[ OK ] Reached target Login Prompts. [ OK ] Reached target Multi-User System. [ OK ] Reached target Graphical Interface. Starting Update UTMP about System Runlevel Changes... [ OK ] Started Update UTMP about System Runlevel Changes. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.75' (ECDSA) to the list of known hosts. executing program executing program executing program syzkaller login: [ 476.584824] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready [ 476.614438] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 638.279391] INFO: task kworker/0:1:14 blocked for more than 140 seconds. [ 638.286506] Not tainted 4.19.157-syzkaller #0 [ 638.294965] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 638.304299] kworker/0:1 D26552 14 2 0x80000000 [ 638.311158] Workqueue: events linkwatch_event [ 638.315744] Call Trace: [ 638.318501] __schedule+0x887/0x2040 [ 638.325199] ? io_schedule_timeout+0x140/0x140 [ 638.330949] ? lock_downgrade+0x720/0x720 [ 638.335226] ? __mutex_lock+0x458/0x1260 [ 638.340761] schedule+0x8d/0x1b0 [ 638.344158] schedule_preempt_disabled+0xf/0x20 [ 638.350901] __mutex_lock+0x647/0x1260 [ 638.354904] ? linkwatch_event+0xb/0x60 [ 638.358905] ? __mutex_add_waiter+0x160/0x160 [ 638.365309] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 638.371647] ? process_one_work+0x77b/0x1570 [ 638.376186] ? check_preemption_disabled+0x41/0x280 [ 638.382649] linkwatch_event+0xb/0x60 [ 638.386485] process_one_work+0x864/0x1570 [ 638.392273] ? pwq_dec_nr_in_flight+0x2d0/0x2d0 [ 638.397201] worker_thread+0x64c/0x1130 [ 638.403164] ? __kthread_parkme+0x133/0x1e0 [ 638.408710] ? process_one_work+0x1570/0x1570 [ 638.414894] kthread+0x33f/0x460 [ 638.418393] ? kthread_park+0x180/0x180 [ 638.424678] ret_from_fork+0x24/0x30 [ 638.428863] INFO: task kworker/0:0:8130 blocked for more than 140 seconds. [ 638.437692] Not tainted 4.19.157-syzkaller #0 [ 638.445200] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 638.454580] kworker/0:0 D27416 8130 2 0x80000000 [ 638.461815] Workqueue: ipv6_addrconf addrconf_dad_work [ 638.467374] Call Trace: [ 638.471923] __schedule+0x887/0x2040 [ 638.475706] ? io_schedule_timeout+0x140/0x140 [ 638.481719] ? lock_downgrade+0x720/0x720 [ 638.485916] ? __mutex_lock+0x458/0x1260 [ 638.491382] schedule+0x8d/0x1b0 [ 638.494800] schedule_preempt_disabled+0xf/0x20 [ 638.500962] __mutex_lock+0x647/0x1260 [ 638.504930] ? addrconf_dad_work+0x9c/0x10a0 [ 638.511342] ? __mutex_add_waiter+0x160/0x160 [ 638.515894] ? lock_downgrade+0x720/0x720 [ 638.521677] ? lock_acquire+0x170/0x3c0 [ 638.525810] ? debug_object_deactivate+0xfc/0x2e0 [ 638.532638] ? trace_hardirqs_off+0x64/0x200 [ 638.537097] ? _raw_spin_unlock_irqrestore+0x66/0xe0 [ 638.544018] addrconf_dad_work+0x9c/0x10a0 [ 638.548296] ? addrconf_dad_completed+0xb60/0xb60 [ 638.555671] process_one_work+0x864/0x1570 [ 638.560981] ? pwq_dec_nr_in_flight+0x2d0/0x2d0 [ 638.565700] worker_thread+0x64c/0x1130 [ 638.571185] ? __kthread_parkme+0x133/0x1e0 [ 638.575595] ? process_one_work+0x1570/0x1570 [ 638.582200] kthread+0x33f/0x460 [ 638.585622] ? kthread_park+0x180/0x180 [ 638.591053] ret_from_fork+0x24/0x30 [ 638.594902] [ 638.594902] Showing all locks held in the system: [ 638.603055] 3 locks held by kworker/0:1/14: [ 638.607409] #0: 00000000e55d9845 ((wq_completion)"events"){+.+.}, at: process_one_work+0x767/0x1570 [ 638.618330] #1: 00000000489dd410 ((linkwatch_work).work){+.+.}, at: process_one_work+0x79c/0x1570 [ 638.629011] #2: 00000000fb70e3fd (rtnl_mutex){+.