Bluetooth: hci3 command 0x0406 tx timeout Bluetooth: hci5 command 0x0406 tx timeout Bluetooth: hci2 command 0x0406 tx timeout Bluetooth: hci0 command 0x0406 tx timeout Bluetooth: hci4 command 0x0406 tx timeout INFO: task kworker/1:0:19 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/1:0 D25920 19 2 0x80000000 Workqueue: events linkwatch_event Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 linkwatch_event+0xa/0x50 net/core/link_watch.c:236 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task syz-executor.1:8008 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.1 D25840 8008 1 0x80000006 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 tun_detach drivers/net/tun.c:593 [inline] tun_chr_close+0x34/0x60 drivers/net/tun.c:2732 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa44/0x2850 kernel/exit.c:868 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fb24ce2d6a7 RSP: 002b:00007ffec0356190 EFLAGS: 00000293 ORIG_RAX: 000000000000003d RAX: fffffffffffffe00 RBX: 000000000000020c RCX: 00007fb24ce2d6a7 RDX: 0000000040000000 RSI: 00007ffec035621c RDI: 00000000ffffffff RBP: 00007ffec035621c R08: 0000000000000000 R09: 00007fb24ce8834a R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 000000000004b97b R14: 0000000000000009 R15: 00007ffec0356280 INFO: task syz-executor.5:14548 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D27752 14548 8005 0x80000006 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 tun_detach drivers/net/tun.c:593 [inline] tun_chr_close+0x34/0x60 drivers/net/tun.c:2732 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa44/0x2850 kernel/exit.c:868 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f2f8cc9e209 RSP: 002b:00007f2f8b613168 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffef RBX: 00007f2f8cdb0f60 RCX: 00007f2f8cc9e209 RDX: 000000000000048b RSI: 0000000000000000 RDI: 0000000000000006 RBP: 00007f2f8ccf8161 R08: 0000000000000018 R09: 0000000000000000 R10: 0000000020000040 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe4b42bf6f R14: 00007f2f8b613300 R15: 0000000000022000 INFO: task syz-executor.4:14552 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D27864 14552 8010 0x80000006 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 tun_detach drivers/net/tun.c:593 [inline] tun_chr_close+0x34/0x60 drivers/net/tun.c:2732 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa44/0x2850 kernel/exit.c:868 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f00386a2209 RSP: 002b:00007f0037017168 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: 0000000000000000 RBX: 00007f00387b4f60 RCX: 00007f00386a2209 RDX: 00000000000000ca RSI: 0000000000000000 RDI: 0000000000000006 RBP: 00007f00386fc161 R08: 0000000000000010 R09: 0000000000000000 R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff77af95bf R14: 00007f0037017300 R15: 0000000000022000 INFO: task syz-executor.2:14549 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D28112 14549 8009 0x80000006 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 tun_detach drivers/net/tun.c:593 [inline] tun_chr_close+0x34/0x60 drivers/net/tun.c:2732 __fput+0x25f/0x7a0 fs/file_table.c:210 task_work_run+0x11f/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0xa44/0x2850 kernel/exit.c:868 do_group_exit+0x100/0x2e0 kernel/exit.c:965 get_signal+0x38d/0x1ca0 kernel/signal.c:2412 do_signal+0x7c/0x1550 arch/x86/kernel/signal.c:792 exit_to_usermode_loop+0x160/0x200 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x4a3/0x640 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fad56552209 RSP: 002b:00007fad54ec7168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: 0000000000000010 RBX: 00007fad56664f60 RCX: 00007fad56552209 RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000006 RBP: 00007fad565ac161 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffa1bfeddf R14: 00007fad54ec7300 R15: 0000000000022000 INFO: task syz-executor.3:14566 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28816 14566 1 0x00000000 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2454 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1c7/0x2c0 net/socket.c:1731 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fbd04a4bfcc RSP: 002b:00007fff9318cbb0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fbd05ae4320 RCX: 00007fbd04a4bfcc RDX: 000000000000002c RSI: 