IPv6: Can't replace route, no match found INFO: task syz-executor0:11224 blocked for more than 140 seconds. Not tainted 4.9.130+ #49 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor0 D28824 11224 2125 0x80000000 ffff8801a2f95f00 ffff8801a2afb180 ffff8801a2afb180 ffff8801d1a25f00 ffff8801db721018 ffff8801ce92fb10 ffffffff827f2da2 ffff8801ce92fae8 ffffffff812068a7 0000000000000000 00ff8801a2f967a8 ffff8801db7218f0 Call Trace: [] schedule+0x7f/0x1b0 kernel/sched/core.c:3553 [] rwsem_down_read_failed+0x26c/0x400 kernel/locking/rwsem-xadd.c:260 [] call_rwsem_down_read_failed+0x18/0x30 arch/x86/lib/rwsem.S:94 [] __down_read arch/x86/include/asm/rwsem.h:65 [inline] [] down_read+0x52/0xb0 kernel/locking/rwsem.c:24 [] exit_mm kernel/exit.c:480 [inline] [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 [] do_group_exit+0x111/0x300 kernel/exit.c:937 [] SYSC_exit_group kernel/exit.c:948 [inline] [] SyS_exit_group+0x1d/0x20 kernel/exit.c:946 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Showing all locks held in the system: 2 locks held by khungtaskd/24: #0: (rcu_read_lock){......}, at: [] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 kernel/hung_task.c:239 #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336 2 locks held by getty/2032: #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367 #1: (&ldata->atomic_read_lock){+.+.+.}, at: [] n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142 1 lock held by syz-executor0/11224: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 1 lock held by syz-executor0/11226: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 1 lock held by syz-executor0/11232: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 1 lock held by syz-executor0/11236: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 1 lock held by syz-executor0/11237: #0: (&mm->mmap_sem){++++++}, at: [] exit_mm kernel/exit.c:480 [inline] #0: (&mm->mmap_sem){++++++}, at: [] do_exit+0x3c1/0x29d0 kernel/exit.c:820 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.130+ #49 ffff8801d9907d08 ffffffff81b36ca9 0000000000000000 0000000000000001 0000000000000001 0000000000000001 ffffffff81098180 ffff8801d9907d40 ffffffff81b41db9 0000000000000001 0000000000000000 0000000000000003 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] nmi_cpu_backtrace.cold.0+0x48/0x87 lib/nmi_backtrace.c:99 [] nmi_trigger_cpumask_backtrace+0x12c/0x151 lib/nmi_backtrace.c:60 [] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37 [] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline] [] check_hung_task kernel/hung_task.c:125 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline] [] watchdog+0x6ad/0xa20 kernel/hung_task.c:239 [] kthread+0x26d/0x300 kernel/kthread.c:211 [] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 11238 Comm: syz-executor0 Not tainted 4.9.130+ #49 task: ffff8801a2d9af80 task.stack: ffff88019fd60000 RIP: 0010:[] c [] debug_lockdep_rcu_enabled.part.0+0x2a/0x60 kernel/rcu/update.c:265 RSP: 0018:ffff88019fd67aa8 EFLAGS: 00000807 RAX: dffffc0000000000 RBX: ffff8801a2d9af80 RCX: 1ffffffff05ce880 RDX: 0000000000000000 RSI: ffffffff81b9bafb RDI: ffff8801a2d9b82c RBP: ffff88019fd67ab0 R08: ffff8801a2d9b878 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff827fbbd9 R13: ffff8801d83d80e8 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007fedf7b35700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000232e000 CR3: 00000001d2402000 CR4: 00000000001606b0 DR0: 0001000000000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Stack: ffff8801c9be71c0c ffff88019fd67ac0c ffffffff812434c7c ffff88019fd67b78c ffffffff8120ce63c ffff8801a2d9af80c ffffffff827f6ff7c ffffffff841eb840c 0000000000000246c ffff8801c9be7168c ffff88019fd67b18c ffffffff81206c9bc Call Trace: [] debug_lockdep_rcu_enabled+0x77/0x90 kernel/rcu/update.c:264 [] trace_lock_release include/trace/events/lock.h:57 [inline] [] lock_release+0x7e3/0xc20 kernel/locking/lockdep.c:3774 [] __mutex_unlock_common_slowpath kernel/locking/mutex.c:740 [inline] [] __mutex_unlock_slowpath+0x160/0x3c0 kernel/locking/mutex.c:765 [] mutex_unlock+0x9/0x10 kernel/locking/mutex.c:437 [] perf_mmap+0x64a/0x1430 kernel/events/core.c:5278 [] mmap_region+0x80c/0xf90 mm/mmap.c:1726 [] do_mmap+0x53d/0xbb0 mm/mmap.c:1505 [] do_mmap_pgoff include/linux/mm.h:2032 [inline] [] vm_mmap_pgoff+0x168/0x1b0 mm/util.c:329 [] SYSC_mmap_pgoff mm/mmap.c:1555 [inline] [] SyS_mmap_pgoff+0xfe/0x1b0 mm/mmap.c:1513 [] SYSC_mmap arch/x86/kernel/sys_x86_64.c:96 [inline] [] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:87 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: cff c48 cb8 c00 c00 c00 c00 c00 cfc cff cdf c55 c48 c89 ce5 c53 c65 c48 c8b c1c c25 c00 c7e c01 c00 c48 c8d cbb cac c08 c00 c00 c48 c89 cfa c48 cc1 cea c03 c0f cb6 c14 c02 c<48> c89 cf8 c83 ce0 c07 c83 cc0 c03 c38 cd0 c7c c04 c84 cd2 c75 c10 c8b c93 cac c08 c