syzbot


INFO: task hung in cangw_pernet_exit

Status: closed as invalid on 2019/10/23 07:27
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+916cfd0bd8c9f4df4042@syzkaller.appspotmail.com
First crash: 2219d, last: 1722d
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in cangw_pernet_exit 1 1378d 1378d 0/1 auto-closed as invalid on 2020/11/15 21:42
linux-4.19 INFO: task hung in cangw_pernet_exit (2) 6 649d 884d 0/1 auto-obsoleted due to no activity on 2022/11/15 03:06
upstream INFO: task hung in cangw_pernet_exit (2) can 85 1125d 1301d 0/26 auto-closed as invalid on 2021/06/26 13:07
upstream INFO: task hung in cangw_pernet_exit (3) can syz unreliable 290 851d 957d 0/26 closed as invalid on 2022/02/08 10:22

Sample crash report:
INFO: task kworker/u4:2:44 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc5+ #271
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:2    D14936    44      2 0x80000000
Workqueue: netns cleanup_net
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xaff/0x16f0 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
 cangw_pernet_exit+0x12/0x30 net/can/gw.c:1005
 ops_exit_list.isra.5+0xb0/0x160 net/core/net_namespace.c:153
 cleanup_net+0x555/0xb10 net/core/net_namespace.c:551
 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153
 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296
 kthread+0x35a/0x440 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
INFO: task kworker/0:8:23276 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc5+ #271
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/0:8     D20832 23276      2 0x80000000
Workqueue: ipv6_addrconf addrconf_verify_work
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xaff/0x16f0 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
 addrconf_verify_work+0xe/0x20 net/ipv6/addrconf.c:4481
 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153
 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296
 kthread+0x35a/0x440 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
INFO: task kworker/1:10:25904 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc5+ #271
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/1:10    D22760 25904      2 0x80000000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xaff/0x16f0 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
 addrconf_dad_work+0xb6/0x1310 net/ipv6/addrconf.c:3994
 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153
 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296
 kthread+0x35a/0x440 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
INFO: task syz-executor2:22207 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc5+ #271
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D23192 22207   6043 0x20020004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline]
 _synchronize_rcu_expedited.constprop.58+0x8df/0x9d0 kernel/rcu/tree_exp.h:620
 synchronize_rcu_expedited+0x27/0xa0 kernel/rcu/tree_exp.h:758
 synchronize_net+0x3b/0x60 net/core/dev.c:9069
 dev_deactivate_many+0x543/0xdd0 net/sched/sch_generic.c:1222
 __dev_close_many+0x197/0x380 net/core/dev.c:1461
 __dev_close net/core/dev.c:1486 [inline]
 __dev_change_flags+0x388/0x9b0 net/core/dev.c:7500
 dev_change_flags+0x89/0x150 net/core/dev.c:7571
 devinet_ioctl+0xe6a/0x1d80 net/ipv4/devinet.c:1103
 inet_ioctl+0x18b/0x360 net/ipv4/af_inet.c:954
 sock_do_ioctl+0xeb/0x420 net/socket.c:950
 compat_sock_ioctl_trans net/socket.c:3196 [inline]
 compat_sock_ioctl+0xa0e/0x1fe0 net/socket.c:3222
 __do_compat_sys_ioctl fs/compat_ioctl.c:1052 [inline]
 __se_compat_sys_ioctl fs/compat_ioctl.c:998 [inline]
 __ia32_compat_sys_ioctl+0x20e/0x630 fs/compat_ioctl.c:998
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7fdda29
Code: Bad RIP value.
RSP: 002b:00000000f5fd90cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000008914
RDX: 0000000020000180 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor2:22236 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc5+ #271
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D22864 22236   6043 0x20020004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xaff/0x16f0 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
 devinet_ioctl+0x27f/0x1d80 net/ipv4/devinet.c:1030
 inet_ioctl+0x18b/0x360 net/ipv4/af_inet.c:954
 sock_do_ioctl+0xeb/0x420 net/socket.c:950
 compat_sock_ioctl_trans net/socket.c:3196 [inline]
 compat_sock_ioctl+0xa0e/0x1fe0 net/socket.c:3222
 __do_compat_sys_ioctl fs/compat_ioctl.c:1052 [inline]
 __se_compat_sys_ioctl fs/compat_ioctl.c:998 [inline]
 __ia32_compat_sys_ioctl+0x20e/0x630 fs/compat_ioctl.c:998
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7fdda29
Code: Bad RIP value.
RSP: 002b:00000000f5fb80cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 0000000000008914
RDX: 0000000020000180 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor2:22238 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc5+ #271
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor2   D25304 22238   6043 0x20020004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xaff/0x16f0 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
 dev_ioctl+0x1a8/0xcc0 net/core/dev_ioctl.c:487
 sock_do_ioctl+0x1f6/0x420 net/socket.c:973
 compat_sock_ioctl_trans net/socket.c:3196 [inline]
 compat_sock_ioctl+0xa0e/0x1fe0 net/socket.c:3222
 __do_compat_sys_ioctl fs/compat_ioctl.c:1052 [inline]
 __se_compat_sys_ioctl fs/compat_ioctl.c:998 [inline]
 __ia32_compat_sys_ioctl+0x20e/0x630 fs/compat_ioctl.c:998
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7fdda29
Code: Bad RIP value.
RSP: 002b:00000000f5f760cc EFLAGS: 00000296 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000008914
RDX: 00000000200000c0 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor0:22218 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc5+ #271
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0   D24520 22218   6018 0x20020004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xaff/0x16f0 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock net/core/rtnetlink.c:77 [inline]
 rtnetlink_rcv_msg+0x40e/0xc20 net/core/rtnetlink.c:4944
 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4965
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0x5a5/0x760 net/netlink/af_netlink.c:1336
 netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2116
 __sys_sendmsg+0x11d/0x280 net/socket.c:2154
 __compat_sys_sendmsg net/compat.c:754 [inline]
 __do_compat_sys_sendmsg net/compat.c:761 [inline]
 __se_compat_sys_sendmsg net/compat.c:758 [inline]
 __ia32_compat_sys_sendmsg+0x7a/0xb0 net/compat.c:758
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7fb9a29
Code: Bad RIP value.
RSP: 002b:00000000f5fb50cc EFLAGS: 00000296 ORIG_RAX: 0000000000000172
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000020000500
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
INFO: task syz-executor0:22222 blocked for more than 140 seconds.
      Not tainted 4.20.0-rc5+ #271
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0   D24816 22222   6018 0x20020004
Call Trace:
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472
 schedule+0xfe/0x460 kernel/sched/core.c:3516
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3574
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xaff/0x16f0 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock net/core/rtnetlink.c:77 [inline]
 rtnetlink_rcv_msg+0x40e/0xc20 net/core/rtnetlink.c:4944
 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2477
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4965
 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
 netlink_unicast+0x5a5/0x760 net/netlink/af_netlink.c:1336
 netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1917
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2116
 __sys_sendmsg+0x11d/0x280 net/socket.c:2154
 __compat_sys_sendmsg net/compat.c:754 [inline]
 __do_compat_sys_sendmsg net/compat.c:761 [inline]
 __se_compat_sys_sendmsg net/compat.c:758 [inline]
 __ia32_compat_sys_sendmsg+0x7a/0xb0 net/compat.c:758
 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline]
 do_fast_syscall_32+0x34d/0xfb2 arch/x86/entry/common.c:397
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
RIP: 0023:0xf7fb9a29
Code: Bad RIP value.
RSP: 002b:00000000f5f940cc EFLAGS: 00000296 ORIG_RAX: 0000000000000172
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000020000500
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000

