syzbot

INFO: task kworker/0:1:14 blocked for more than 143 seconds.
      Not tainted 6.1.141-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:1     state:D stack:23984 pid:14    ppid:2      flags:0x00004000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561
 schedule+0xb9/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747
 addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137
 process_one_work+0x898/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task kworker/0:9:4369 blocked for more than 143 seconds.
      Not tainted 6.1.141-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:9     state:D stack:24512 pid:4369  ppid:2      flags:0x00004000
Workqueue: events switchdev_deferred_process_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561
 schedule+0xb9/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747
 switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104
 process_one_work+0x898/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task syz-executor:4379 blocked for more than 143 seconds.
      Not tainted 6.1.141-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22144 pid:4379  ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561
 schedule+0xb9/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:74 [inline]
 rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337
 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 __sys_sendto+0x44f/0x5c0 net/socket.c:2153
 __do_sys_sendto net/socket.c:2165 [inline]
 __se_sys_sendto net/socket.c:2161 [inline]
 __x64_sys_sendto+0xda/0xf0 net/socket.c:2161
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7efe829907bc
RSP: 002b:00007fffd2e87850 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007efe836e4620 RCX: 00007efe829907bc
RDX: 0000000000000040 RSI: 00007efe836e4670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fffd2e878a4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007efe836e4670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:4380 blocked for more than 144 seconds.
      Not tainted 6.1.141-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22144 pid:4380  ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561
 schedule+0xb9/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:74 [inline]
 rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
 netlink_rcv_skb+0x1de/0x420 net/netlink/af_netlink.c:2493
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x74c/0x8c0 net/netlink/af_netlink.c:1337
 netlink_sendmsg+0x89e/0xbc0 net/netlink/af_netlink.c:1859
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 __sys_sendto+0x44f/0x5c0 net/socket.c:2153
 __do_sys_sendto net/socket.c:2165 [inline]
 __se_sys_sendto net/socket.c:2161 [inline]
 __x64_sys_sendto+0xda/0xf0 net/socket.c:2161
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8794f907bc
RSP: 002b:00007fff78b66070 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f8795ce4620 RCX: 00007f8794f907bc
RDX: 0000000000000028 RSI: 00007f8795ce4670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fff78b660c4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f8795ce4670 R15: 0000000000000000
 </TASK>
INFO: task kworker/1:12:4444 blocked for more than 144 seconds.
      Not tainted 6.1.141-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:12    state:D stack:25056 pid:4444  ppid:2      flags:0x00004000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x10e9/0x40d0 kernel/sched/core.c:6561
 schedule+0xb9/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x555/0xaf0 kernel/locking/mutex.c:747
 addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137
 process_one_work+0x898/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8c92b430 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8c92bc50 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517
3 locks held by kworker/0:1/14:
 #0: ffff88814c563138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #1: ffffc90000137d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137
1 lock held by khungtaskd/27:
 #0: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #0: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #0: ffffffff8c92aaa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513
3 locks held by kworker/u4:2/33:
 #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #1: ffffc90000aa7d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263
5 locks held by kworker/u4:3/46:
 #0: ffff888017616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #1: ffffc90000b77d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8db27e10 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x132/0xb80 net/core/net_namespace.c:594
 #3: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xe5/0xa50 net/core/dev.c:11477
 #4: ffffffff8c930778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