00007fbd05ae4370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007fff9318cc04 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007fbd05ae4370 R14: 0000000000000003 R15: 0000000000000000 INFO: task syz-executor.2:14574 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D28816 14574 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2454 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1c7/0x2c0 net/socket.c:1731 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f4c56f86fcc RSP: 002b:00007ffc66ef2320 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f4c5801f320 RCX: 00007f4c56f86fcc RDX: 000000000000002c RSI: 00007f4c5801f370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffc66ef2374 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f4c5801f370 R14: 0000000000000003 R15: 0000000000000000 INFO: task syz-executor.0:14577 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D28816 14577 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2454 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1c7/0x2c0 net/socket.c:1731 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7fcf9e5bdfcc RSP: 002b:00007ffdfd73b3c0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007fcf9f656320 RCX: 00007fcf9e5bdfcc RDX: 000000000000002c RSI: 00007fcf9f656370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffdfd73b414 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007fcf9f656370 R14: 0000000000000003 R15: 0000000000000000 INFO: task syz-executor.3:14625 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D28912 14625 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2454 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1c7/0x2c0 net/socket.c:1731 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f89a8d38fcc RSP: 002b:00007ffd50d42260 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f89a9dd1320 RCX: 00007f89a8d38fcc RDX: 0000000000000028 RSI: 00007f89a9dd1370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffd50d422b4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007f89a9dd1370 R14: 0000000000000003 R15: 0000000000000000 INFO: task syz-executor.0:14649 blocked for more than 140 seconds. Not tainted 4.14.289-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D28792 14649 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2811 [inline] __schedule+0x88b/0x1de0 kernel/sched/core.c:3387 schedule+0x8d/0x1b0 kernel/sched/core.c:3431 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:3489 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x669/0x1310 kernel/locking/mutex.c:893 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2454 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1c7/0x2c0 net/socket.c:1731 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7faa4455dfcc RSP: 002b:00007fffc797ab90 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007faa455f6320 RCX: 00007faa4455dfcc RDX: 0000000000000028 RSI: 00007faa455f6370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007fffc797abe4 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007faa455f6370 R14: 0000000000000003 R15: 0000000000000000 Showing all locks held in the system: 3 locks held by kworker/0:0/3: #0: ("%s"("ipv6_addrconf")){+.+.}, at: [] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088 #1: ((addr_chk_work).work){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092 #2: (rtnl_mutex){+.+.}, at: [] addrconf_verify_work+0xa/0x20 net/ipv6/addrconf.c:4421 4 locks held by kworker/u4:0/5: #0: ("%s""netns"){+.+.}, at: [] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088 #1: (net_cleanup_work){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092 #2: (net_mutex){+.+.}, at: [] cleanup_net+0x110/0x840 net/core/net_namespace.c:453 #3: (rtnl_mutex){+.+.}, at: [] cleanup_net+0x115/0x840 net/core/net_namespace.c:456 3 locks held by kworker/1:0/19: #0: ("events"){+.+.}, at: [] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088 #1: ((linkwatch_work).work){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092 #2: (rtnl_mutex){+.+.}, at: [] linkwatch_event+0xa/0x50 net/core/link_watch.c:236 1 lock held by khungtaskd/1534: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4548 1 lock held by syz-executor.1/8008: #0: (rtnl_mutex){+.+.}, at: [] tun_detach drivers/net/tun.c:593 [inline] #0: (rtnl_mutex){+.+.}, at: [] tun_chr_close+0x34/0x60 drivers/net/tun.c:2732 1 lock held by syz-executor.3/8011: #0: (rtnl_mutex){+.