Showing all locks held in the system:
4 locks held by kworker/u4:2/44:
 #0: 00000000358507f6 ((wq_completion)"%s""netns"){+.+.}, at: __write_once_size include/linux/compiler.h:209 [inline]
 #0: 00000000358507f6 ((wq_completion)"%s""netns"){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 00000000358507f6 ((wq_completion)"%s""netns"){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline]
 #0: 00000000358507f6 ((wq_completion)"%s""netns"){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline]
 #0: 00000000358507f6 ((wq_completion)"%s""netns"){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: 00000000358507f6 ((wq_completion)"%s""netns"){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: 00000000358507f6 ((wq_completion)"%s""netns"){+.+.}, at: process_one_work+0xb43/0x1c40 kernel/workqueue.c:2124
 #1: 00000000d6a2d266 (net_cleanup_work){+.+.}, at: process_one_work+0xb9a/0x1c40 kernel/workqueue.c:2128
 #2: 0000000098e25262 (pernet_ops_rwsem){++++}, at: cleanup_net+0x13f/0xb10 net/core/net_namespace.c:518
 #3: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
1 lock held by khungtaskd/1020:
 #0: 00000000ac572d7b (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379
2 locks held by rsyslogd/5889:
 #0: 000000004cdc5d57 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200 fs/file.c:766
 #1: 000000006e58ce15 (&rq->lock){-.-.}, at: finish_wait+0x119/0x430 kernel/sched/wait.c:366
2 locks held by getty/5979:
 #0: 00000000c11eb6f3 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000012d9ae90 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5980:
 #0: 000000005f2e4c19 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 000000006cd77470 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5981:
 #0: 000000001d4e5e38 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000de2227af (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5982:
 #0: 000000006237eb97 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000edb87f5b (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5983:
 #0: 000000006cc5228b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000bcb7047a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5984:
 #0: 00000000ebfd6340 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000e926c6d1 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
2 locks held by getty/5985:
 #0: 000000008603534f (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 000000003d4f7683 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154
3 locks held by kworker/0:8/23276:
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: __write_once_size include/linux/compiler.h:209 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: process_one_work+0xb43/0x1c40 kernel/workqueue.c:2124
 #1: 0000000019184e46 ((addr_chk_work).work){+.+.}, at: process_one_work+0xb9a/0x1c40 kernel/workqueue.c:2128
 #2: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
3 locks held by kworker/1:10/25904:
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: __write_once_size include/linux/compiler.h:209 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: 00000000a01b7d06 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: process_one_work+0xb43/0x1c40 kernel/workqueue.c:2124
 #1: 000000008e71297f ((work_completion)(&(&ifa->dad_work)->work)){+.+.}, at: process_one_work+0xb9a/0x1c40 kernel/workqueue.c:2128
 #2: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
1 lock held by syz-executor2/22207:
 #0: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
1 lock held by syz-executor2/22236:
 #0: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
1 lock held by syz-executor2/22238:
 #0: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
1 lock held by syz-executor0/22218:
 #0: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline]
 #0: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x40e/0xc20 net/core/rtnetlink.c:4944
1 lock held by syz-executor0/22222:
 #0: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline]
 #0: 0000000090a583d6 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x40e/0xc20 net/core/rtnetlink.c:4944

