INFO: task hung in addrconf_dad

[upstream] INFO: task hung in addrconf_dad_work
Status: moderation: reported on 2018/03/30 20:01
Reported-by: syzbot+63fcb43f66d666cf0974@syzkaller.appspotmail.com
First: 231d, last: 19d

Sample crash report:

netlink: 'syz-executor2': attribute type 4 has an invalid length.
netlink: 4 bytes leftover after parsing attributes in process `syz-executor5'.
INFO: task kworker/1:1:24 blocked for more than 140 seconds.
      Not tainted 4.19.0-rc8+ #72
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/1:1     D19352    24      2 0x80000000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 context_switch kernel/sched/core.c:2825 [inline]
 __schedule+0x86c/0x1ed0 kernel/sched/core.c:3473
 schedule+0xfe/0x460 kernel/sched/core.c:3517
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3575
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xbe7/0x1700 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
 addrconf_dad_work+0xb6/0x1310 net/ipv6/addrconf.c:3973
 process_one_work+0xc90/0x1b90 kernel/workqueue.c:2153
 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296
 kthread+0x35a/0x420 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
INFO: task syz-executor0:13178 blocked for more than 140 seconds.
      Not tainted 4.19.0-rc8+ #72
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor0   D18784 13178   5609 0x00000004
Call Trace:
 context_switch kernel/sched/core.c:2825 [inline]
 __schedule+0x86c/0x1ed0 kernel/sched/core.c:3473
 schedule+0xfe/0x460 kernel/sched/core.c:3517
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3575
 __mutex_lock_common kernel/locking/mutex.c:1002 [inline]
 __mutex_lock+0xbe7/0x1700 kernel/locking/mutex.c:1072
 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087
 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
 netdev_run_todo+0x6ae/0xa60 net/core/dev.c:8764
 rtnl_unlock net/core/rtnetlink.c:117 [inline]
 rtnetlink_rcv_msg+0x477/0xc20 net/core/rtnetlink.c:4731
 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2454
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4748
 netlink_unicast_kernel net/netlink/af_netlink.c:1317 [inline]
 netlink_unicast+0x5a5/0x760 net/netlink/af_netlink.c:1343
 netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1908
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2116
 __sys_sendmsg+0x11d/0x280 net/socket.c:2154
 __do_sys_sendmsg net/socket.c:2163 [inline]
 __se_sys_sendmsg net/socket.c:2161 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2161
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f4203b90c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457569
RDX: 0000000000000800 RSI: 0000000020000080 RDI: 0000000000000004
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4203b916d4
R13: 00000000004c38a5 R14: 00000000004d5700 R15: 00000000ffffffff