+.}, at: linkwatch_event+0xb/0x60 [ 638.637818] 3 locks held by kworker/1:1/25: [ 638.643333] #0: 00000000cf9cbaaa ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: process_one_work+0x767/0x1570 [ 638.656393] #1: 0000000005dfb04d ((addr_chk_work).work){+.+.}, at: process_one_work+0x79c/0x1570 [ 638.666589] #2: 00000000fb70e3fd (rtnl_mutex){+.+.}, at: addrconf_verify_work+0xa/0x20 [ 638.675862] 1 lock held by khungtaskd/1566: [ 638.682079] #0: 0000000035d44def (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 [ 638.691776] 1 lock held by in:imklog/7779: [ 638.696028] #0: 00000000a612ab87 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 [ 638.706232] 3 locks held by kworker/0:0/8130: [ 638.711794] #0: 00000000cf9cbaaa ((wq_completion)"%s"("ipv6_addrconf")){+.+.}, at: process_one_work+0x767/0x1570 [ 638.723267] #1: 000000007c79bb18 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}, at: process_one_work+0x79c/0x1570 [ 638.735866] #2: 00000000fb70e3fd (rtnl_mutex){+.+.}, at: addrconf_dad_work+0x9c/0x10a0 [ 638.745104] 4 locks held by syz-executor805/8150: [ 638.751057] [ 638.752708] ============================================= [ 638.752708] [ 638.761262] NMI backtrace for cpu 0 [ 638.764921] CPU: 0 PID: 1566 Comm: khungtaskd Not tainted 4.19.157-syzkaller #0 [ 638.776917] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 638.786549] Call Trace: [ 638.789224] dump_stack+0x1fc/0x2fe [ 638.792943] nmi_cpu_backtrace.cold+0x63/0xa2 [ 638.797638] ? lapic_can_unplug_cpu.cold+0x39/0x39 [ 638.802628] nmi_trigger_cpumask_backtrace+0x1a6/0x1eb [ 638.808172] watchdog+0x991/0xe60 [ 638.811660] ? reset_hung_task_detector+0x30/0x30 [ 638.816541] kthread+0x33f/0x460 [ 638.820174] ? kthread_park+0x180/0x180 [ 638.824361] ret_from_fork+0x24/0x30 [ 638.828994] Sending NMI from CPU 0 to CPUs 1: [ 638.834983] NMI backtrace for cpu 1 [ 638.834990] CPU: 1 PID: 8150 Comm: syz-executor805 Not tainted 4.19.157-syzkaller #0 [ 638.834996] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 638.835001] RIP: 0010:ieee80211_chanctx_radar_detect+0x258/0x390 [ 638.835012] Code: 00 48 89 f8 48 c1 e8 03 42 0f b6 04 30 84 c0 74 08 3c 03 0f 8e 00 01 00 00 8b 8b 00 10 00 00 b8 01 00 00 00 48 d3 e0 41 09 c4 53 5f a1 f9 48 8d bb f8 07 00 00 48 89 f8 48 c1 e8 03 42 80 3c [ 638.835016] RSP: 0018:ffff88809642f3a0 EFLAGS: 00000246 [ 638.835025] RAX: 0000000000000000 RBX: ffff8880abd40ec0 RCX: ffffffff87c36fce [ 638.835030] RDX: 0000000000000000 RSI: ffff8880b07d6600 RDI: 0000000000000001 [ 638.835035] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 638.835040] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 [ 638.835046] R13: ffff8880ab2c7920 R14: dffffc0000000000 R15: 0000000000000000 [ 638.835051] FS: 0000000000b7c880(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 [ 638.835056] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 638.835061] CR2: 00005588cea94f00 CR3: 00000000a573f000 CR4: 00000000001406e0 [ 638.835066] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 638.835072] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 638.835075] Call Trace: [ 638.835079] ieee80211_check_combinations+0x3b8/0x810 [ 638.835083] ? ieee80211_recalc_dtim+0x240/0x240 [ 638.835088] ieee80211_check_concurrent_iface+0x46d/0x650 [ 638.835092] ieee80211_if_change_type+0x27b/0x5f0 [ 638.835096] ieee80211_change_iface+0x26/0x220 [ 638.835100] cfg80211_change_iface+0x2e1/0x1530 [ 638.835104] nl80211_set_interface+0x661/0x830 [ 