 #4: ffffffff8c930778 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x455/0x830 kernel/rcu/tree_exp.h:962
2 locks held by getty/4010:
 #0: ffff888030d43098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffffc9000326b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41b/0x1380 drivers/tty/n_tty.c:2198
3 locks held by kworker/0:9/4369:
 #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #1: ffffc900032e7d00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104
3 locks held by syz-executor/4377:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 fs/namespace.c:393
 #1: ffff88807b167430 (&type->i_mutex_dir_key#5/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:793 [inline]
 #1: ffff88807b167430 (&type->i_mutex_dir_key#5/1){+.+.}-{3:3}, at: do_unlinkat+0x178/0x560 fs/namei.c:4373
 #2: ffff88807b164800 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #2: ffff88807b164800 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: vfs_unlink+0xee/0x600 fs/namei.c:4311
1 lock held by syz-executor/4379:
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
1 lock held by syz-executor/4380:
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
3 locks held by syz-executor/4381:
 #0: ffff88807dd66460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 fs/namespace.c:393
 #1: ffff888075937a80 (&type->i_mutex_dir_key#5/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:793 [inline]
 #1: ffff888075937a80 (&type->i_mutex_dir_key#5/1){+.+.}-{3:3}, at: do_unlinkat+0x178/0x560 fs/namei.c:4373
 #2: ffff88807ae66de0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #2: ffff88807ae66de0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: vfs_unlink+0xee/0x600 fs/namei.c:4311
3 locks held by syz-executor/4387:
 #0: ffff88807d0dc460 (sb_writers#5){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 fs/namespace.c:393
 #1: ffff88807ae654a0 (&type->i_mutex_dir_key#5/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:793 [inline]
 #1: ffff88807ae654a0 (&type->i_mutex_dir_key#5/1){+.+.}-{3:3}, at: do_unlinkat+0x178/0x560 fs/namei.c:4373
 #2: ffff88807b162220 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #2: ffff88807b162220 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: vfs_unlink+0xee/0x600 fs/namei.c:4311
3 locks held by kworker/1:11/4443:
 #0: ffff888017471938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #1: ffffc90003567d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x8b/0xd80 net/wireless/reg.c:2499
3 locks held by kworker/1:12/4444:
 #0: ffff88814c563138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #1: ffffc900035b7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #2: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x14d0 net/ipv6/addrconf.c:4137
2 locks held by kworker/1:13/4445:
 #0: ffff888017472138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
 #1: ffffc900035c7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7a1/0x1160 kernel/workqueue.c:2267
1 lock held by syz-executor/6929:
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
1 lock held by syz-executor/6936:
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
1 lock held by syz-executor/9494:
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
1 lock held by syz-executor/9500:
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
1 lock held by syz.0.2219/11155:
1 lock held by syz.3.2253/11260:
3 locks held by syz.0.2263/11291:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff88805f77b510 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff88805f77b510 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
1 lock held by syz.3.2268/11307:
2 locks held by syz.0.2287/11359:
 #0: ffff888029d10158 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:71 [inline]
 #0: ffff888029d10158 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x20f/0x8e0 mm/mmap.c:3246
 #1: ffff88805b1ecd38 (&anon_vma->rwsem){++++}-{3:3}, at: lock_anon_vma_root mm/rmap.c:250 [inline]
 #1: ffff88805b1ecd38 (&anon_vma->rwsem){++++}-{3:3}, at: unlink_anon_vmas+0xfc/0x660 mm/rmap.c:407
1 lock held by syz.0.2293/11378:
2 locks held by syz.0.2297/11452:
1 lock held by syz.0.2320/11461:
1 lock held by syz.0.2330/11488:
3 locks held by syz.0.2338/11512:
2 locks held by syz.0.2357/11572:
2 locks held by syz.0.2360/11583:
2 locks held by syz.0.2365/11596:
2 locks held by syz.0.2370/11611:
3 locks held by syz.0.2372/11623:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff888077e90f30 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff888077e90f30 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
2 locks held by syz.0.2379/11638:
3 locks held by syz.0.2381/11641:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff888026b47430 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff888026b47430 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
