syzbot


INFO: task hung in netlink_dump

Status: upstream: reported on 2024/02/11 17:56
Reported-by: syzbot+2bd84c933e141021f2c4@syzkaller.appspotmail.com
First crash: 80d, last: 62d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in netlink_dump (2) net 2 796d 797d 0/26 auto-closed as invalid on 2022/05/26 21:32
upstream INFO: task hung in netlink_dump net 1 967d 967d 0/26 auto-closed as invalid on 2021/12/07 11:04
upstream INFO: task hung in netlink_dump (3) net 78 80d 237d 0/26 closed as invalid on 2024/02/12 15:10
upstream INFO: task hung in netlink_dump (4) net 72 24d 64d 26/26 fixed on 2024/04/12 18:02

Sample crash report:
INFO: task dhcpcd:3217 blocked for more than 143 seconds.
      Not tainted 6.1.79-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:20744 pid:3217  ppid:3216   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x142d/0x4550 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 netlink_dump+0xce/0xc50 net/netlink/af_netlink.c:2178
 netlink_recvmsg+0x6c8/0x1180 net/netlink/af_netlink.c:1956
 ____sys_recvmsg+0x285/0x530
 ___sys_recvmsg net/socket.c:2775 [inline]
 __sys_recvmsg+0x2e9/0x3d0 net/socket.c:2805
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7ff7535f091e
RSP: 002b:00007fff3b6365b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 00007fff3b6376e0 RCX: 00007ff7535f091e
RDX: 0000000000000000 RSI: 00007fff3b637600 RDI: 0000000000000008
RBP: 00007fff3b637670 R08: 0000000000000000 R09: 0000000001000000
R10: 00000000000000c5 R11: 0000000000000246 R12: 0000000000000b44
R13: 00007fff3b6375e4 R14: 00007fff3b637600 R15: 00007fff3b6375f0
 </TASK>
INFO: task kworker/0:22:32484 blocked for more than 143 seconds.
      Not tainted 6.1.79-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:22    state:D stack:20568 pid:32484 ppid:2      flags:0x00004000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x142d/0x4550 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 addrconf_dad_work+0xcc/0x16b0 net/ipv6/addrconf.c:4098
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
INFO: task kworker/1:1:19947 blocked for more than 143 seconds.
      Not tainted 6.1.79-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:1     state:D stack:23256 pid:19947 ppid:2      flags:0x00004000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x142d/0x4550 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 addrconf_dad_work+0xcc/0x16b0 net/ipv6/addrconf.c:4098
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
INFO: task kworker/0:1:31533 blocked for more than 144 seconds.
      Not tainted 6.1.79-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:1     state:D stack:24544 pid:31533 ppid:2      flags:0x00004000
Workqueue: events switchdev_deferred_process_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x142d/0x4550 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:75
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
INFO: task kworker/1:3:31657 blocked for more than 144 seconds.
      Not tainted 6.1.79-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:3     state:D stack:25624 pid:31657 ppid:2      flags:0x00004000
Workqueue: events linkwatch_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x142d/0x4550 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 linkwatch_event+0xa/0x50 net/core/link_watch.c:263
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
INFO: task syz-executor.3:31799 blocked for more than 144 seconds.
      Not tainted 6.1.79-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3  state:D stack:21496 pid:31799 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x142d/0x4550 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:74 [inline]
 rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
 netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508
 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]
 netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352
 netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 __sys_sendto+0x480/0x600 net/socket.c:2148
 __do_sys_sendto net/socket.c:2160 [inline]
 __se_sys_sendto net/socket.c:2156 [inline]
 __x64_sys_sendto+0xda/0xf0 net/socket.c:2156
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f400447fa9c
RSP: 002b:00007ffe66ae67a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f40050d4620 RCX: 00007f400447fa9c
RDX: 0000000000000040 RSI: 00007f40050d4670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffe66ae67f4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f40050d4670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor.2:31835 blocked for more than 144 seconds.
      Not tainted 6.1.79-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.2  state:D stack:21736 pid:31835 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x142d/0x4550 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 new_device_store+0x1ad/0x800 drivers/net/netdevsim/bus.c:160
 kernfs_fop_write_iter+0x3a2/0x4f0 fs/kernfs/file.c:330
 call_write_iter include/linux/fs.h:2249 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x7ae/0xba0 fs/read_write.c:584
 ksys_write+0x19c/0x2c0 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f2d3ae7caef
RSP: 002b:00007ffc74a5a4f0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f2d3ae7caef
RDX: 0000000000000003 RSI: 00007ffc74a5a540 RDI: 0000000000000005
RBP: 00007f2d3aeca045 R08: 0000000000000000 R09: 00007ffc74a5a347
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 00007ffc74a5a540 R14: 00007f2d3bad4620 R15: 0000000000000003
 </TASK>
INFO: task syz-executor.0:31839 blocked for more than 145 seconds.
      Not tainted 6.1.79-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:21496 pid:31839 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5245 [inline]
 __schedule+0x142d/0x4550 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 devlink_nl_port_fill+0x2b1/0xa00 net/devlink/leftover.c:1296
 devlink_port_notify+0xa0/0x1d0 net/devlink/leftover.c:1361
 devlink_notify_unregister net/devlink/leftover.c:9756 [inline]
 devlink_unregister+0x50b/0x6a0 net/devlink/leftover.c:9791
 nsim_drv_remove+0x4c/0x160 drivers/net/netdevsim/dev.c:1673
 device_remove drivers/base/dd.c:548 [inline]
