syzbot

 sign-in | mailing list | source | docs
🐞 Open [698]
🐞 Fixed [97]
🐞 Invalid [561]
⬇ Missing Backports [40]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

INFO: task hung in devinet_ioctl (3)

Status: auto-obsoleted due to no activity on 2024/11/11 06:30
Reported-by: syzbot+82cf1a90cb2764a85399@syzkaller.appspotmail.com
First crash: 210d, last: 140d
▶ ▼ Similar bugs (11)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 INFO: task hung in devinet_ioctl 1 621d 621d 0/3 auto-obsoleted due to no activity on 2023/08/07 17:54
linux-6.1 INFO: task hung in devinet_ioctl (2) 1 451d 451d 0/3 auto-obsoleted due to no activity on 2024/01/05 10:55
upstream INFO: task hung in devinet_ioctl (2) net 27 1049d 1179d 0/28 closed as invalid on 2022/02/07 19:19
upstream INFO: task hung in devinet_ioctl net 1 2253d 2253d 0/28 auto-closed as invalid on 2019/04/18 15:55
linux-5.15 INFO: task hung in devinet_ioctl (2) 3 306d 319d 0/3 auto-obsoleted due to no activity on 2024/05/28 21:09
upstream INFO: task hung in devinet_ioctl (3) net 825 284d 934d 0/28 closed as invalid on 2024/03/11 20:24
linux-5.15 INFO: task hung in devinet_ioctl (3) 3 193d 206d 0/3 auto-obsoleted due to no activity on 2024/09/19 07:29
upstream INFO: task hung in devinet_ioctl (4) net 5 283d 284d 25/28 fixed on 2024/04/12 18:02
linux-5.15 INFO: task hung in devinet_ioctl (4) 1 6d20h 6d20h 0/3 upstream: reported on 2024/12/14 18:20
upstream INFO: task hung in devinet_ioctl (5) net 59 164d 190d 26/28 fixed on 2024/07/09 19:14
linux-5.15 INFO: task hung in devinet_ioctl 1 531d 531d 0/3 auto-obsoleted due to no activity on 2023/10/17 09:29

