unregister_netdevice: waiting for lo to become free. Usage count = 6 unregister_netdevice: waiting for lo to become free. Usage count = 6 unregister_netdevice: waiting for lo to become free. Usage count = 6 unregister_netdevice: waiting for lo to become free. Usage count = 6 unregister_netdevice: waiting for lo to become free. Usage count = 6 INFO: task syz-executor2:15698 blocked for more than 120 seconds. Not tainted 4.9.93-gf6bec4e #4 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor2 D30584 15698 3837 0x00000004 ffff8801cca46000 0000000000000000 ffff8801c2d479c0 ffff8801cf44b000 ffff8801db321b98 ffff8801b9d5fbc8 ffffffff838c4a7d ffff8801cca468c0 ffffed0039948d17 ffff8801cca46000 00fffc0000000000 ffff8801db322468 Call Trace: [] schedule+0x7f/0x1b0 kernel/sched/core.c:3556 [] schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3589 [] __mutex_lock_common kernel/locking/mutex.c:582 [inline] [] mutex_lock_nested+0x326/0x870 kernel/locking/mutex.c:621 [] copy_net_ns+0x155/0x290 net/core/net_namespace.c:387 [] create_new_namespaces+0x51c/0x730 kernel/nsproxy.c:106 [] unshare_nsproxy_namespaces+0xa5/0x1d0 kernel/nsproxy.c:205 [] SYSC_unshare kernel/fork.c:2244 [inline] [] SyS_unshare+0x319/0x710 kernel/fork.c:2194 [] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Showing all locks held in the system: 3 locks held by kworker/u4:1/22: #0: ("%s""netns"){.+.+.+}, at: [] work_static include/linux/workqueue.h:186 [inline] #0: ("%s""netns"){.+.+.+}, at: [] set_work_data kernel/workqueue.c:617 [inline] #0: ("%s""netns"){.+.+.+}, at: [] set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline] #0: ("%s""netns"){.+.+.+}, at: [] process_one_work+0x6ee/0x1500 kernel/workqueue.c:2085 #1: (net_cleanup_work){+.+.+.}, at: [] process_one_work+0x728/0x1500 kernel/workqueue.c:2089 #2: (net_mutex){+.+.+.}, at: [] cleanup_net+0x13f/0x630 net/core/net_namespace.c:420 2 locks held by khungtaskd/515: #0: (rcu_read_lock){......}, at: [] check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline] #0: (rcu_read_lock){......}, at: [] watchdog+0x11c/0xa20 kernel/hung_task.c:239 #1: (tasklist_lock){.+.+..}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336 2 locks held by getty/3744: #0: (&tty->ldisc_sem){++++++}, at: [] ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367 #1: (&ldata->atomic_read_lock){+.+...}, at: [] n_tty_read+0x202/0x16b0 drivers/tty/n_tty.c:2133 1 lock held by syz-executor2/15698: #0: (net_mutex){+.+.+.}, at: [] copy_net_ns+0x155/0x290 net/core/net_namespace.c:387 1 lock held by syz-executor2/15734: #0: (net_mutex){+.+.+.}, at: [] copy_net_ns+0x155/0x290 net/core/net_namespace.c:387 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 515 Comm: khungtaskd Not tainted 4.9.93-gf6bec4e #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d87a7d08 ffffffff81d9c299 0000000000000000 0000000000000001 0000000000000001 0000000000000001 ffffffff810b7d90 ffff8801d87a7d40 ffffffff81da75d7 0000000000000001 0000000000000000 0000000000000002 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] nmi_cpu_backtrace.cold.2+0x48/0x87 lib/nmi_backtrace.c:99 [] nmi_trigger_cpumask_backtrace+0x12a/0x14f lib/nmi_backtrace.c:60 [] arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:37 [] trigger_all_cpu_backtrace include/linux/nmi.h:58 [inline] [] check_hung_task kernel/hung_task.c:125 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:182 [inline] [] watchdog+0x6b4/0xa20 kernel/hung_task.c:239 [] kthread+0x26d/0x300 kernel/kthread.c:211 [] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 1 Comm: init Not tainted 4.9.93-gf6bec4e #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801d9ab8000 task.stack: ffff8801d9ac0000 RIP: 0010:[] c [] mark_lock+0xb7/0x1280 kernel/locking/lockdep.c:3039 RSP: 0018:ffff8801d9ac7908 EFLAGS: 00000002 RAX: dffffc0000000000 RBX: ffff8801d9ab88c0 RCX: 1ffff1003b35711c RDX: 1ffffffff0a6c022 RSI: ffff8801d9ab88c0 RDI: ffffffff85360110 RBP: ffff8801d9ac7950 R08: ffff8801d9ab88e0 R09: 0000000000000000 R10: ffff8801d9ab8000 R11: 0000000000000001 R12: ffffffff853600e0 R13: 0000000000000004 R14: 0000000000000002 R15: ffff8801d9ab8000 FS: 00007f42d05f57a0(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000158d800 CR3: 00000001ce15e000 CR4: 0000000000160670 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: 0000000000000000c 1ffff1003b358f28c 0000000000000000c ffffea0006eb0d80c ffff8801d9ab88c0c 000000000000000bc 0000000000000000c 0000000000000000c ffff8801d9ab88e2c ffff8801d9ac7b08c ffffffff81234a1bc ffff8801d9ab88b8c Call Trace: [] mark_irqflags kernel/locking/lockdep.c:2937 [inline] [] __lock_acquire+0xd9b/0x4080 kernel/locking/lockdep.c:3302 [] lock_acquire+0x130/0x3e0 kernel/locking/lockdep.c:3756 [] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline] [] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151 [] spin_lock include/linux/spinlock.h:302 [inline] [] pgd_alloc+0xb3/0x2a0 arch/x86/mm/pgtable.c:382 [] mm_alloc_pgd kernel/fork.c:698 [inline] [] mm_init+0x4a3/0x820 kernel/fork.c:798 [] dup_mm kernel/fork.c:1147 [inline] [] copy_mm kernel/fork.c:1204 [inline] [] copy_process.part.51+0x39a8/0x6140 kernel/fork.c:1670 [] copy_process kernel/fork.c:1497 [inline] [] _do_fork+0x1b0/0xdc0 kernel/fork.c:1955 [] SYSC_clone kernel/fork.c:2065 [inline] [] SyS_clone+0x37/0x50 kernel/fork.c:2059 [] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: c00 cf0 c35 c85 c49 c8d c7c c24 c30 c48 cb8 c00 c00 c00 c00 c00 cfc cff cdf c48 c89 cfa c48 cc1 cea c03 c80 c3c c02 c00 c0f c85 c41 c0e c00 c00 c4d c85 c6c c24 c30 c74 c5f c<41> cbd c01 c00 c00 c00 c48 c83 cc4 c20 c44 c89 ce8 c5b c41 c5c c41 c5d c41 c5e c41 c