syzbot


INFO: task hung in nl80211_pre_doit

Status: auto-closed as invalid on 2021/05/17 09:21
Subsystems: wireless
[Documentation on labels]
First crash: 1341d, last: 1263d
Similar bugs (6)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in rtnetlink_rcv_msg net C inconclusive inconclusive 1970 14d 1977d 27/27 fixed on 2024/07/09 19:14
linux-4.19 INFO: task hung in nl80211_pre_doit 1 922d 922d 0/1 auto-closed as invalid on 2022/05/13 08:55
upstream INFO: task hung in nl80211_pre_doit (2) wireless 18 1008d 1048d 0/27 auto-closed as invalid on 2022/01/17 00:54
linux-5.15 INFO: task hung in nl80211_pre_doit 9 19d 59d 0/3 upstream: reported on 2024/05/24 13:56
linux-4.19 INFO: task hung in nl80211_pre_doit (2) 1 570d 570d 0/1 upstream: reported on 2022/12/31 06:52
linux-6.1 INFO: task hung in nl80211_pre_doit 7 32d 60d 0/3 upstream: reported on 2024/05/24 07:02

Sample crash report:
INFO: task syz-executor.3:11824 blocked for more than 143 seconds.
      Not tainted 5.11.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3  state:D stack:27616 pid:11824 ppid:  8478 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x90c/0x21a0 kernel/sched/core.c:5078
 schedule+0xcf/0x270 kernel/sched/core.c:5157
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:5216
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x81a/0x1110 kernel/locking/mutex.c:1103
 nl80211_pre_doit+0x34f/0x630 net/wireless/nl80211.c:14659
 genl_family_rcv_msg_doit+0x1ee/0x320 net/netlink/genetlink.c:734
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x465b09
RSP: 002b:00007f3f99f7f188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
RDX: 0000000000000000 RSI: 0000000020001280 RDI: 0000000000000003
RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffeeec2ec9f R14: 00007f3f99f7f300 R15: 0000000000022000
INFO: task syz-executor.3:11827 blocked for more than 144 seconds.
      Not tainted 5.11.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.3  state:D stack:27616 pid:11827 ppid:  8478 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x90c/0x21a0 kernel/sched/core.c:5078
 schedule+0xcf/0x270 kernel/sched/core.c:5157
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:5216
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x81a/0x1110 kernel/locking/mutex.c:1103
 nl80211_pre_doit+0x34f/0x630 net/wireless/nl80211.c:14659
 genl_family_rcv_msg_doit+0x1ee/0x320 net/netlink/genetlink.c:734
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2345
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2399
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2432
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x465b09
RSP: 002b:00007f3f99f5e188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000465b09
RDX: 0000000000000000 RSI: 0000000020001280 RDI: 0000000000000004
RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008
R13: 00007ffeeec2ec9f R14: 00007f3f99f5e300 R15: 0000000000022000
INFO: task syz-executor.0:11831 blocked for more than 144 seconds.
      Not tainted 5.11.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:29664 pid:11831 ppid:  8472 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x90c/0x21a0 kernel/sched/core.c:5078
 schedule+0xcf/0x270 kernel/sched/core.c:5157
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:5216
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x81a/0x1110 kernel/locking/mutex.c:1103
 register_netdevice_notifier+0x23/0x260 net/core/dev.c:1822
 raw_init+0x296/0x340 net/can/raw.c:337
 can_create+0x27c/0x4d0 net/can/af_can.c:168
 __sock_create+0x3de/0x780 net/socket.c:1406
 sock_create net/socket.c:1457 [inline]
 __sys_socket+0xef/0x200 net/socket.c:1499
 __do_sys_socket net/socket.c:1508 [inline]
 __se_sys_socket net/socket.c:1506 [inline]
 __x64_sys_socket+0x6f/0xb0 net/socket.c:1506
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x465b09
RSP: 002b:00007f141cc11188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
RDX: 0000000000000001 RSI: 0000000000000003 RDI: 000000000000001d
RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffd65641bff R14: 00007f141cc11300 R15: 0000000000022000
INFO: task syz-executor.0:11837 blocked for more than 144 seconds.
      Not tainted 5.11.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.0  state:D stack:29664 pid:11837 ppid:  8472 flags:0x00000004
Call Trace:
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x90c/0x21a0 kernel/sched/core.c:5078
 schedule+0xcf/0x270 kernel/sched/core.c:5157
 rwsem_down_write_slowpath+0x7e5/0x1200 kernel/locking/rwsem.c:1106
 __down_write_common kernel/locking/rwsem.c:1261 [inline]
 __down_write_common kernel/locking/rwsem.c:1258 [inline]
 __down_write kernel/locking/rwsem.c:1270 [inline]
 down_write+0x132/0x150 kernel/locking/rwsem.c:1407
 register_netdevice_notifier+0x1e/0x260 net/core/dev.c:1821
 raw_init+0x296/0x340 net/can/raw.c:337
 can_create+0x27c/0x4d0 net/can/af_can.c:168
 __sock_create+0x3de/0x780 net/socket.c:1406
 sock_create net/socket.c:1457 [inline]
 __sys_socket+0xef/0x200 net/socket.c:1499
 __do_sys_socket net/socket.c:1508 [inline]
 __se_sys_socket net/socket.c:1506 [inline]
 __x64_sys_socket+0x6f/0xb0 net/socket.c:1506
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x465b09
RSP: 002b:00007f141cbf0188 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000465b09
RDX: 0000000000000001 RSI: 0000000000000003 RDI: 000000000000001d
RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008
R13: 00007ffd65641bff R14: 00007f141cbf0300 R15: 0000000000022000
INFO: task syz-executor.4:11830 blocked for more than 145 seconds.
      Not tainted 5.11.0-rc6-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor.4  state:D stack:29664 pid:11830 ppid:  8480 flags:0x00004004
Call Trace:
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x90c/0x21a0 kernel/sched/core.c:5078
 schedule+0xcf/0x270 kernel/sched/core.c:5157
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:5216
 __mutex_lock_common kernel/locking/mutex.c:1033 [inline]
 __mutex_lock+0x81a/0x1110 kernel/locking/mutex.c:1103
 dev_ioctl+0x1a3/0xc40 net/core/dev_ioctl.c:510
 sock_do_ioctl+0x148/0x2d0 net/socket.c:1060
 sock_ioctl+0x477/0x6a0 net/socket.c:1177
 vfs_ioctl fs/ioctl.c:48 [inline]
 __do_sys_ioctl fs/ioctl.c:753 [inline]
 __se_sys_ioctl fs/ioctl.c:739 [inline]
 __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x465b09
RSP: 002b:00007f47dbc83188 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465b09
RDX: 0000000020000040 RSI: 0000000000008990 RDI: 0000000000000003
RBP: 00000000004b069f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007fff82c0949f R14: 00007f47dbc83300 R15: 0000000000022000

Showing all locks held in the system:
1 lock held by khungtaskd/1658:
 #0: ffffffff8bd73da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6259
3 locks held by kworker/0:3/3204:
 #0: ffff888147907538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
 #0: ffff888147907538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline]
 #0: ffff888147907538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline]
 #0: ffff888147907538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline]
 #0: ffff888147907538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline]
 #0: ffff888147907538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x871/0x15f0 kernel/workqueue.c:2246
 #1: ffffc9000200fda8 ((addr_chk_work).work){+.+.}-{0:0}, at: process_one_work+0x8a5/0x15f0 kernel/workqueue.c:2250
 #2: ffffffff8d4590e8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0xa/0x20 net/ipv6/addrconf.c:4570
1 lock held by in:imklog/8221:
 #0: ffff888011d05c70 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:947
1 lock held by syz-executor.5/11810:
2 locks held by syz-executor.3/11824:
 #0: ffffffff8d4e8190 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:810
 #1: ffffffff8d4590e8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x34f/0x630 net/wireless/nl80211.c:14659
2 locks held by syz-executor.3/11827:
 #0: ffffffff8d4e8190 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:810
 #1: ffffffff8d4590e8 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x34f/0x630 net/wireless/nl80211.c:14659
2 locks held by syz-executor.0/11831:
 #0: ffffffff8d445c90 (pernet_ops_rwsem){++++}-{3:3}, at: register_netdevice_notifier+0x1e/0x260 net/core/dev.c:1821
 #1: ffffffff8d4590e8 (rtnl_mutex){+.+.}-{3:3}, at: register_netdevice_notifier+0x23/0x260 net/core/dev.c:1822
1 lock held by syz-executor.0/11837:
 #0: ffffffff8d445c90 (pernet_ops_rwsem){++++}-{3:3}, at: register_netdevice_notifier+0x1e/0x260 net/core/dev.c:1821
1 lock held by syz-executor.4/11830:
 #0: ffffffff8d4590e8 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x1a3/0xc40 net/core/dev_ioctl.c:510

