syzbot

INFO: task syz.0.107:6400 blocked for more than 143 seconds.
      Not tainted 6.14.0-rc6-syzkaller-00180-g83158b21ae9a #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.107       state:D stack:26160 pid:6400  tgid:6392  ppid:5842   task_flags:0x400140 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6857
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x6bd/0xb10 kernel/locking/mutex.c:730
 wg_netns_pre_exit+0x1b/0x230 drivers/net/wireguard/device.c:415
 ops_pre_exit_list net/core/net_namespace.c:162 [inline]
 setup_net+0x39c/0x860 net/core/net_namespace.c:379
 copy_net_ns+0x2a6/0x5f0 net/core/net_namespace.c:516
 create_new_namespaces+0x3ea/0xad0 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0xc0/0x1f0 kernel/nsproxy.c:228
 ksys_unshare+0x45d/0xa40 kernel/fork.c:3342
 __do_sys_unshare kernel/fork.c:3413 [inline]
 __se_sys_unshare kernel/fork.c:3411 [inline]
 __x64_sys_unshare+0x31/0x40 kernel/fork.c:3411
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdf878d169
RSP: 002b:00007fcdf96b4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007fcdf89a6080 RCX: 00007fcdf878d169
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000080
RBP: 00007fcdf880e2a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fcdf89a6080 R15: 00007ffdafa2cbc8
 </TASK>

Showing all locks held in the system:
2 locks held by kworker/u8:0/12:
3 locks held by kworker/u8:1/13:
2 locks held by kworker/1:0/26:
1 lock held by khungtaskd/31:
 #0: ffffffff8e1bd140 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff8e1bd140 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8e1bd140 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6746
6 locks held by kworker/u8:3/53:
3 locks held by kworker/u8:4/62:
3 locks held by kworker/u8:5/1319:
3 locks held by kworker/R-ipv6_/3167:
 #0: ffff888030849948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3213
 #1: ffffc9000c3a7cb0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3214
 #2: ffffffff8fef9d28 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline]
 #2: ffffffff8fef9d28 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4733
3 locks held by kworker/u8:6/3224:
3 locks held by kworker/u8:7/3236:
3 locks held by kworker/u8:9/3471:
4 locks held by kworker/u8:10/3482:
3 locks held by kworker/u8:11/3513:
3 locks held by kworker/u8:12/3572:
2 locks held by syslogd/5195:
5 locks held by udevd/5213:
2 locks held by dhcpcd/5506:
2 locks held by syz-executor/5832:
4 locks held by syz-executor/5841:
3 locks held by kworker/0:3/5843:
 #0: ffff88801b081d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3213
 #1: ffffc90004067d18 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3214
 #2: ffffffff8fef9d28 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x84/0x1130 net/wireless/reg.c:2481
2 locks held by syz-executor/5845:
2 locks held by syz-executor/5846:
2 locks held by kworker/1:3/5885:
3 locks held by kworker/0:6/5905:
2 locks held by kworker/1:5/5906:
3 locks held by kworker/0:7/5923:
 #0: ffff88801b081d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3213
 #1: ffffc900048dfd18 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3214
 #2: ffffffff8fef9d28 (rtnl_mutex){+.+.}-{4:4}, at: crda_timeout_work+0x15/0x50 net/wireless/reg.c:541
2 locks held by getty/6008:
 #0: ffff88814d7740a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc900037bd2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211
3 locks held by syz.3.61/6249:
1 lock held by syz.0.74/6290:
3 locks held by syz.3.85/6327:
2 locks held by syz.0.107/6400:
 #0: ffffffff8fee4010 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x286/0x5f0 net/core/net_namespace.c:512
 #1: ffffffff8fef9d28 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1b/0x230 drivers/net/wireguard/device.c:415
2 locks held by kworker/u8:13/6428:
7 locks held by kworker/u8:14/6429:
3 locks held by kworker/u8:15/6430:
3 locks held by kworker/u8:16/6432:
3 locks held by syz-executor/6433:

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.14.0-rc6-syzkaller-00180-g83158b21ae9a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:236 [inline]
 watchdog+0xf62/0x12b0 kernel/hung_task.c:399
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 3482 Comm: kworker/u8:10 Not tainted 6.14.0-rc6-syzkaller-00180-g83158b21ae9a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:br_nf_forward_ip net/bridge/br_netfilter_hooks.c:679 [inline]
RIP: 0010:br_nf_forward+0xf13/0x1bd0 net/bridge/br_netfilter_hooks.c:776
Code: 0f b6 44 24 04 c1 e0 03 48 98 49 01 c4 0f 84 14 fd ff ff e8 cf 10 88 f7 48 89 df ba 0a 00 00 00 48 89 ee e8 bf e8 ff ff 89 c3 <e9> fd fc ff ff 4c 8d a3 b4 00 00 00 e9 9a f1 ff ff 84 d2 0f 84 86
RSP: 0018:ffffc90000a281a8 EFLAGS: 00000292
RAX: 0000000000000002 RBX: 0000000000000002 RCX: fffff52000145005
RDX: ffff888032108000 RSI: ffffffff8a31cccd RDI: 0000000000000005