syzbot


INFO: task hung in mpol_rebind_mm

Status: upstream: reported on 2024/11/01 04:47
Reported-by: syzbot+ef9bc4d9c532e9aac612@syzkaller.appspotmail.com
First crash: 50d, last: 50d

Sample crash report:
INFO: task syz-executor:5491 blocked for more than 143 seconds.
      Not tainted 6.1.115-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:20472 pid:5491  ppid:5482   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 rwsem_down_write_slowpath+0xea1/0x14b0 kernel/locking/rwsem.c:1189
 mmap_write_lock include/linux/mmap_lock.h:71 [inline]
 mpol_rebind_mm+0xe4/0x390 mm/mempolicy.c:386
 cpuset_attach+0x29b/0x560 kernel/cgroup/cpuset.c:2663
 cgroup_migrate_execute+0x7e3/0x1060 kernel/cgroup/cgroup.c:2639
 cgroup_attach_task+0x614/0x970 kernel/cgroup/cgroup.c:2930
 __cgroup1_procs_write+0x2ef/0x460 kernel/cgroup/cgroup-v1.c:522
 cgroup_file_write+0x2c6/0x6c0 kernel/cgroup/cgroup.c:4081
 kernfs_fop_write_iter+0x3a2/0x4f0 fs/kernfs/file.c:334
 call_write_iter include/linux/fs.h:2265 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x857/0xbc0 fs/read_write.c:584
 ksys_write+0x19c/0x2c0 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f170ff7d1ff
RSP: 002b:00007ffde7e9aa10 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f170ff7d1ff
RDX: 0000000000000001 RSI: 00007ffde7e9aa60 RDI: 0000000000000003
RBP: 00007ffde7e9afc0 R08: 0000000000000000 R09: 00007ffde7e9a867
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 00007ffde7e9aa60 R14: 00007ffde7e9af80 R15: 00007ffde7e9afc0
 </TASK>
INFO: task syz-executor:5492 blocked for more than 143 seconds.
      Not tainted 6.1.115-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:19320 pid:5492  ppid:5481   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 percpu_rwsem_wait+0x3b9/0x450 kernel/locking/percpu-rwsem.c:162
 __percpu_down_read+0xe6/0x130 kernel/locking/percpu-rwsem.c:177
 percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
 cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:748 [inline]
 cgroup_css_set_fork kernel/cgroup/cgroup.c:6404 [inline]
 cgroup_can_fork+0xb87/0xc70 kernel/cgroup/cgroup.c:6533
 copy_process+0x241c/0x4060 kernel/fork.c:2368
 kernel_clone+0x222/0x920 kernel/fork.c:2679
 __do_sys_clone kernel/fork.c:2820 [inline]
 __se_sys_clone kernel/fork.c:2804 [inline]
 __x64_sys_clone+0x231/0x280 kernel/fork.c:2804
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff5a8974f93
RSP: 002b:00007fff516591a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff5a8974f93
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 0000555576eb07d0 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000002351d R14: 00000000000234d7 R15: 00007fff51659330
 </TASK>
INFO: task syz.3.435:5587 blocked for more than 143 seconds.
      Not tainted 6.1.115-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.435       state:D stack:24512 pid:5587  ppid:4249   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 rwsem_down_write_slowpath+0xea1/0x14b0 kernel/locking/rwsem.c:1189
 mmap_write_lock include/linux/mmap_lock.h:71 [inline]
 exit_mmap+0x29a/0x9f0 mm/mmap.c:3235
 __mmput+0x115/0x3c0 kernel/fork.c:1199
 exit_mm+0x226/0x300 kernel/exit.c:565
 do_exit+0x9f6/0x26a0 kernel/exit.c:858
 do_group_exit+0x202/0x2b0 kernel/exit.c:1021
 get_signal+0x16f7/0x17d0 kernel/signal.c:2870
 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303
 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f678e57e719
RSP: 002b:00007f678f2f30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00007f678e735f88 RCX: 00007f678e57e719
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f678e735f8c
RBP: 00007f678e735f80 R08: 0000000000000010 R09: 0000000000000000
R10: 0000000000000007 R11: 0000000000000246 R12: 00007f678e735f8c
R13: 0000000000000000 R14: 00007ffe03724300 R15: 00007ffe037243e8
 </TASK>
INFO: task syz.9.439:5701 blocked for more than 144 seconds.