 __device_release_driver drivers/base/dd.c:1260 [inline]
 device_release_driver_internal+0x4f3/0x880 drivers/base/dd.c:1286
 bus_remove_device+0x2e5/0x400 drivers/base/bus.c:529
 device_del+0x6e2/0xbd0 drivers/base/core.c:3859
 device_unregister+0x1c/0xc0 drivers/base/core.c:3902
 nsim_bus_dev_del drivers/net/netdevsim/bus.c:310 [inline]
 del_device_store+0x35f/0x480 drivers/net/netdevsim/bus.c:219
 kernfs_fop_write_iter+0x3a2/0x4f0 fs/kernfs/file.c:330
 call_write_iter include/linux/fs.h:2249 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x7ae/0xba0 fs/read_write.c:584
 ksys_write+0x19c/0x2c0 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f31d3c7caef
RSP: 002b:00007fff97bd2400 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007f31d3c7caef
RDX: 0000000000000001 RSI: 00007fff97bd2450 RDI: 0000000000000005
RBP: 00007f31d3cca021 R08: 0000000000000000 R09: 00007fff97bd2257
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 00007fff97bd2450 R14: 00007f31d48d4620 R15: 0000000000000003
 </TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8d12aa90 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:516
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8d12b290 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:516
1 lock held by khungtaskd/28:
 #0: ffffffff8d12a8c0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:319 [inline]
 #0: ffffffff8d12a8c0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:760 [inline]
 #0: ffffffff8d12a8c0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6494
1 lock held by dhcpcd/3217:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0xce/0xc50 net/netlink/af_netlink.c:2178
2 locks held by getty/3306:
 #0: ffff88814b9e9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffffc900031262f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a7/0x1db0 drivers/tty/n_tty.c:2188
3 locks held by kworker/1:22/32195:
 #0: ffff888012471938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc9000b4d7d20 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x8d/0xdb0 net/wireless/reg.c:2498
2 locks held by kworker/1:23/32196:
 #0: ffff888012472138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc9000ba1fd20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
3 locks held by kworker/0:22/32484:
 #0: ffff88802825e938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc90013c67d20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xcc/0x16b0 net/ipv6/addrconf.c:4098
2 locks held by kworker/u4:12/4791:
5 locks held by kworker/u4:15/4795:
 #0: ffff888012616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc90003bf7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e288c10 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60 net/core/net_namespace.c:563
 #3: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xe5/0x9d0 net/core/dev.c:11377
 #4: ffffffff8d12feb8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
 #4: ffffffff8d12feb8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3b0/0x8a0 kernel/rcu/tree_exp.h:949
3 locks held by kworker/1:1/19947:
 #0: ffff88802825e938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc90005a87d20 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xcc/0x16b0 net/ipv6/addrconf.c:4098
3 locks held by kworker/0:1/31533:
 #0: ffff888012470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc900078efd20 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:75
3 locks held by kworker/1:3/31657:
 #0: ffff888012470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc9000b20fd20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263
1 lock held by syz-executor.3/31799:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
4 locks held by syz-executor.2/31835:
 #0: ffff88807e916460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x269/0xba0 fs/read_write.c:580
 #1: ffff88808b39ac88 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x4f0 fs/kernfs/file.c:321
 #2: ffff8880224c4918 (kn->active#52){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x20b/0x4f0 fs/kernfs/file.c:322
 #3: ffffffff8dc09708 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: new_device_store+0x1ad/0x800 drivers/net/netdevsim/bus.c:160
6 locks held by syz-executor.0/31839:
 #0: ffff88807e916460 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x269/0xba0 fs/read_write.c:580
 #1: ffff888038598088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x4f0 fs/kernfs/file.c:321
 #2: ffff8880224c4a00 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x20b/0x4f0 fs/kernfs/file.c:322
 #3: ffffffff8dc09708 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xf8/0x480 drivers/net/netdevsim/bus.c:209
 #4: ffff8880864db0e8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:837 [inline]
 #4: ffff8880864db0e8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1080 [inline]
 #4: ffff8880864db0e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xb6/0x880 drivers/base/dd.c:1283
 #5: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: devlink_nl_port_fill+0x2b1/0xa00 net/devlink/leftover.c:1296
1 lock held by syz-executor.4/32112:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x59c/0xf70 net/core/dev_ioctl.c:612
1 lock held by syz-executor.4/32270:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
1 lock held by syz-executor.3/32705:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
1 lock held by syz-executor.0/32721:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
1 lock held by syz-executor.2/32730:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
1 lock held by syz-executor.1/647:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2a5/0x1b20 net/ipv4/devinet.c:1070
1 lock held by syz-executor.4/652:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
1 lock held by syz-executor.1/656:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
1 lock held by syz-executor.3/660:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
1 lock held by syz-executor.0/665:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119
1 lock held by syz-executor.2/668:
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e294e68 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6119