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 1658 Comm: khungtaskd Not tainted 5.11.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline]
 watchdog+0xd43/0xfa0 kernel/hung_task.c:294
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 169 Comm: kworker/u4:4 Not tainted 5.11.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
RIP: 0010:rcu_dynticks_curr_cpu_in_eqs kernel/rcu/tree.c:319 [inline]
RIP: 0010:rcu_is_watching+0x3d/0xc0 kernel/rcu/tree.c:1113
Code: 03 00 83 f8 07 89 c5 0f 87 81 00 00 00 48 8d 3c ed c0 f6 e6 8a 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <75> 5b 48 03 1c ed c0 f6 e6 8a 48 b8 00 00 00 00 00 fc ff df 48 8d
RSP: 0018:ffffc90000e3faa8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000035a80 RCX: ffffffff8158bc61
RDX: 1ffffffff15cded9 RSI: 0000000000000002 RDI: ffffffff8ae6f6c8
RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff8da38a4f
R10: fffffbfff1b47149 R11: 0000000000000000 R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88805cb6cbc0 R15: 000000000000010f
FS:  0000000000000000(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f84ce2f0018 CR3: 0000000025954000 CR4: 00000000001506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 rcu_read_lock_held_common kernel/rcu/update.c:106 [inline]
 rcu_read_lock_sched_held+0x1c/0x70 kernel/rcu/update.c:121
 trace_lock_release include/trace/events/lock.h:58 [inline]
 lock_release+0x5b7/0x710 kernel/locking/lockdep.c:5453
 rcu_lock_release include/linux/rcupdate.h:264 [inline]
 rcu_read_unlock include/linux/rcupdate.h:702 [inline]
 batadv_iv_ogm_slide_own_bcast_window net/batman-adv/bat_iv_ogm.c:771 [inline]
 batadv_iv_ogm_schedule_buff+0x7a6/0x1410 net/batman-adv/bat_iv_ogm.c:825
 batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:869 [inline]
 batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:862 [inline]
 batadv_iv_send_outstanding_bat_ogm_packet+0x675/0x920 net/batman-adv/bat_iv_ogm.c:1723
 process_one_work+0x98d/0x15f0 kernel/workqueue.c:2275
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2021/02/05 10:36 net-old 7b5eab57cac4 23a562df .config console log report info ci-upstream-net-this-kasan-gce INFO: task hung in nl80211_pre_doit
2021/02/05 10:28 net-next-old 9c97921a51a0 23a562df .config console log report info ci-upstream-net-kasan-gce INFO: task hung in nl80211_pre_doit
2020/12/31 18:04 upstream f6e1ea196492 79264ae3 .config console log report info ci-upstream-kasan-gce
2020/11/28 00:54 net-next-old fb3158ea612c 486f93ef .config console log report info ci-upstream-net-kasan-gce
2020/11/20 03:41 net-next-old 657bc1d10bfc 0767f13f .config console log report info ci-upstream-net-kasan-gce
* Struck through repros no longer work on HEAD.