Sample crash report:
INFO: task dhcpcd:3305 blocked for more than 143 seconds.
      Not tainted 6.1.102-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:20648 pid:3305  ppid:3304   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6561
 schedule+0xbf/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 devinet_ioctl+0x2a5/0x1b20 net/ipv4/devinet.c:1070
 inet_ioctl+0x32d/0x400 net/ipv4/af_inet.c:1010
 sock_do_ioctl+0x152/0x450 net/socket.c:1204
 sock_ioctl+0x47f/0x770 net/socket.c:1321
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:870 [inline]
 __se_sys_ioctl+0xf1/0x160 fs/ioctl.c:856
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f594d144d49
RSP: 002b:00007ffce7bbf4c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f594d0766c0 RCX: 00007f594d144d49
RDX: 00007ffce7bcf6b8 RSI: 0000000000008914 RDI: 0000000000000018
RBP: 00007ffce7bdf878 R08: 00007ffce7bcf678 R09: 00007ffce7bcf628
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffce7bcf6b8 R14: 0000000000000028 R15: 0000000000008914
 </TASK>
INFO: task syz-executor:3646 blocked for more than 143 seconds.
      Not tainted 6.1.102-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:19576 pid:3646  ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6561
 schedule+0xbf/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
 synchronize_rcu_expedited+0x360/0x930 kernel/rcu/tree_exp.h:962
 namespace_unlock+0x297/0x4d0 fs/namespace.c:1497
 do_umount fs/namespace.c:1720 [inline]
 path_umount+0xe78/0xef0 fs/namespace.c:1802
 ksys_umount fs/namespace.c:1825 [inline]
 __do_sys_umount fs/namespace.c:1830 [inline]
 __se_sys_umount fs/namespace.c:1828 [inline]
 __x64_sys_umount+0x122/0x170 fs/namespace.c:1828
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fa237578d27
RSP: 002b:00007fff2e11fcd8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: ffffffffffffffda RBX: 00007fa2375e578c RCX: 00007fa237578d27
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007fff2e11fd90
RBP: 00007fff2e11fd90 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007fff2e120e10
R13: 00007fa2375e578c R14: 0000000000022200 R15: 00007fff2e120e50
 </TASK>
INFO: task kworker/u4:6:3760 blocked for more than 144 seconds.
      Not tainted 6.1.102-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:6    state:D stack:23296 pid:3760  ppid:2      flags:0x00004000
Workqueue: events_unbound fsnotify_connector_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6561
 schedule+0xbf/0x180 kernel/sched/core.c:6637
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1941
 do_wait_for_common kernel/sched/completion.c:85 [inline]
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x350/0x610 kernel/sched/completion.c:138
 __synchronize_srcu+0x2b7/0x360 kernel/rcu/srcutree.c:1243
 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:208
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task syz-executor:3963 blocked for more than 144 seconds.
      Not tainted 6.1.102-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21208 pid:3963  ppid:1      flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6561
 schedule+0xbf/0x180 kernel/sched/core.c:6637
 synchronize_rcu_expedited+0x777/0x930 kernel/rcu/tree_exp.h:977
 synchronize_rcu+0x11c/0x3f0 kernel/rcu/tree.c:3575
 lockdep_unregister_key+0x537/0x5e0 kernel/locking/lockdep.c:6355
 __qdisc_destroy+0x127/0x450 net/sched/sch_generic.c:1068
 qdisc_put net/sched/sch_generic.c:1094 [inline]
 dev_shutdown+0x359/0x440 net/sched/sch_generic.c:1482
 unregister_netdevice_many+0xaae/0x17a0 net/core/dev.c:10873
 unregister_netdevice_queue+0x2e6/0x350 net/core/dev.c:10813
 unregister_netdevice include/linux/netdevice.h:3045 [inline]
 __tun_detach+0x6b6/0x1600 drivers/net/tun.c:685
 tun_detach drivers/net/tun.c:701 [inline]
 tun_chr_close+0x104/0x1b0 drivers/net/tun.c:3492
 __fput+0x3f6/0x8d0 fs/file_table.c:320
 task_work_run+0x246/0x300 kernel/task_work.c:179
 exit_task_work include/linux/task_work.h:38 [inline]
 do_exit+0xa73/0x26a0 kernel/exit.c:871
 do_group_exit+0x202/0x2b0 kernel/exit.c:1021
 __do_sys_exit_group kernel/exit.c:1032 [inline]
 __se_sys_exit_group kernel/exit.c:1030 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1030
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2f771779f9
RSP: 002b:00007ffe7ab88888 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007f2f771e57b1 RCX: 00007f2f771779f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 0000000000000005 R08: 00007ffe7ab86627 R09: 00007ffe7ab89b40
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe7ab89b40
R13: 00007f2f771e578c R14: 0000000000021b57 R15: 00007ffe7ab8ac00
 </TASK>
INFO: task kworker/u4:11:4024 blocked for more than 144 seconds.
      Not tainted 6.1.102-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:11   state:D stack:23512 pid:4024  ppid:2      flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6561
 schedule+0xbf/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 xfrmi_exit_batch_net+0xb0/0x350 net/xfrm/xfrm_interface_core.c:956
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x763/0xb60 net/core/net_namespace.c:604
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task kworker/u4:12:4030 blocked for more than 145 seconds.
      Not tainted 6.1.102-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:12   state:D stack:20344 pid:4030  ppid:2      flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6561
 schedule+0xbf/0x180 kernel/sched/core.c:6637
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1941
 do_wait_for_common kernel/sched/completion.c:85 [inline]
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x350/0x610 kernel/sched/completion.c:138
 __synchronize_srcu+0x2b7/0x360 kernel/rcu/srcutree.c:1243
 fsnotify_mark_destroy_workfn+0x142/0x340 fs/notify/mark.c:898
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
INFO: task syz-executor:5100 blocked for more than 145 seconds.
      Not tainted 6.1.102-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21736 pid:5100  ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6561
 schedule+0xbf/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:74 [inline]
 rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
 netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508
 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]
 netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352
 netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 __sys_sendto+0x480/0x600 net/socket.c:2148
 __do_sys_sendto net/socket.c:2160 [inline]
 __se_sys_sendto net/socket.c:2156 [inline]
 __x64_sys_sendto+0xda/0xf0 net/socket.c:2156
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f501357978c
RSP: 002b:00007fff37733840 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f5014234620 RCX: 00007f501357978c
RDX: 000000000000003c RSI: 00007f5014234670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007fff37733894 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f5014234670 R15: 0000000000000000
 </TASK>
INFO: task syz.3.414:5147 blocked for more than 145 seconds.
      Not tainted 6.1.102-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.414       state:D stack:26168 pid:5147  ppid:3634   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5244 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6561
 schedule+0xbf/0x180 kernel/sched/core.c:6637
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6696
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747
 nl80211_pre_doit+0x5b/0x8a0 net/wireless/nl80211.c:16191
 genl_family_rcv_msg_doit net/netlink/genetlink.c:751 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:833 [inline]
 genl_rcv_msg+0xbc1/0xf70 net/netlink/genetlink.c:850
 netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:861
 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline]
 netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352
 netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5a5/0x8f0 net/socket.c:2514
 ___sys_sendmsg net/socket.c:2568 [inline]
 __sys_sendmsg+0x2a9/0x390 net/socket.c:2597
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f73663779f9
RSP: 002b:00007f73670bb048 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7366505f80 RCX: 00007f73663779f9
RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000006
RBP: 00007f73663e58ee R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f7366505f80 R15: 00007ffe9701b738
 </TASK>