Showing all locks held in the system:
3 locks held by kworker/1:1/24:
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: __write_once_size include/linux/compiler.h:215 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: process_one_work+0xb43/0x1b90 kernel/workqueue.c:2124
 #1: 000000000e599ca2 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}, at: process_one_work+0xb9a/0x1b90 kernel/workqueue.c:2128
 #2: 0000000009ce7a13 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
1 lock held by khungtaskd/461:
 #0: 00000000a5a5a581 (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4435
1 lock held by rsyslogd/5363:
 #0: 00000000d7cb882a (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200 fs/file.c:766
2 locks held by getty/5485:
 #0: 0000000055a884ca (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000027982e5c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/5486:
 #0: 000000001229f874 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000074efc3d2 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/5487:
 #0: 00000000db5acef8 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 000000008c652867 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/5488:
 #0: 000000003958ab01 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 000000000760859a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/5489:
 #0: 0000000090021b97 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000e50311bb (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/5490:
 #0: 00000000eeb6d0ef (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 00000000004f2a4a (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
2 locks held by getty/5491:
 #0: 00000000d70613e8 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353
 #1: 0000000072dd7762 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1ce0 drivers/tty/n_tty.c:2140
3 locks held by kworker/0:0/21796:
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: __write_once_size include/linux/compiler.h:215 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: 00000000d712a122 ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: process_one_work+0xb43/0x1b90 kernel/workqueue.c:2124
 #1: 0000000012e1287e ((addr_chk_work).work){+.+.}, at: process_one_work+0xb9a/0x1b90 kernel/workqueue.c:2128
 #2: 0000000009ce7a13 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
2 locks held by syz-executor3/4119:
1 lock held by syz-executor3/4136:
2 locks held by syz-executor2/4144:
1 lock held by syz-executor2/4157:
3 locks held by syz-executor2/4177:
1 lock held by syz-executor0/13178:
 #0: 0000000009ce7a13 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77
1 lock held by syz-executor0/13213:
3 locks held by kworker/1:4/13215:
 #0: 00000000df752126 ((wq_completion)"events"){+.+.}, at: __write_once_size include/linux/compiler.h:215 [inline]
 #0: 00000000df752126 ((wq_completion)"events"){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: 00000000df752126 ((wq_completion)"events"){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline]
 #0: 00000000df752126 ((wq_completion)"events"){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline]
 #0: 00000000df752126 ((wq_completion)"events"){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline]
 #0: 00000000df752126 ((wq_completion)"events"){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline]
 #0: 00000000df752126 ((wq_completion)"events"){+.+.}, at: process_one_work+0xb43/0x1b90 kernel/workqueue.c:2124
 #1: 0000000008ea6e53 (deferred_process_work){+.+.}, at: process_one_work+0xb9a/0x1b90 kernel/workqueue.c:2128
 #2: 0000000009ce7a13 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 461 Comm: khungtaskd Not tainted 4.19.0-rc8+ #72
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
 nmi_cpu_backtrace.cold.3+0x63/0xa2 lib/nmi_backtrace.c:101
 nmi_trigger_cpumask_backtrace+0x1b3/0x1ed lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
 trigger_all_cpu_backtrace include/linux/nmi.h:144 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline]
 watchdog+0xb3e/0x1050 kernel/hung_task.c:265
 kthread+0x35a/0x420 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4136 Comm: syz-executor3 Not tainted 4.19.0-rc8+ #72
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:debug_lockdep_rcu_enabled+0x68/0x90 kernel/rcu/update.c:252
Code: 00 e0 6f 89 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 1c <8b> 05 32 47 08 08 85 c0 74 07 e8 29 ff ff ff 5d c3 31 c0 5d c3 e8
RSP: 0018:ffff8801b7b2f5d8 EFLAGS: 00000297
RAX: 0000000000000003 RBX: ffff8801c7788080 RCX: ffffffff8340e248
RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff896fe000
RBP: ffff8801b7b2f5d8 R08: ffff8801c7788080 R09: 1ffffffff1273955
R10: ffffed003b5e4732 R11: ffff8801daf23993 R12: 1ffff10036f65ebe
R13: 0000000000000000 R14: ffffffff883999a0 R15: 000000000000011d
FS:  00007f2e843de700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 0000000197067000 CR4: 00000000001426e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 ___might_sleep+0x84/0x300 kernel/sched/core.c:6108
 __might_sleep+0x95/0x190 kernel/sched/core.c:6096
 __inode_security_revalidate+0xfe/0x120 security/selinux/hooks.c:285
 inode_security security/selinux/hooks.c:322 [inline]
 selinux_file_permission+0x13a/0x540 security/selinux/hooks.c:3550
 security_file_permission+0x58/0x230 security/security.c:875
 rw_verify_area+0x111/0x360 fs/read_write.c:391
 do_iter_write+0x101/0x5f0 fs/read_write.c:954
 vfs_iter_write+0x77/0xb0 fs/read_write.c:972
 iter_file_splice_write+0x90d/0x1050 fs/splice.c:750
 do_splice_from fs/splice.c:852 [inline]
 direct_splice_actor+0x128/0x190 fs/splice.c:1019
 splice_direct_to_actor+0x318/0x8f0 fs/splice.c:974
 do_splice_direct+0x2d4/0x420 fs/splice.c:1062
 do_sendfile+0x62a/0xe20 fs/read_write.c:1440
 __do_sys_sendfile64 fs/read_write.c:1495 [inline]
 __se_sys_sendfile64 fs/read_write.c:1487 [inline]
 __x64_sys_sendfile64+0x15d/0x250 fs/read_write.c:1487
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f2e843ddc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000457569
RDX: 0000000020002780 RSI: 0000000000000004 RDI: 0000000000000003
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 00008000fffffffe R11: 0000000000000246 R12: 00007f2e843de6d4
R13: 00000000004c34d0 R14: 00000000004d5298 R15: 00000000ffffffff

All crashes (5):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Maintainers
ci-upstream-kasan-gce-selinux-root	2018/10/20 09:12	upstream	270b77a0	ecb386fe	.config	log	report	christian.brauner@ubuntu.com, davem@davemloft.net, fw@strlen.de, jakub.kicinski@netronome.com, jbenc@redhat.com, ktkhai@virtuozzo.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, stephen@networkplumber.org
ci-upstream-kasan-gce-selinux-root	2018/10/04 15:37	upstream	cec4de30	8b311eaf	.config	log	report	christian.brauner@ubuntu.com, davem@davemloft.net, dsahern@gmail.com, fw@strlen.de, jakub.kicinski@netronome.com, jbenc@redhat.com, ktkhai@virtuozzo.com, linux-kernel@vger.kernel.org, lucien.xin@gmail.com, netdev@vger.kernel.org, nicolas.dichtel@6wind.com
ci-upstream-net-this-kasan-gce	2018/10/28 17:55	net	6788fac8	6f9b225a	.config	log	report	christian@brauner.io, davem@davemloft.net, dsahern@gmail.com, fw@strlen.de, jakub.kicinski@netronome.com, jbenc@redhat.com, ktkhai@virtuozzo.com, linux-kernel@vger.kernel.org, netdev@vger.kernel.org
ci-upstream-net-this-kasan-gce	2018/09/30 07:11	net	43955a45	41e4b329	.config	log	report	christian.brauner@ubuntu.com, davem@davemloft.net, dsahern@gmail.com, fw@strlen.de, jakub.kicinski@netronome.com, jbenc@redhat.com, ktkhai@virtuozzo.com, linux-kernel@vger.kernel.org, lucien.xin@gmail.com, netdev@vger.kernel.org, nicolas.dichtel@6wind.com
ci-upstream-net-kasan-gce	2018/03/30 16:13	net-next	18845557	d47f0ed6	.config	log	report	christian.brauner@ubuntu.com, davem@davemloft.net, dsahern@gmail.com, fw@strlen.de, jbenc@redhat.com, ktkhai@virtuozzo.com, linux-kernel@vger.kernel.org, lucien.xin@gmail.com, netdev@vger.kernel.org, vyasevich@gmail.com