INFO: task dhcpcd:3216 blocked for more than 143 seconds. Not tainted 6.1.81-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:20744 pid:3216 ppid:3215 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x142d/0x4550 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352 netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x5a5/0x8f0 net/socket.c:2514 ___sys_sendmsg net/socket.c:2568 [inline] __sys_sendmsg+0x2a9/0x390 net/socket.c:2597 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f7784bc7a4b RSP: 002b:00007ffdef497a18 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f7784aef6c0 RCX: 00007f7784bc7a4b RDX: 0000000000000000 RSI: 00007ffdef4abbc8 RDI: 0000000000000023 RBP: 0000000000000023 R08: 0000000000000000 R09: 00007ffdef4abbc8 R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff R13: 00007ffdef4abbc8 R14: 0000000000000048 R15: 0000000000000001 INFO: task syz-executor.0:24122 blocked for more than 144 seconds. Not tainted 6.1.81-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:21736 pid:24122 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x142d/0x4550 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352 netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x480/0x600 net/socket.c:2148 __do_sys_sendto net/socket.c:2160 [inline] __se_sys_sendto net/socket.c:2156 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2156 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fcb38e7fa9c RSP: 002b:00007ffec5dcf440 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fcb39ad4620 RCX: 00007fcb38e7fa9c RDX: 0000000000000028 RSI: 00007fcb39ad4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffec5dcf494 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fcb39ad4670 R15: 0000000000000000 INFO: task syz-executor.3:24138 blocked for more than 144 seconds. Not tainted 6.1.81-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.3 state:D stack:21736 pid:24138 ppid:1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x142d/0x4550 kernel/sched/core.c:6558 schedule+0xbf/0x180 kernel/sched/core.c:6634 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6693 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x6b9/0xd80 kernel/locking/mutex.c:747 rtnl_lock net/core/rtnetlink.c:74 [inline] rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 netlink_rcv_skb+0x1cd/0x410 net/netlink/af_netlink.c:2508 netlink_unicast_kernel net/netlink/af_netlink.c:1326 [inline] netlink_unicast+0x7d8/0x970 net/netlink/af_netlink.c:1352 netlink_sendmsg+0xa26/0xd60 net/netlink/af_netlink.c:1874 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] __sys_sendto+0x480/0x600 net/socket.c:2148 __do_sys_sendto net/socket.c:2160 [inline] __se_sys_sendto net/socket.c:2156 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:2156 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fb8abc7fa9c RSP: 002b:00007ffeadc17680 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fb8ac8d4620 RCX: 00007fb8abc7fa9c RDX: 0000000000000068 RSI: 00007fb8ac8d4670 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffeadc176d4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003 R13: 0000000000000000 R14: 00007fb8ac8d4670 R15: 0000000000000000 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8d12aa10 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:516 1 lock held by rcu_tasks_trace/13: #0: ffffffff8d12b210 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x29/0xe30 kernel/rcu/tasks.h:516 1 lock held by khungtaskd/28: #0: ffffffff8d12a840 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:319 [inline] #0: ffffffff8d12a840 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:760 [inline] #0: ffffffff8d12a840 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6494 1 lock held by dhcpcd/3216: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 2 locks held by getty/3303: #0: ffff88814b78a098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc900031262f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6a7/0x1db0 drivers/tty/n_tty.c:2188 3 locks held by kworker/1:4/3609: #0: ffff888027caf138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90004a1fd20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4654 2 locks held by kworker/0:7/3611: #0: ffff888012472138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90004a3fd20 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 4 locks held by kworker/u4:5/3666: #0: ffff88814c41d138 ((wq_completion)ext4-rsv-conversion){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90004c87d20 ((work_completion)(&ei->i_rsv_conversion_work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff91fabd08 (&obj_hash[i].lock){-.-.}-{2:2}, at: __debug_check_no_obj_freed lib/debugobjects.c:967 [inline] #2: ffffffff91fabd08 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_check_no_obj_freed+0xd8/0x4e0 lib/debugobjects.c:1008 #3: ffffffff8d12a840 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:319 [inline] #3: ffffffff8d12a840 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:760 [inline] #3: ffffffff8d12a840 (rcu_read_lock){....