INFO: task syz-executor:5882 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:22280 pid:5882 ppid:1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x1553/0x45a0 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747
del_device_store+0xd8/0x370 drivers/net/netdevsim/bus.c:209
kernfs_fop_write_iter+0x3b6/0x520 fs/kernfs/file.c:352
call_write_iter include/linux/fs.h:2018 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x46c/0x990 fs/read_write.c:584
ksys_write+0x150/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fceb8f5d60e
RSP: 002b:00007ffc4f111448 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555558909500 RCX: 00007fceb8f5d60e
RDX: 0000000000000001 RSI: 00007ffc4f1114d0 RDI: 0000000000000005
RBP: 00007fceb90335ec R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc4f1114d0 R14: 00007fceb9d44620 R15: 0000000000000003
</TASK>
INFO: task syz-executor:5883 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:22064 pid:5883 ppid:1 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x1553/0x45a0 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747
nsim_drv_remove+0x50/0x170 drivers/net/netdevsim/dev.c:1676
device_remove drivers/base/dd.c:567 [inline]
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x468/0x7a0 drivers/base/dd.c:1295
bus_remove_device+0x342/0x400 drivers/base/bus.c:576
device_del+0x522/0x910 drivers/base/core.c:3872
device_unregister+0x20/0xc0 drivers/base/core.c:3913
nsim_bus_dev_del drivers/net/netdevsim/bus.c:310 [inline]
del_device_store+0x2b1/0x370 drivers/net/netdevsim/bus.c:219
kernfs_fop_write_iter+0x3b6/0x520 fs/kernfs/file.c:352
call_write_iter include/linux/fs.h:2018 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x46c/0x990 fs/read_write.c:584
ksys_write+0x150/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd3f0d5d60e
RSP: 002b:00007ffe0e7d8da8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555555dcd500 RCX: 00007fd3f0d5d60e
RDX: 0000000000000001 RSI: 00007ffe0e7d8e30 RDI: 0000000000000005
RBP: 00007fd3f0e335ec R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffe0e7d8e30 R14: 00007fd3f1b44620 R15: 0000000000000003
</TASK>
INFO: task syz-executor:5885 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor state:D stack:22280 pid:5885 ppid:1 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x1553/0x45a0 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6a9/0xcc0 kernel/locking/mutex.c:747
del_device_store+0xd8/0x370 drivers/net/netdevsim/bus.c:209
kernfs_fop_write_iter+0x3b6/0x520 fs/kernfs/file.c:352
call_write_iter include/linux/fs.h:2018 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x46c/0x990 fs/read_write.c:584
ksys_write+0x150/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe04255d60e
RSP: 002b:00007ffefe09d5d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555558e06500 RCX: 00007fe04255d60e
RDX: 0000000000000001 RSI: 00007ffefe09d660 RDI: 0000000000000005
RBP: 00007fe0426335ec R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffefe09d660 R14: 00007fe043344620 R15: 0000000000000003
</TASK>
Showing all locks held in the system:
3 locks held by kworker/0:1/9:
#0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc900000e7d00 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc900000e7d00 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: crda_timeout_work+0x15/0x50 net/wireless/reg.c:539
4 locks held by kworker/u4:0/11:
#0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017c71538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc90000107d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90000107d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
#3: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline]
#3: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 kernel/rcu/tree_exp.h:1004
3 locks held by kworker/1:0/23:
#0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017c71d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc900001d7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc900001d7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x92/0xd90 net/wireless/reg.c:2463
1 lock held by khungtaskd/29:
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
3 locks held by kworker/u4:2/38:
#0: ffff88802c96e138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff88802c96e138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc90000aefd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90000aefd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4718
3 locks held by kworker/u4:5/985:
5 locks held by kworker/u4:7/2911:
#0: ffff88801a254938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff88801a254938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc9000bb17d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc9000bb17d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffffffff8e3b57d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x14c/0xbb0 net/core/net_namespace.c:606
#3: ffff88807b34f250 (&devlink->lock_key){+.+.}-{3:3}, at: devl_lock net/devlink/core.c:60 [inline]
#3: ffff88807b34f250 (&devlink->lock_key){+.+.}-{3:3}, at: devlink_pernet_pre_exit+0xee/0x360 net/devlink/core.c:285
#4: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3f/0x180 drivers/net/netdevsim/netdev.c:417
2 locks held by getty/5534:
#0: ffff88802d6870a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x433/0x1390 drivers/tty/n_tty.c:2217
2 locks held by kworker/1:4/5835:
#0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff888017c72538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc90003047d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90003047d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
5 locks held by kworker/u5:2/5849:
#0: ffff88802f029538 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff88802f029538 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc90002f47d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90002f47d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffff88802e544e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1d4/0x380 net/bluetooth/hci_sync.c:332
#3: ffff88802e5440b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x98a/0xec0 net/bluetooth/hci_sync.c:5673
#4: ffffffff8e530468 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1996 [inline]
#4: ffffffff8e530468 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x165/0x300 net/bluetooth/hci_conn.c:1252
4 locks held by syz-executor/5882:
#0: ffff88802113e418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21b/0x990 fs/read_write.c:580
#1: ffff88805db51088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x520 fs/kernfs/file.c:343
#2: ffff88814233bca0 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88814233bca0 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x23a/0x520 fs/kernfs/file.c:344
#3: ffffffff8dca2848 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd8/0x370 drivers/net/netdevsim/bus.c:209
6 locks held by syz-executor/5883:
#0: ffff88802113e418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21b/0x990 fs/read_write.c:580
#1: ffff888060bf7088 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x520 fs/kernfs/file.c:343
#2: ffff88814233bca0 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88814233bca0 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x23a/0x520 fs/kernfs/file.c:344
#3: ffffffff8dca2848 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd8/0x370 drivers/net/netdevsim/bus.c:209
#4: ffff88807b34e0e8 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:995 [inline]
#4: ffff88807b34e0e8 (&dev->mutex){....}-{3:3}, at: __device_driver_lock drivers/base/dd.c:1095 [inline]
#4: ffff88807b34e0e8 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0xb6/0x7a0 drivers/base/dd.c:1292
#5: ffff88807b34f250 (&devlink->lock_key){+.+.}-{3:3}, at: nsim_drv_remove+0x50/0x170 drivers/net/netdevsim/dev.c:1676
4 locks held by syz-executor/5885:
#0: ffff88802113e418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21b/0x990 fs/read_write.c:580
#1:
ffff88805ce3b888
(&of->mutex
){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x520 fs/kernfs/file.c:343
#2: ffff88814233bca0 (kn->active#59){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
#2: ffff88814233bca0 (kn->active#59){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x23a/0x520 fs/kernfs/file.c:344
#3: ffffffff8dca2848 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: del_device_store+0xd8/0x370 drivers/net/netdevsim/bus.c:209
6 locks held by kworker/u5:3/5887:
#0: ffff8881423abd38 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff8881423abd38 ((wq_completion)hci3){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc900032e7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc900032e7d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffff88801fff0e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1d4/0x380 net/bluetooth/hci_sync.c:332
#3: ffff88801fff00b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x98a/0xec0 net/bluetooth/hci_sync.c:5673
#4: ffffffff8e530468 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1996 [inline]
#4: ffffffff8e530468 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x165/0x300 net/bluetooth/hci_conn.c:1252
#5: ffff888076832b38 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_conn_del+0x70/0x660 net/bluetooth/l2cap_core.c:1759
4 locks held by kworker/u5:4/5890:
#0: ffff88805fd38d38 ((wq_completion)hci12#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff88805fd38d38 ((wq_completion)hci12#2){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc900032f7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc900032f7d00 ((work_completion)(&hdev->rx_work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffff8880256180b8 (&hdev->lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x9c/0x900 net/bluetooth/hci_event.c:3688
#3: ffffffff8e530468 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1996 [inline]
#3: ffffffff8e530468 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_remote_features_evt+0x547/0x900 net/bluetooth/hci_event.c:3722
5 locks held by kworker/u5:5/5892:
#0: ffff8881423a9138 ((wq_completion)hci1){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#0: ffff8881423a9138 ((wq_completion)hci1){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#1: ffffc90003317d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2628 [inline]
#1: ffffc90003317d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x96f/0x15d0 kernel/workqueue.c:2730
#2: ffff88801fff4e70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1d4/0x380 net/bluetooth/hci_sync.c:332
#3: ffff88801fff40b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x98a/0xec0 net/bluetooth/hci_sync.c:5673
#4: ffffffff8e530468 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1996 [inline]
#4: ffffffff8e530468 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x165/0x300 net/bluetooth/hci_conn.c:1252
2 locks held by syz.3.20/5924:
1 lock held by syz-executor/5932:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
1 lock held by syz-executor/5944:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
1 lock held by syz-executor/5947:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
1 lock held by syz-executor/5953:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
2 locks held by dhcpcd/5956:
#0: ffff88807dfb4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88807dfb4130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3259