638.835108] ? nl80211_nan_del_func+0x8b0/0x8b0 [ 638.835112] ? nl80211_dump_interface+0x6e0/0x6e0 [ 638.835116] ? nl80211_pre_doit+0xa2/0x620 [ 638.835120] ? __cfg80211_rdev_from_attrs+0x700/0x700 [ 638.835124] genl_family_rcv_msg+0x642/0xc40 [ 638.835134] ? genl_rcv+0x40/0x40 [ 638.835138] ? genl_rcv_msg+0x12f/0x160 [ 638.835142] ? __mutex_add_waiter+0x160/0x160 [ 638.835146] ? __radix_tree_lookup+0x216/0x370 [ 638.835150] genl_rcv_msg+0xbf/0x160 [ 638.835153] netlink_rcv_skb+0x160/0x440 [ 638.835157] ? genl_family_rcv_msg+0xc40/0xc40 [ 638.835161] ? netlink_ack+0xae0/0xae0 [ 638.835165] ? genl_rcv+0x15/0x40 [ 638.835168] genl_rcv+0x24/0x40 [ 638.835172] netlink_unicast+0x4d5/0x690 [ 638.835176] ? netlink_sendskb+0x110/0x110 [ 638.835180] ? _copy_from_iter_full+0x229/0x7c0 [ 638.835184] ? __phys_addr_symbol+0x2c/0x70 [ 638.835188] ? __check_object_size+0x17b/0x3d1 [ 638.835192] netlink_sendmsg+0x6bb/0xc40 [ 638.835195] ? aa_af_perm+0x230/0x230 [ 638.835199] ? nlmsg_notify+0x1a0/0x1a0 [ 638.835203] ? kernel_recvmsg+0x220/0x220 [ 638.835207] ? nlmsg_notify+0x1a0/0x1a0 [ 638.835210] sock_sendmsg+0xc3/0x120 [ 638.835214] ___sys_sendmsg+0x7bb/0x8e0 [ 638.835218] ? copy_msghdr_from_user+0x440/0x440 [ 638.835222] ? sock_ioctl+0x30e/0x5d0 [ 638.835226] ? dlci_ioctl_set+0x30/0x30 [ 638.835229] ? lock_downgrade+0x720/0x720 [ 638.835233] ? lock_acquire+0x170/0x3c0 [ 638.835237] ? debug_object_active_state+0x104/0x330 [ 638.835241] ? mark_held_locks+0xf0/0xf0 [ 638.835245] ? dlci_ioctl_set+0x30/0x30 [ 638.835249] ? do_vfs_ioctl+0x110/0x12e0 [ 638.835253] ? ioctl_preallocate+0x200/0x200 [ 638.835256] ? __fdget+0x1a0/0x230 [ 638.835260] __x64_sys_sendmsg+0x132/0x220 [ 638.835264] ? __sys_sendmsg+0x1b0/0x1b0 [ 638.835269] ? entry_SYSCALL_64_after_hwframe+0x3e/0xbe [ 638.835273] ? trace_hardirqs_off_caller+0x6e/0x210 [ 638.835277] ? do_syscall_64+0x21/0x620 [ 638.835280] do_syscall_64+0xf9/0x620 [ 638.835285] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 638.835288] RIP: 0033:0x442449 [ 638.835299] Code: e8 4c ff 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db 06 fc ff c3 66 2e 0f 1f 84 00 00 00 00 [ 638.835303] RSP: 002b:00007ffc13fd0128 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 638.835312] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000442449 [ 638.835317] RDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000004 [ 638.835323] RBP: 000000306e616c77 R08: 00000000004002e0 R09: 00000000004002e0 [ 638.835328] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000402fb0 [ 638.835333] R13: 0000000000403040 R14: 0000000000000000 R15: 0000000000000000 [ 638.835339] INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.239 msecs [ 638.877696] Kernel panic - not syncing: hung_task: blocked tasks [ 639.285774] CPU: 0 PID: 1566 Comm: khungtaskd Not tainted 4.19.157-syzkaller #0 [ 639.293623] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 639.303305] Call Trace: [ 639.306110] dump_stack+0x1fc/0x2fe [ 639.309864] panic+0x26a/0x50e [ 639.313187] ? __warn_printk+0xf3/0xf3 [ 639.317419] ? lapic_can_unplug_cpu.cold+0x39/0x39 [ 639.322683] ? ___preempt_schedule+0x16/0x18 [ 639.327690] ? watchdog+0x991/0xe60 [ 639.331338] ? nmi_trigger_cpumask_backtrace+0x15e/0x1eb [ 639.339400] watchdog+0x9a2/0xe60 [ 639.343413] ? reset_hung_task_detector+0x30/0x30 [ 639.348715] kthread+0x33f/0x460 [ 639.352121] ? kthread_park+0x180/0x180 [ 639.356122] ret_from_fork+0x24/0x30 [ 639.360475] Kernel Offset: disabled [ 639.364140] Rebooting in 86400 seconds..