion)krds_cp_wq#1/5){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90000117c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000117c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000117c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90000117c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888023f54380 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff8880659b1de0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff8880659b1de0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:1/13: 4, last CPU#0: #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801d2de148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90000127c40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90000127c40 (net_cleanup_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90000127c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90000127c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91272f28 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf5/0x810 net/core/net_namespace.c:677 #3: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline] #3: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x28e/0x8f0 net/core/net_namespace.c:249 locks held by khungtaskd/33: 1, last CPU#1: #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffffffff8fd59ca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6871 locks held by kworker/u8:4/62: 2, last CPU#1: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000204fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000204fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000204fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000204fc40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by kworker/u8:11/1289: 3, last CPU#1: #0: ffff88802473c148 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802473c148 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802473c148 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802473c148 ((wq_completion)krds_cp_wq#1/3){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900057f7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900057f7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900057f7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900057f7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888023f54980 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 locks held by dhcpcd/5288: 2, on CPU#1: #0: ffffffff91262860 (vlan_ioctl_mutex){+.+.}-{4:4}, at: sock_ioctl+0x5eb/0x7e0 net/socket.c:1411 #1: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: vlan_ioctl_handler+0xf0/0x630 net/8021q/vlan.c:517 locks held by getty/5383: 2, on CPU#1: #0: ffff888032c1a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900032432e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45a/0x1360 drivers/tty/n_tty.c:2211 locks held by kworker/0:4/5631: 2, last CPU#0: #0: ffff88801c069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c069d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000449fc40 ((gc_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000449fc40 ((gc_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000449fc40 ((gc_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000449fc40 ((gc_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 locks held by syz-executor/5632: 1, on CPU#0: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: netdev_wait_allrefs_any net/core/dev.c:11855 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: netdev_run_todo+0x7a8/0x1090 net/core/dev.c:11972 locks held by kworker/0:7/5821: 3, on CPU#0: #0: ffff88801c06ad48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c06ad48 ((wq_completion)events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c06ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c06ad48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90005177c40 (netdev_work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90005177c40 (netdev_work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90005177c40 (netdev_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90005177c40 (netdev_work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: netdev_lock_ops_compat include/net/netdev_lock.h:94 [inline] #2: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: netdev_work_proc+0x209/0x780 net/core/netdev_work.c:146 locks held by kworker/u8:13/8131: 3, on CPU#1: #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801c0ac148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9000e607c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9000e607c40 ((linkwatch_work).work){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9000e607c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9000e607c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313 locks held by kworker/u8:16/9134: 4, last CPU#1: #0: ffff88802473a948 ((wq_completion)krds_cp_wq#1/6){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802473a948 ((wq_completion)krds_cp_wq#1/6){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802473a948 ((wq_completion)krds_cp_wq#1/6){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802473a948 ((wq_completion)krds_cp_wq#1/6){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc9001d547c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc9001d547c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc9001d547c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc9001d547c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888023f54080 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888050ee9de0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888050ee9de0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:17/9135: 4, last CPU#1: #0: ffff88802473d948 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802473d948 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802473d948 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802473d948 ((wq_completion)krds_cp_wq#1/0){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90004fb7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90004fb7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90004fb7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90004fb7c40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff888023f55280 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888050ee9020 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888050ee9020 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by kworker/u8:19/15374: 3, on CPU#1: #0: ffff88801e7a1948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88801e7a1948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88801e7a1948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88801e7a1948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90006a7fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90006a7fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90006a7fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90006a7fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #2: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4795 locks held by kworker/u8:20/15394: 3, last CPU#0: #0: ffff8880339cc148 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff8880339cc148 ((wq_completion)bat_events){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff8880339cc148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff8880339cc148 ((wq_completion)bat_events){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc900054d7c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc900054d7c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc900054d7c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc900054d7c40 ((work_completion)(&(&bat_priv->tt.work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff8880b8428618 (hrtimer_bases.lock){-.-.}-{2:2}, at: __run_hrtimer kernel/time/hrtimer.c:2079 [inline] #2: ffff8880b8428618 (hrtimer_bases.lock){-.-.}-{2:2}, at: __hrtimer_run_queues+0x466/0xa10 kernel/time/hrtimer.c:2132 locks held by kworker/u8:21/15436: 4, last CPU#1: #0: ffff88802473a148 ((wq_completion)krds_cp_wq#1/7){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #0: ffff88802473a148 ((wq_completion)krds_cp_wq#1/7){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #0: ffff88802473a148 ((wq_completion)krds_cp_wq#1/7){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #0: ffff88802473a148 ((wq_completion)krds_cp_wq#1/7){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #1: ffffc90002f0fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:309 [inline] #1: ffffc90002f0fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffc90002f0fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3460 [inline] #1: ffffc90002f0fc40 ((work_completion)(&(&cp->cp_conn_w)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x97a/0x1630 kernel/workqueue.c:3578 #2: ffff88805326bc80 (&tc->t_conn_path_lock){+.+.}-{4:4}, at: rds_tcp_conn_path_connect+0x1cc/0x920 net/rds/tcp_connect.c:118 #3: ffff888050eeaba0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1717 [inline] #3: ffff888050eeaba0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: __inet6_bind+0x301/0xf30 net/ipv6/af_inet6.c:292 locks held by syz-executor/15460: 1, on CPU#1: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:366 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc1d/0x1c30 net/core/rtnetlink.c:4251 locks held by syz-executor/15465: 1, on CPU#1: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15466: 1, on CPU#1: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15475: 1, on CPU#0: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15491: 1, on CPU#0: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15496: 1, on CPU#0: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15500: 1, on CPU#1: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15501: 1, on CPU#0: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15508: 1, on CPU#0: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15522: 1, on CPU#1: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15524: 1, on CPU#0: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15529: 1, on CPU#0: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15533: 1, on CPU#1: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 locks held by syz-executor/15542: 1, on CPU#1: #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:134 [inline] #0: ffffffff91281be0 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x470/0x19f0 net/ipv4/devinet.c:968 ============================================= NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 33 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:123 nmi_trigger_cpumask_backtrace+0x17d/0x390 lib/nmi_backtrace.c:66 trigger_all_cpu_backtrace include/linux/nmi.h:164 [inline] __sys_info lib/sys_info.c:157 [inline] sys_info+0x135/0x170 lib/sys_info.c:165 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline] watchdog+0xfd2/0x1030 kernel/hung_task.c:561 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: krds_cp_wq#1/5 rds_connect_worker RIP: 0010:__hrtimer_run_queues+0x138/0xa10 kernel/time/hrtimer.c:2113 Code: 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 3c b3 84 00 89 6c 24 24 48 8b 44 24 10 4e 8d 3c 30 49 83 c7 60 48 8b 03 <48> 03 44 24 60 48 89 44 24 30 4c 89 f8 48 c1 e8 03 48 89 84 24 80 RSP: 0018:ffffc90000007c48 EFLAGS: 00000082 RAX: 0000000000000000 RBX: ffff8880b8428728 RCX: ffff88801f288000 RDX: 8000000001000101 RSI: 0000000001000101 RDI: 0000000000000021 RBP: 0000000000000001 R08: 0000000001000101 R09: 1ffffffff22f9957 R10: dffffc0000000000 R11: fffffbfff22f9958 R12: ffff8880b8428600 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8880b8428720 FS: 0000000000000000(0000) GS:ffff888123a52000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f1b88c35ff8 CR3: 000000007f62a000 CR4: 00000000003526f0 Call Trace: hrtimer_interrupt+0x4cd/0xaa0 kernel/time/hrtimer.c:2251 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1051 [inline] __sysvec_apic_timer_interrupt+0x102/0x430 arch/x86/kernel/apic/apic.c:1068 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:211 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:221 Code: f7 e8 0d e0 a9 f5 f7 c3 00 02 00 00 74 05 e8 e0 72 d6 f5 9c 58 a9 00 02 00 00 75 29 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 94 d9 9a f5 65 48 8b 05 1c 9d a2 08 48 85 c0 74 18 5b 41 5e c3 RSP: 0018:ffffc90000007f48 EFLAGS: 00000206 RAX: 0000000000000006 RBX: 0000000000000287 RCX: 8000000000000102 RDX: 0000000000000002 RSI: ffffffff8e492305 RDI: 0000000000000001 RBP: 8000000000000101 R08: ffffffff917ccabf R09: 1ffffffff22f9957 R10: dffffc0000000000 R11: fffffbfff22f9958 R12: 0000000000000008 R13: 0000000000000009 R14: ffff8880b8428600 R15: 0000000000000000 handle_softirqs+0x265/0x8d0 kernel/softirq.c:669 do_softirq+0x77/0xd0 kernel/softirq.c:569 __local_bh_enable_ip+0x100/0x140 kernel/softirq.c:473 __inet6_bind+0x386/0xf30 net/ipv6/af_inet6.c:419 kernel_bind+0x13e/0x1c0 net/socket.c:3677 rds_tcp_conn_path_connect+0x53b/0x920 net/rds/tcp_connect.c:175 rds_connect_worker+0x1d8/0x290 net/rds/threads.c:176 process_one_work kernel/workqueue.c:3495 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3578 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3659 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245