INFO: task syz-executor.2:11054 blocked for more than 143 seconds. Not tainted 6.1.0-syzkaller-11835-g0471005efac9 #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.2 state:D stack:25120 pid:11054 ppid:5106 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0xb8a/0x5450 kernel/sched/core.c:6555 schedule+0xde/0x1b0 kernel/sched/core.c:6631 __lock_sock+0x141/0x260 net/core/sock.c:2904 lock_sock_nested+0xda/0xf0 net/core/sock.c:3475 __mptcp_close_ssk+0x19e/0x780 net/mptcp/protocol.c:2322 mptcp_destroy_common+0x169/0x650 net/mptcp/protocol.c:3152 mptcp_disconnect+0xb7/0x450 net/mptcp/protocol.c:3003 __inet_stream_connect+0xc95/0xed0 net/ipv4/af_inet.c:717 tcp_sendmsg_fastopen+0x3c4/0x710 net/ipv4/tcp.c:1200 mptcp_sendmsg_fastopen net/mptcp/protocol.c:1676 [inline] mptcp_sendmsg+0x1359/0x1910 net/mptcp/protocol.c:1715 inet6_sendmsg+0x9d/0xe0 net/ipv6/af_inet6.c:660 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 ____sys_sendmsg+0x334/0x8c0 net/socket.c:2476 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2530 __sys_sendmmsg+0x18f/0x460 net/socket.c:2616 __do_sys_sendmmsg net/socket.c:2645 [inline] __se_sys_sendmmsg net/socket.c:2642 [inline] __x64_sys_sendmmsg+0x9d/0x100 net/socket.c:2642 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd659c8c0c9 RSP: 002b:00007fd65a921168 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007fd659dac120 RCX: 00007fd659c8c0c9 RDX: 0000000000000001 RSI: 0000000020008b40 RDI: 0000000000000005 RBP: 00007fd659ce7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020080040 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff09c1126f R14: 00007fd65a921300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8c790d70 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 kernel/rcu/tasks.h:507 1 lock held by rcu_tasks_trace/13: #0: ffffffff8c790a70 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 kernel/rcu/tasks.h:507 1 lock held by khungtaskd/28: #0: ffffffff8c7918c0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x57/0x264 kernel/locking/lockdep.c:6494 5 locks held by kworker/u4:2/33: #0: ffff8880125df938 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880125df938 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff8880125df938 ((wq_completion)netns){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline] #0: ffff8880125df938 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline] #0: ffff8880125df938 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline] #0: ffff8880125df938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x86d/0x1710 kernel/workqueue.c:2260 #1: ffffc90000aa7da8 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1710 kernel/workqueue.c:2264 #2: ffffffff8e0aa750 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9f/0xb10 net/core/net_namespace.c:568 #3: ffffffff8e0be3e8 (rtnl_mutex){+.+.}-{3:3}, at: ip6gre_exit_batch_net+0x8c/0x760 net/ipv6/ip6_gre.c:1636 #4: ffffffff8c79c578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline] #4: ffffffff8c79c578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x5df/0x780 kernel/rcu/tree_exp.h:946 2 locks held by kworker/u4:5/1034: 2 locks held by getty/4751: #0: ffff888027427098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x26/0x80 drivers/tty/tty_ldisc.c:244 #1: ffffc900015b02f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xef4/0x13e0 drivers/tty/n_tty.c:2177 2 locks held by kworker/0:18/9959: #0: ffff888012472538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888012472538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888012472538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1280 [inline] #0: ffff888012472538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:636 [inline] #0: ffff888012472538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:663 [inline] #0: ffff888012472538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x86d/0x1710 kernel/workqueue.c:2260 #1: ffffc90003c47da8 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x8a1/0x1710 kernel/workqueue.c:2264 3 locks held by syz-executor.2/11054: #0: ffff88807dc9bd30 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1725 [inline] #0: ffff88807dc9bd30 (sk_lock-AF_INET6){+.+.}-{0:0}, at: mptcp_sendmsg+0xce/0x1910 net/mptcp/protocol.c:1708 #1: ffff88804cb473f0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1725 [inline] #1: ffff88804cb473f0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: mptcp_sendmsg_fastopen net/mptcp/protocol.c:1672 [inline] #1: ffff88804cb473f0 (k-sk_lock-AF_INET6){+.