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 1020 Comm: khungtaskd Not tainted 4.20.0-rc5+ #271
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
 watchdog+0xb51/0x1060 kernel/hung_task.c:289
 kthread+0x35a/0x440 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:57

Crashes (14):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2018/12/09 01:49 upstream 8214bdf7d3e6 c7918378 .config console log report ci-upstream-kasan-gce-386
2019/08/09 21:20 net-old 8c25d0887a8b ede31a9b .config console log report ci-upstream-net-this-kasan-gce
2019/03/16 17:37 net-old 4477138fa0ae bab43553 .config console log report ci-upstream-net-this-kasan-gce
2018/12/16 01:03 net-old 10589a568f2e def91db3 .config console log report ci-upstream-net-this-kasan-gce
2019/04/27 07:24 bpf-next 3745dc24aa7a b617407b .config console log report ci-upstream-bpf-next-kasan-gce
2019/01/04 13:39 net-next-old b71acb0e3721 7da23925 .config console log report ci-upstream-net-kasan-gce
2018/04/17 09:08 net-next-old 9a00b697ce31 b80fd3b5 .config console log report ci-upstream-net-kasan-gce
2018/03/30 14:25 net-next-old 18845557fd6f d47f0ed6 .config console log report ci-upstream-net-kasan-gce
2018/03/30 12:19 net-next-old 18845557fd6f d47f0ed6 .config console log report ci-upstream-net-kasan-gce
2018/03/30 12:12 net-next-old 18845557fd6f d47f0ed6 .config console log report ci-upstream-net-kasan-gce
2018/03/30 08:54 net-next-old 18845557fd6f d47f0ed6 .config console log report ci-upstream-net-kasan-gce
2018/12/28 04:58 linux-next 6a1d293238c1 af317504 .config console log report ci-upstream-linux-next-kasan-gce-root
2018/10/28 05:58 linux-next 8c60c36d0b8c 8efba39a .config console log report ci-upstream-linux-next-kasan-gce-root
2018/09/01 18:21 linux-next a880148cb2af a4718693 .config console log report ci-upstream-linux-next-kasan-gce-root
* Struck through repros no longer work on HEAD.