3 locks held by syz.0.2387/11662:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff88805ea35af0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff88805ea35af0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
1 lock held by syz.4.2388/11665:
1 lock held by syz.0.2389/11668:
3 locks held by syz.0.2394/11683:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff88805b499bd0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff88805b499bd0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
1 lock held by syz.0.2399/11695:
1 lock held by syz.0.2400/11698:
2 locks held by syz.0.2402/11704:
1 lock held by syz.4.2410/11728:
3 locks held by syz.0.2404/11734:
3 locks held by syz.0.2421/11767:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff888024983b60 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff888024983b60 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
2 locks held by syz.0.2425/11779:
3 locks held by syz.0.2428/11788:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff888029ee2870 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff888029ee2870 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
4 locks held by syz.0.2430/11794:
3 locks held by syz.0.2432/11797:
3 locks held by syz.0.2434/11800:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff88805c31f430 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff88805c31f430 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
2 locks held by syz.0.2435/11803:
2 locks held by syz.0.2436/11806:
1 lock held by syz.0.2440/11818:
1 lock held by syz.0.2441/11821:
3 locks held by syz.0.2445/11834:
2 locks held by syz.0.2448/11845:
2 locks held by syz.0.2449/11851:
3 locks held by syz.0.2454/11863:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff888077947a80 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff888077947a80 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
1 lock held by syz.3.2456/11869:
3 locks held by syz.0.2457/11872:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff88807e409bd0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff88807e409bd0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
1 lock held by syz.3.2459/11879:
2 locks held by syz.0.2461/11884:
2 locks held by syz.0.2463/11887:
3 locks held by syz.0.2464/11890:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff888061d2aec0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff888061d2aec0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
3 locks held by syz.0.2465/11893:
1 lock held by syz-executor/11899:
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
1 lock held by syz-executor/11905:
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8db34aa8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x740/0xed0 net/core/rtnetlink.c:6150
1 lock held by syz.3.2462/11935:
1 lock held by syz.3.2483/11955:
3 locks held by syz.0.2487/11967:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff88805ba788e0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff88805ba788e0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
1 lock held by syz.3.2488/11972:
2 locks held by syz.0.2489/11974:
1 lock held by syz.3.2497/11998:
3 locks held by syz.0.2499/12005:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff88805b4988e0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff88805b4988e0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
2 locks held by syz.0.2501/12010:
1 lock held by syz.4.2509/12031:
1 lock held by syz.4.2510/12034:
2 locks held by syz.4.2511/12037:
1 lock held by syz.4.2512/12040:
1 lock held by syz.4.2513/12043:
1 lock held by syz.4.2515/12049:
1 lock held by syz.4.2517/12055:
2 locks held by syz.3.2521/12067:
2 locks held by syz.4.2524/12077:
2 locks held by syz.3.2526/12086:
2 locks held by syz.4.2527/12089:
3 locks held by syz.0.2503/12097:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff888074c82220 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff888074c82220 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffff8880b8f3aa98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537
2 locks held by syz.4.2534/12118:
2 locks held by syz.3.2537/12123:
2 locks held by syz.4.2538/12126:
3 locks held by syz.3.2539/12127:
3 locks held by syz.3.2541/12142:
2 locks held by syz.4.2545/12148:
4 locks held by syz.3.2547/12158:
3 locks held by syz.4.2550/12164:
2 locks held by syz.3.2555/12173:
2 locks held by syz.3.2556/12176:
2 locks held by syz.3.2557/12179:
3 locks held by syz.3.2560/12188:
2 locks held by syz.4.2552/12200:
2 locks held by syz.3.2569/12218:
3 locks held by syz.4.2574/12236:
2 locks held by syz.4.2577/12246:
2 locks held by syz.3.2587/12269:
4 locks held by syz.3.2588/12272:
2 locks held by syz.3.2589/12275:
3 locks held by syz.0.2592/12281:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff88806b8888e0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff88806b8888e0 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
3 locks held by syz.0.2593/12284:
2 locks held by syz.3.2591/12290:
2 locks held by syz.3.2597/12296:
2 locks held by syz.3.2601/12308:
2 locks held by syz.3.2608/12329:
2 locks held by syz.3.2609/12332:
2 locks held by syz.3.2610/12335:
3 locks held by syz.3.2611/12338:
3 locks held by syz.3.2617/12356:
2 locks held by syz.3.2618/12359:
3 locks held by syz.0.2595/12363:
 #0: ffff888075698460 (sb_writers#5){.+.+}-{0:0}, at: do_coredump+0x15de/0x22b0 fs/coredump.c:823
 #1: ffff888029ee2220 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline]
 #1: ffff888029ee2220 (&sb->s_type->i_mutex_key#12){+.+.}-{3:3}, at: generic_file_write_iter+0x7f/0x2e0 mm/filemap.c:4003
 #2: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
1 lock held by syz.3.2622/12373:
2 locks held by syz.0.2625/12381:
 #0: ffff888030c9ae58 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:71 [inline]
 #0: ffff888030c9ae58 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x20f/0x8e0 mm/mmap.c:3246
 #1: ffff88805b1ecd38 (&anon_vma->rwsem){++++}-{3:3}, at: lock_anon_vma_root mm/rmap.c:250 [inline]
 #1: ffff88805b1ecd38 (&anon_vma->rwsem){++++}-{3:3}, at: unlink_anon_vmas+0xfc/0x660 mm/rmap.c:407
2 locks held by syz.3.2624/12398:
3 locks held by syz.0.2631/12401:
2 locks held by syz.4.2583/12410:
2 locks held by syz.0.2636/12416:
 #0: ffff88801f2653d8 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline]
 #0: ffff88801f2653d8 (&mm->mmap_lock){++++}-{3:3}, at: get_mmap_lock_carefully mm/memory.c:5322 [inline]
 #0: ffff88801f2653d8 (&mm->mmap_lock){++++}-{3:3}, at: lock_mm_and_find_vma+0x2e/0x2f0 mm/memory.c:5384
 #1: ffffffff8c9e1028 (shmem_swaplist_mutex){+.+.}-{3:3}, at: shmem_writepage+0x81d/0x1b60 mm/shmem.c:1435
2 locks held by syz.3.2639/12422:
2 locks held by syz.4.2641/12430:
2 locks held by syz.4.2642/12433:
2 locks held by syz.0.2637/12448:
2 locks held by syz.4.2647/12450:
2 locks held by syz.4.2649/12453:
3 locks held by syz.0.2648/12458:
3 locks held by syz.4.2650/12460:
2 locks held by syz.4.2652/12466:
3 locks held by syz.3.2656/12474:
3 locks held by syz.3.2657/12477:
3 locks held by syz.3.2658/12480:
2 locks held by syz.3.2659/12483:
3 locks held by syz.3.2662/12492:
2 locks held by syz.3.2668/12512:
1 lock held by syz.3.2671/12525:
3 locks held by syz.4.2674/12531:
2 locks held by syz.3.2675/12537:
2 locks held by syz.4.2679/12546:
3 locks held by syz.3.2680/12549:
3 locks held by syz.3.2683/12555:
4 locks held by syz.3.2684/12558:
2 locks held by syz.4.2681/12561:
3 locks held by syz.0.2651/12564:
2 locks held by syz.4.2690/12576:
2 locks held by syz.4.2691/12579:
3 locks held by syz.4.2692/12582:
2 locks held by syz.4.2693/12585:
3 locks held by syz.4.2695/12591:
1 lock held by syz.4.2696/12594:

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 6.1.141-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x22e lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3f4/0x470 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xeee/0xf30 kernel/hung_task.c:377
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4340 Comm: kworker/1:8 Not tainted 6.1.141-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: events_power_efficient wg_ratelimiter_gc_entries
RIP: 0010:in_lock_functions+0xa/0x20 kernel/locking/spinlock.c:413
Code: 92 80 e1 07 80 c1 03 38 c1 0f 8c 77 ff ff ff 48 c7 c7 c0 87 8f 92 e8 35 34 6e 00 e9 66 ff ff ff 48 81 ff 80 96 19 8a 0f 93 c0 <48> 81 ff 4f bf 19 8a 0f 92 c1 20 c1 0f b6 c1 c3 00 00 cc cc 00 00
RSP: 0018:ffffc90003227bb0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: ffffffff8a19976e RCX: ffffffff969bf103
RDX: 0000000000000000 RSI: ffffffff8a6c1160 RDI: ffffffff8a19976e
RBP: dffffc0000000000 R08: dffffc0000000000 R09: fffffbfff1a64bc9
R10: fffffbfff1a64bc9 R11: 1ffffffff1a64bc8 R12: ffff88805a8baf80
R13: ffffffff8d325f80 R14: 00000000000015f1 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000fffffcc0 CR3: 000000002f79a000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 get_lock_parent_ip include/linux/ftrace.h:950 [inline]
 preempt_latency_start kernel/sched/core.c:5691 [inline]
 preempt_count_add+0x8d/0x190 kernel/sched/core.c:5716
 __raw_spin_lock include/linux/spinlock_api_smp.h:132 [inline]
 _raw_spin_lock+0xe/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 wg_ratelimiter_gc_entries+0x59/0x450 drivers/net/wireguard/ratelimiter.c:63
 process_one_work+0x898/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaa2/0x1250 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>