+.}-{0:0}, at: mptcp_sendmsg+0x1296/0x1910 net/mptcp/protocol.c:1715 #2: ffff88804cb473f0 (k-sk_lock-AF_INET6/1){+.+.}-{0:0}, at: __mptcp_close_ssk+0x19e/0x780 net/mptcp/protocol.c:2322 1 lock held by syz-executor.2/12466: 3 locks held by syz-executor.5/12465: 2 locks held by syz-executor.3/12475: #0: ffffffff8e0aa750 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2f8/0x6b0 net/core/net_namespace.c:479 #1: ffffffff8e0be3e8 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_init_net+0x2dd/0x9f0 net/ipv4/ip_tunnel.c:1072 2 locks held by syz-executor.0/12483: #0: ffff888047c78210 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:756 [inline] #0: ffff888047c78210 (&sb->s_type->i_mutex_key#10){+.+.}-{3:3}, at: __sock_release+0x86/0x280 net/socket.c:649 #1: ffffffff8c79c578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline] #1: ffffffff8c79c578 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x24f/0x780 kernel/rcu/tree_exp.h:946 1 lock held by syz-executor.4/12486: #0: ffff888028c56198 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #0: ffff888028c56198 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x159/0x280 mm/util.c:518 2 locks held by syz-executor.4/12487: #0: ffffffff8e0aa750 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2f8/0x6b0 net/core/net_namespace.c:479 #1: ffffffff8e0be3e8 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:805 [inline] #1: ffffffff8e0be3e8 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x218/0x470 net/smc/smc_pnet.c:874 1 lock held by syz-executor.4/12488: 1 lock held by syz-executor.1/12489: #0: ffff88807e592458 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #0: ffff88807e592458 (&mm->mmap_lock){++++}-{3:3}, at: vm_mmap_pgoff+0x159/0x280 mm/util.c:518 2 locks held by syz-executor.1/12490: #0: ffffffff8e0aa750 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x2f8/0x6b0 net/core/net_namespace.c:479 #1: ffffffff8e0be3e8 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_create_pnetids_list net/smc/smc_pnet.c:805 [inline] #1: ffffffff8e0be3e8 (rtnl_mutex){+.+.}-{3:3}, at: smc_pnet_net_init+0x218/0x470 net/smc/smc_pnet.c:874 3 locks held by syz-executor.1/12491: ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 28 Comm: khungtaskd Not tainted 6.1.0-syzkaller-11835-g0471005efac9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x24/0x18a lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x333/0x3c0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xc75/0xfc0 kernel/hung_task.c:377 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 2414 Comm: kworker/u4:6 Not tainted 6.1.0-syzkaller-11835-g0471005efac9 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: phy9 ieee80211_iface_work RIP: 0010:__sanitizer_cov_trace_switch+0x8/0x90 kernel/kcov.c:317 Code: 00 00 f3 0f 1e fa 48 8b 0c 24 48 89 f2 48 89 fe bf 07 00 00 00 e9 78 fe ff ff 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 41 56 41 55 <41> 54 49 89 fc 55 48 89 f5 53 48 8b 46 08 48 83 f8 20 74 63 77 44 RSP: 0018:ffffc9000aa4f560 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 0000000000000032 RCX: 0000000000000000 RDX: ffff8880264a0000 RSI: ffffffff8b7c7820 RDI: 0000000000000032 RBP: ffff888078c3088d R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000094001 R12: dffffc0000000000 R13: ffff888078c3088e R14: 0000000000000032 R15: 0000000000000004 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002015e030 CR3: 000000004820c000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: _ieee802_11_parse_elems_full+0x2ec/0x3130 net/mac80211/util.c:1121 ieee802_11_parse_elems_full+0x77b/0x1330 net/mac80211/util.c:1674 ieee802_11_parse_elems_crc.constprop.0+0x99/0xd0 net/mac80211/ieee80211_i.h:2260 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2267 [inline] ieee80211_bss_info_update+0x410/0xaf0 net/mac80211/scan.c:212 ieee80211_rx_bss_info net/mac80211/ibss.c:1120 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1609 [inline] ieee80211_ibss_rx_queued_mgmt+0x19fc/0x3160 net/mac80211/ibss.c:1638 ieee80211_iface_process_skb net/mac80211/iface.c:1581 [inline] ieee80211_iface_work+0xa4d/0xd70 net/mac80211/iface.c:1635 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308