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.1.79-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 nmi_cpu_backtrace+0x4e1/0x560 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1b0/0x3f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xf88/0xfd0 kernel/hung_task.c:377
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 32196 Comm: kworker/1:23 Not tainted 6.1.79-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Workqueue: events_power_efficient wg_ratelimiter_gc_entries
RIP: 0010:__lock_acquire+0x32/0x1f80 kernel/locking/lockdep.c:4916
Code: 54 53 48 81 ec 88 00 00 00 44 89 cb 45 89 c7 41 89 cc 89 54 24 50 89 f5 49 89 fe 65 4c 8b 2d a5 1b 98 7e 48 c7 c0 e4 7a 73 8e <48> c1 e8 03 48 ba 00 00 00 00 00 fc ff df 0f b6 04 10 84 c0 0f 85
RSP: 0018:ffffc9000ba1f9a0 EFLAGS: 00000086
RAX: ffffffff8e737ae4 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8daf00b8
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffff888099b63b80 R14: ffffffff8daf00b8 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c02e34fde0 CR3: 000000000ce8e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 wg_ratelimiter_gc_entries+0x5c/0x470 drivers/net/wireguard/ratelimiter.c:63
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
 </TASK>

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/03/01 02:46 linux-6.1.y 81e1dc2f7001 352ab904 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in netlink_dump
2024/02/20 08:41 linux-6.1.y 8b4118fabd6e 3af7dd65 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: task hung in netlink_dump
2024/02/11 17:56 linux-6.1.y f1bb70486c9c 77b23aa1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in netlink_dump
* Struck through repros no longer work on HEAD.