}-{1:2}, at: __mod_lruvec_page_state+0xa6/0x420 mm/memcontrol.c:832 5 locks held by kworker/u4:6/3681: #0: ffff888012616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90004bf7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e28cad0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0xf1/0xb60 net/core/net_namespace.c:563 #3: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xe5/0x9d0 net/core/dev.c:11377 #4: ffffffff8d12fe38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #4: ffffffff8d12fe38 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x479/0x8a0 kernel/rcu/tree_exp.h:949 3 locks held by kworker/0:1/22229: #0: ffff888012470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc9000b3e7d20 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263 3 locks held by kworker/0:3/22239: #0: ffff888027caf138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc9000b497d20 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4654 3 locks held by kworker/u4:7/22507: 3 locks held by kworker/0:13/23544: #0: ffff888012470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #1: ffffc90004c97d20 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7a9/0x11d0 kernel/workqueue.c:2267 #2: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104 1 lock held by syz-executor.0/24122: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.1/24132: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.3/24138: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.0/24562: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.1/24567: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.3/24580: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.0/24956: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.1/24961: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.3/24969: #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8e298d28 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7c1/0xff0 net/core/rtnetlink.c:6118 1 lock held by syz-executor.2/25018: 1 lock held by syz-executor.2/25035: 1 lock held by syz-executor.2/25044: 2 locks held by syz-executor.4/25049: 1 lock held by syz-executor.2/25053: 2 locks held by syz-executor.4/25057: 2 locks held by syz-executor.2/25063: 2 locks held by syz-executor.4/25064: 2 locks held by syz-executor.2/25069: 2 locks held by syz-executor.4/25074: 2 locks held by syz-executor.2/25081: 2 locks held by syz-executor.4/25084: 2 locks held by syz-executor.4/25090: 3 locks held by syz-executor.2/25092: 2 locks held by syz-executor.4/25099: 2 locks held by syz-executor.2/25106: 3 locks held by syz-executor.4/25108: 3 locks held by syz-executor.2/25113: 2 locks held by syz-executor.4/25116: 2 locks held by syz-executor.2/25123: 2 locks held by syz-executor.4/25126: 3 locks held by syz-executor.2/25132: 2 locks held by syz-executor.4/25134: 2 locks held by syz-executor.2/25141: 3 locks held by syz-executor.4/25143: 1 lock held by syz-executor.2/25149: 2 locks held by syz-executor.4/25156: 2 locks held by syz-executor.2/25159: 3 locks held by syz-executor.2/25165: 2 locks held by syz-executor.4/25166: 2 locks held by syz-executor.4/25171: 3 locks held by syz-executor.2/25178: 2 locks held by syz-executor.4/25181: 2 locks held by syz-executor.2/25186: 3 locks held by syz-executor.4/25189: 3 locks held by syz-executor.2/25196: 2 locks held by syz-executor.4/25200: 3 locks held by syz-executor.2/25205: 1 lock held by syz-executor.4/25206: #0: ffff888077f908d8 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_lock_killable+0x1d/0x60 include/linux/mmap_lock.h:126 3 locks held by syz-executor.4/25207: ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 28 Comm: khungtaskd Not tainted 6.1.81-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 nmi_cpu_backtrace+0x4e1/0x560 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1b0/0x3f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xf88/0xfd0 kernel/hung_task.c:377 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 3666 Comm: kworker/u4:5 Not tainted 6.1.81-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Workqueue: phy3 ieee80211_iface_work RIP: 0010:memset_erms+0xb/0x10 arch/x86/lib/memset_64.S:65 Code: 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 f3 aa <4c> 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 01 01 RSP: 0018:ffffc90004c86f58 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 1ffffffff1de207b RCX: 0000000000000000 RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc90004c870a0 RBP: dffffc0000000000 R08: dffffc0000000000 R09: ffffc90004c87090 R10: 0000000000000000 R11: dffffc0000000001 R12: ffffc90004c87040 R13: ffffffff8ef103d8 R14: ffffc90004c87075 R15: ffffc90004c87090 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f2ee7ad56c6 CR3: 000000000ce8e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: unwind_next_frame+0xde7/0x2220 arch/x86/kernel/unwind_orc.c:546 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:383 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:955 [inline] __kmalloc+0xb2/0x230 mm/slab_common.c:968 kmalloc include/linux/slab.h:561 [inline] kzalloc include/linux/slab.h:692 [inline] cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2406 [inline] cfg80211_inform_bss_frame_data+0x5e3/0x1680 net/wireless/scan.c:2467 ieee80211_bss_info_update+0x847/0xf00 net/mac80211/scan.c:190 ieee80211_rx_bss_info net/mac80211/ibss.c:1120 [inline] ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1609 [inline] ieee80211_ibss_rx_queued_mgmt+0x1962/0x2dd0 net/mac80211/ibss.c:1638 ieee80211_iface_process_skb net/mac80211/iface.c:1632 [inline] ieee80211_iface_work+0x7aa/0xce0 net/mac80211/iface.c:1686 process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292 worker_thread+0xa47/0x1200 kernel/workqueue.c:2439 kthread+0x28d/0x320 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307