      Not tainted 6.1.115-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.439       state:D stack:25832 pid:5701  ppid:5508   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 percpu_rwsem_wait+0x3b9/0x450 kernel/locking/percpu-rwsem.c:162
 __percpu_down_read+0xe6/0x130 kernel/locking/percpu-rwsem.c:177
 percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
 cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:748 [inline]
 exit_signals+0x435/0x530 kernel/signal.c:2962
 do_exit+0x69f/0x26a0 kernel/exit.c:827
 do_group_exit+0x202/0x2b0 kernel/exit.c:1021
 __do_sys_exit_group kernel/exit.c:1032 [inline]
 __se_sys_exit_group kernel/exit.c:1030 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1030
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fac25f7e719
RSP: 002b:00007ffe7d74cb98 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fac25f7e719
RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 00007ffe7d74cbec R08: 00007ffe7d74cc7f R09: 0000000000023399
R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000032
R13: 0000000000023399 R14: 0000000000023328 R15: 00007ffe7d74cc40
 </TASK>
INFO: task syz.9.439:5702 blocked for more than 144 seconds.
      Not tainted 6.1.115-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.439       state:D stack:26616 pid:5702  ppid:5508   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 percpu_rwsem_wait+0x3b9/0x450 kernel/locking/percpu-rwsem.c:162
 __percpu_down_read+0xe6/0x130 kernel/locking/percpu-rwsem.c:177
 percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
 cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:748 [inline]
 exit_signals+0x435/0x530 kernel/signal.c:2962
 do_exit+0x69f/0x26a0 kernel/exit.c:827
 do_group_exit+0x202/0x2b0 kernel/exit.c:1021
 get_signal+0x16f7/0x17d0 kernel/signal.c:2870
 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303
 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fac25f7e719
RSP: 002b:00007fac26df40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fac26135f88 RCX: 00007fac25f7e719
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fac26135f88
RBP: 00007fac26135f80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fac26135f8c
R13: 0000000000000000 R14: 00007ffe7d74c740 R15: 00007ffe7d74c828
 </TASK>
INFO: task syz.9.439:5705 blocked for more than 144 seconds.
      Not tainted 6.1.115-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.439       state:D stack:24512 pid:5705  ppid:5508   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5241 [inline]
 __schedule+0x143f/0x4570 kernel/sched/core.c:6558
 schedule+0xbf/0x180 kernel/sched/core.c:6634
 percpu_rwsem_wait+0x3b9/0x450 kernel/locking/percpu-rwsem.c:162
 __percpu_down_read+0xe6/0x130 kernel/locking/percpu-rwsem.c:177
 percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
 cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:748 [inline]
 exit_signals+0x435/0x530 kernel/signal.c:2962
 do_exit+0x69f/0x26a0 kernel/exit.c:827
 do_group_exit+0x202/0x2b0 kernel/exit.c:1021
 get_signal+0x16f7/0x17d0 kernel/signal.c:2870
 arch_do_signal_or_restart+0xb0/0x1a10 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x6a/0x100 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
 syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:303
 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fac25f7e719
RSP: 002b:00007fac26dd30e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fac26136060 RCX: 00007fac25f7e719
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fac26136060
RBP: 00007fac26136058 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fac26136064
R13: 0000000000000000 R14: 00007ffe7d74c740 R15: 00007ffe7d74c828
 </TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
 #0: ffffffff8d32b1d0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
 #0: ffffffff8d32b9d0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/28:
 #0: ffffffff8d32b000 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
 #0: ffffffff8d32b000 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
 #0: ffffffff8d32b000 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6510
3 locks held by kworker/u4:3/46:
 #0: ffff888017e16938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #1: ffffc90000b77d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267
 #2: ffffffff8e4eedd0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60 net/core/net_namespace.c:566
1 lock held by dhcpcd/3916:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x241c/0x4060 kernel/fork.c:2368
2 locks held by getty/4012:
 #0: ffff88814cefc098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
 #1: ffffc900032462f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a7/0x1db0 drivers/tty/n_tty.c:2198
1 lock held by syz-executor/4247:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827
1 lock held by bond0/5176:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827
7 locks held by syz-executor/5491:
 #0: ffff88802f9f6460 (sb_writers#11){.+.+}-{0:0}, at: vfs_write+0x269/0xbc0 fs/read_write.c:580
 #1: ffff8880628f4888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e7/0x4f0 fs/kernfs/file.c:325
 #2: ffffffff8d3535e8 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:442 [inline]
 #2: ffffffff8d3535e8 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xe5/0x290 kernel/cgroup/cgroup.c:1677
 #3: ffffffff8d1c83b0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_attach_lock kernel/cgroup/cgroup.c:2453 [inline]
 #3: ffffffff8d1c83b0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x19c/0x650 kernel/cgroup/cgroup.c:2959
 #4: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_attach_lock kernel/cgroup/cgroup.c:2455 [inline]
 #4: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_procs_write_start+0x1b1/0x650 kernel/cgroup/cgroup.c:2959
 #5: ffffffff8d35ffa8 (cpuset_mutex){+.+.}-{3:3}, at: cpuset_attach+0xd9/0x560 kernel/cgroup/cpuset.c:2647
 #6: ffff88807c07bd58 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:71 [inline]
 #6: ffff88807c07bd58 (&mm->mmap_lock){++++}-{3:3}, at: mpol_rebind_mm+0xe4/0x390 mm/mempolicy.c:386
1 lock held by syz-executor/5492:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x241c/0x4060 kernel/fork.c:2368
1 lock held by syz.3.435/5587:
 #0: ffff8880767e9058 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:71 [inline]
 #0: ffff8880767e9058 (&mm->mmap_lock){++++}-{3:3}, at: exit_mmap+0x29a/0x9f0 mm/mmap.c:3235
1 lock held by udevd/5686:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827
1 lock held by syz.8.438/5698:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827
1 lock held by syz.8.438/5699:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827
1 lock held by syz.8.438/5700:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827
1 lock held by syz.9.439/5701:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827
1 lock held by syz.9.439/5702:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827
1 lock held by syz.9.439/5705:
 #0: ffffffff8d3537d0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x69f/0x26a0 kernel/exit.c:827

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.1.115-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
 nmi_cpu_backtrace+0x4e1/0x560 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x1ae/0x3f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
 watchdog+0xf88/0xfd0 kernel/hung_task.c:377
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4308 Comm: kworker/u4:6 Not tainted 6.1.115-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
RIP: 0010:unwind_next_frame+0x571/0x2220 arch/x86/kernel/unwind_orc.c:461
Code: ef 49 c1 ef 03 41 0f b6 04 3f 84 c0 0f 85 92 16 00 00 48 89 d8 48 c1 e8 03 0f b6 04 38 84 c0 0f 85 a5 16 00 00 41 0f b7 45 00 <89> c3 83 e3 0f 0f 84 94 00 00 00 8d 43 fe 83 f8 07 0f 87 98 00 00
RSP: 0018:ffffc900001e0260 EFLAGS: 00000246
RAX: 0000000000000014 RBX: ffffffff8f8b4c07 RCX: ffffffff8ef7e338
RDX: ffffffff8f8b4c02 RSI: ffffffff889eca8c RDI: dffffc0000000000
RBP: ffffffff8f8b4c02 R08: 0000000000000001 R09: ffffc900001e0430
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000000000000
R13: ffffffff8f8b4c06 R14: ffffffff8ef7e334 R15: 1ffffffff1f16980
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555589b635c8 CR3: 000000007e460000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 __kmem_cache_free+0x25c/0x3c0 mm/slub.c:3674
 skb_free_head net/core/skbuff.c:762 [inline]
 skb_release_data+0x5de/0x7a0 net/core/skbuff.c:791
 skb_release_all net/core/skbuff.c:856 [inline]
 __kfree_skb net/core/skbuff.c:870 [inline]
 kfree_skb_reason+0x16f/0x390 net/core/skbuff.c:893
 __netif_receive_skb_core+0x398a/0x41d0 net/core/dev.c:5506
 __netif_receive_skb_one_core net/core/dev.c:5530 [inline]
 __netif_receive_skb+0x11c/0x530 net/core/dev.c:5646
 process_backlog+0x381/0x760 net/core/dev.c:5974
 __napi_poll+0xc7/0x470 net/core/dev.c:6541
 napi_poll net/core/dev.c:6608 [inline]
 net_rx_action+0x70f/0xeb0 net/core/dev.c:6722
 handle_softirqs+0x2ee/0xa40 kernel/softirq.c:571
 do_softirq+0x162/0x240 kernel/softirq.c:472
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x1b1/0x1f0 kernel/softirq.c:396
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:861 [inline]
 __dev_queue_xmit+0x173c/0x3d50 net/core/dev.c:4324
 dev_queue_xmit include/linux/netdevice.h:3021 [inline]
 batadv_send_skb_packet+0x409/0x660 net/batman-adv/send.c:108
 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline]
 batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline]
 batadv_iv_send_outstanding_bat_ogm_packet+0x66f/0x800 net/batman-adv/bat_iv_ogm.c:1701
 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
 kthread+0x28d/0x320 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2024/11/01 04:46 linux-6.1.y 7c15117f9468 96eb609f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-perf INFO: task hung in mpol_rebind_mm
* Struck through repros no longer work on HEAD.