Showing all locks held in the system:
4 locks held by kworker/u4:1/11:
 #0: ffff88802065d138 ((wq_completion)phy3){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc90000107d20 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffff888059b80d40 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1114 [inline]
 #2: ffff888059b80d40 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0xa0/0x1480 net/mac80211/ibss.c:1680
 #3: ffff888024231780 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_sta_expire net/mac80211/ibss.c:1256 [inline]
 #3: ffff888024231780 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_sta_merge_ibss net/mac80211/ibss.c:1299 [inline]
 #3: ffff888024231780 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0x4cc/0x1480 net/mac80211/ibss.c:1708
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8d32af10 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:516
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8d32b710 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:516
1 lock held by khungtaskd/28:
 #0: ffffffff8d32ad40 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #0: ffffffff8d32ad40 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #0: ffffffff8d32ad40 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6494
1 lock held by dhcpcd/3305:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2a5/0x1b20 net/ipv4/devinet.c:1070
2 locks held by getty/3392:
 #0: ffff888029df1098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffffc900031262f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a7/0x1db0 drivers/tty/n_tty.c:2198
1 lock held by syz-executor/3646:
 #0: ffffffff8d330338 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
 #0: ffffffff8d330338 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x360/0x930 kernel/rcu/tree_exp.h:962
2 locks held by kworker/u4:6/3760:
 #0: ffff888012879138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc90004597d20 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
2 locks held by syz-executor/3963:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3a/0x1b0 drivers/net/tun.c:3492
 #1: ffffffff8d330338 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
 #1: ffffffff8d330338 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x4f0/0x930 kernel/rcu/tree_exp.h:962
4 locks held by kworker/u4:11/4024:
 #0: ffff888012a1e938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc900027cfd20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e4eb310 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60 net/core/net_namespace.c:566
 #3: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: xfrmi_exit_batch_net+0xb0/0x350 net/xfrm/xfrm_interface_core.c:956
2 locks held by kworker/u4:12/4030:
 #0: ffff888012879138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc900047c7d20 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
4 locks held by kworker/0:14/4602:
3 locks held by kworker/1:12/5064:
 #0: ffff888012871938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc9000495fd20 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x8d/0xdb0 net/wireless/reg.c:2498
3 locks held by kworker/1:13/5065:
 #0: ffff88814b45c938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc90004c37d20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4655
1 lock held by syz-executor/5100:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
2 locks held by syz.3.414/5147:
 #0: ffffffff8e556690 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860
 #1: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5b/0x8a0 net/wireless/nl80211.c:16191
1 lock held by syz-executor/5181:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5184:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5185:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5189:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5192:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5196:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5202:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5204:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5207:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5210:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5214:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5219:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5221:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118
1 lock held by syz-executor/5225:
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
 #0: ffffffff8e4f7668 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.1.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 nmi_cpu_backtrace+0x4e1/0x560 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1b0/0x3f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xf88/0xfd0 kernel/hung_task.c:377
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 4602 Comm: kworker/0:14 Not tainted 6.1.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Workqueue: events p9_poll_workfn
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:lock_is_held_type+0x117/0x180 kernel/locking/lockdep.c:5707
Code: 01 00 00 00 48 c7 c7 c0 13 0c 8b e8 13 16 00 00 b8 ff ff ff ff 65 0f c1 05 16 9b 5d 75 83 f8 01 75 40 48 c7 04 24 00 00 00 00 <9c> 8f 04 24 f7 04 24 00 02 00 00 75 46 41 f7 c4 00 02 00 00 74 01
RSP: 0018:ffffc9000837fa48 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 0000000000000002 RCX: ffff8880205dbb80
RDX: ffff8880205dbb80 RSI: ffffffff8b0c13c0 RDI: ffffffff8b5d5ba0
RBP: 0000000000000001 R08: ffffffff85636172 R09: ffffc9000837fb08
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000246
R13: ffff8880205dbb80 R14: 00000000ffffffff R15: ffff888018b3e250
FS:  0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000056500bc4f058 CR3: 000000000d08e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <TASK>
 lock_is_held include/linux/lockdep.h:283 [inline]
 dma_resv_iter_first+0x6d/0x250 drivers/dma-buf/dma-resv.c:462
 dma_buf_poll_add_cb+0xd7/0x280 drivers/dma-buf/dma-buf.c:225
 dma_buf_poll+0x456/0x6a0 drivers/dma-buf/dma-buf.c:295
 vfs_poll include/linux/poll.h:84 [inline]
 p9_fd_poll net/9p/trans_fd.c:238 [inline]
 p9_poll_mux net/9p/trans_fd.c:630 [inline]
 p9_poll_workfn+0x2cd/0x5c0 net/9p/trans_fd.c:1174
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/08/03 06:30 linux-6.1.y c1cec4dad96b 1786a2a8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in devinet_ioctl
2024/06/15 22:33 linux-6.1.y ae9f2a70d69e f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in devinet_ioctl
2024/05/24 20:35 linux-6.1.y 4078fa637fcd a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: task hung in devinet_ioctl
* Struck through repros no longer work on HEAD.