#1: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#1: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
1 lock held by dhcpcd/5957:
#0: ffff88801b372130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88801b372130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3259
1 lock held by dhcpcd/5958:
#0: ffff888077d4a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888077d4a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3259
1 lock held by dhcpcd/5959:
#0: ffff88803127e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88803127e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3259
1 lock held by dhcpcd/5960:
#0: ffff88802105a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88802105a130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3259
1 lock held by dhcpcd/5961:
#0: ffff888030c56130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888030c56130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3259
1 lock held by syz-executor/5963:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
1 lock held by syz-executor/5971:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
1 lock held by syz-executor/5972:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
1 lock held by syz-executor/5975:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
1 lock held by syz-executor/5982:
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3c2808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x811/0xfa0 net/core/rtnetlink.c:6472
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
<TASK>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf3d/0xf80 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5924 Comm: syz.3.20 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:check_preemption_disabled+0x18/0x110 lib/smp_processor_id.c:14
Code: 40 8e 1c 8b eb 0c 66 2e 0f 1f 84 00 00 00 00 00 66 90 55 41 57 41 56 53 48 83 ec 10 65 48 8b 04 25 28 00 00 00 48 89 44 24 08 <65> 8b 05 bd 55 7d 75 65 8b 0d b2 55 7d 75 f7 c1 ff ff ff 7f 74 1f
RSP: 0018:ffffc900001f09a8 EFLAGS: 00000082
RAX: 2026178ef2609c00 RBX: ffffc900001f09f8 RCX: 2026178ef2609c00
RDX: 0000000000000000 RSI: ffffffff8ac7b680 RDI: ffffffff8b1c8e60
RBP: 0000000000000000 R08: ffffffff8e8b15ef R09: 1ffffffff1d162bd
R10: dffffc0000000000 R11: fffffbfff1d162be R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000555555c77500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555cb446160 CR3: 0000000024b92000 CR4: 00000000003506e0
Call Trace:
<IRQ>
kvm_set_cpu_l1tf_flush_l1d arch/x86/include/asm/hardirq.h:72 [inline]
sysvec_apic_timer_interrupt+0x1c/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 kernel/locking/spinlock.c:194
Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 0b 94 cc f6 65 8b 05 4c c1 73 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc900001f0aa0 EFLAGS: 00000206
RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: 2026178ef2609c00
RDX: dffffc0000000000 RSI: ffffffff8acac9e0 RDI: 0000000000000001
RBP: ffffc900001f0b20 R08: ffffffff911c551f R09: 1ffffffff2238aa3
R10: dffffc0000000000 R11: fffffbfff2238aa4 R12: dffffc0000000000
R13: ffff8880b8f3cd58 R14: ffff88801ba68a00 R15: 1ffff9200003e154
class_raw_spinlock_irqsave_destructor include/linux/spinlock.h:522 [inline]
try_to_wake_up+0x70a/0x1190 kernel/sched/core.c:4233
call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x542/0x800 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:finish_task_switch+0x26a/0x8f0 kernel/sched/core.c:5255
Code: 0f 84 33 01 00 00 48 85 db 0f 85 52 01 00 00 0f 1f 44 00 00 4c 8b 75 d0 4c 89 e7 e8 00 89 32 09 e8 9b 29 30 00 fb 4c 8b 65 c0 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0
RSP: 0018:ffffc90003477598 EFLAGS: 00000282
RAX: 2026178ef2609c00 RBX: 0000000000000000 RCX: 2026178ef2609c00
RDX: dffffc0000000000 RSI: ffffffff8acac9e0 RDI: ffffffff8b1c8e60
RBP: ffffc900034775f0 R08: ffffffff911c5517 R09: 1ffffffff2238aa2
R10: dffffc0000000000 R11: fffffbfff2238aa3 R12: ffff88802689bc00
R13: dffffc0000000000 R14: ffff88801ca63c00 R15: ffff8880b8f3cac8
context_switch kernel/sched/core.c:5384 [inline]
__schedule+0x155b/0x45a0 kernel/sched/core.c:6700
preempt_schedule_irq+0xbf/0x150 kernel/sched/core.c:7010
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:preempt_schedule+0x80/0xd0 kernel/sched/core.c:6889
Code: 4a 89 04 33 65 8b 05 27 28 75 75 a9 ff ff ff 7f 75 2a 48 b8 04 00 00 00 00 fc ff df c6 04 03 00 48 c7 44 24 20 00 00 00 00 9c <8f> 44 24 20 f7 44 24 20 00 02 00 00 c6 04 03 f8 75 29 48 c7 04 24
RSP: 0018:ffffc90003477998 EFLAGS: 00000246
RAX: dffffc0000000004 RBX: 1ffff9200068ef34 RCX: ffff88802689bc00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90003477a10 R08: dffffc0000000000 R09: 1ffffffff2238aa2
R10: dffffc0000000000 R11: fffffbfff2238aa3 R12: dffffc0000000000
R13: 0000000000000009 R14: dffffc0000000000 R15: 0000000000000000
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
percpu_down_read include/linux/percpu-rwsem.h:70 [inline]
cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:768 [inline]
exit_signals+0x3e3/0x500 kernel/signal.c:2994
do_exit+0x5fe/0x2460 kernel/exit.c:830
do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
get_signal+0x12fc/0x13f0 kernel/signal.c:2902
arch_do_signal_or_restart+0xc2/0x800 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f574979cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffe1b18368 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 0000000000000004 RBX: 00007f5749a15fa0 RCX: 00007f574979cdd9
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000480
RBP: 00007f5749832d69 R08: 000000000000000a R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5749a15fac R14: 00007f5749a15fa0 R15: 00007f5749a15fa0
</TASK>