+.}, at: [] netdev_run_todo+0x20e/0xad0 net/core/dev.c:7934 1 lock held by syz-executor.5/14548: #0: (rtnl_mutex){+.+.}, at: [] tun_detach drivers/net/tun.c:593 [inline] #0: (rtnl_mutex){+.+.}, at: [] tun_chr_close+0x34/0x60 drivers/net/tun.c:2732 1 lock held by syz-executor.4/14552: #0: (rtnl_mutex){+.+.}, at: [] tun_detach drivers/net/tun.c:593 [inline] #0: (rtnl_mutex){+.+.}, at: [] tun_chr_close+0x34/0x60 drivers/net/tun.c:2732 1 lock held by syz-executor.2/14549: #0: (rtnl_mutex){+.+.}, at: [] tun_detach drivers/net/tun.c:593 [inline] #0: (rtnl_mutex){+.+.}, at: [] tun_chr_close+0x34/0x60 drivers/net/tun.c:2732 1 lock held by syz-executor.3/14566: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 1 lock held by syz-executor.2/14574: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 1 lock held by syz-executor.0/14577: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 1 lock held by syz-executor.3/14625: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 1 lock held by syz-executor.0/14649: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 1 lock held by syz-executor.1/14653: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 1 lock held by syz-executor.4/14654: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 1 lock held by syz-executor.2/14655: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 1 lock held by syz-executor.2/14686: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x31d/0xb10 net/core/rtnetlink.c:4317 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1534 Comm: khungtaskd Not tainted 4.14.289-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 nmi_cpu_backtrace.cold+0x57/0x93 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x13a/0x180 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x5b9/0xb40 kernel/hung_task.c:274 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 14678 Comm: syz-executor.5 Not tainted 4.14.289-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 task: ffff888064682040 task.stack: ffff888044408000 RIP: 0010:deref_stack_reg+0x15c/0x1a0 arch/x86/kernel/unwind_orc.c:291 RSP: 0018:ffff8880ba5078f8 EFLAGS: 00000282 RAX: 0000000000000001 RBX: 1ffff110174a0f17 RCX: ffffffff8a699ea4 RDX: dffffc0000000000 RSI: ffff8880ba5078d8 RDI: ffff8880ba507af0 RBP: ffff888032ba1928 R08: 0000000000000001 R09: 0000000000000001 R10: ffff8880ba507b00 R11: 0000000000000001 R12: ffff8880ba507a80 R13: ffff8880ba507ac0 R14: ffff8880ba500000 R15: ffff8880ba507a80 FS: 00005555566ad400(0000) GS:ffff8880ba500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005593dc2ea848 CR3: 000000005ea15000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: unwind_next_frame+0xfcc/0x17d0 arch/x86/kernel/unwind_orc.c:474 __unwind_start+0x594/0x930 arch/x86/kernel/unwind_orc.c:583 unwind_start arch/x86/include/asm/unwind.h:60 [inline] __save_stack_trace+0x63/0x160 arch/x86/kernel/stacktrace.c:43 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 kmem_cache_alloc_node+0x146/0x410 mm/slab.c:3642 __alloc_skb+0x5c/0x510 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:980 [inline] bcm_can_tx+0x1c1/0x680 net/can/bcm.c:300 bcm_tx_timeout_tsklet+0x179/0x320 net/can/bcm.c:427 tasklet_action+0x195/0x340 kernel/softirq.c:513 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:qlink_to_object mm/kasan/quarantine.c:136 [inline] RIP: 0010:qlink_free mm/kasan/quarantine.c:141 [inline] RIP: 0010:qlist_free_all+0x32/0x140 mm/kasan/quarantine.c:166 RSP: 0018:ffff88804440fa88 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff10 RAX: 0000000000000000 RBX: ffff888032ba3500 RCX: ffffea0000cae85f RDX: 0000000000000000 RSI: ffff8880646828c8 RDI: ffff888032ba3500 RBP: 0000000000000000 R08: 00000000000000d8 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888032ba4d40 R13: ffff88804440fac0 R14: ffff8880b5538900 R15: 0000000000000286 quarantine_reduce+0x185/0x200 mm/kasan/quarantine.c:259 kasan_kmalloc+0xa2/0x160 mm/kasan/kasan.c:536 kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618 kmalloc include/linux/slab.h:488 [inline] syslog_print_all+0x55/0x790 kernel/printk/printk.c:1365 do_syslog.part.0+0x4f5/0xad0 kernel/printk/printk.c:1482 do_syslog kernel/printk/printk.c:1554 [inline] SYSC_syslog kernel/printk/printk.c:1556 [inline] SyS_syslog+0x37/0x50 kernel/printk/printk.c:1554 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f0f829ed209 RSP: 002b:00007ffdade89718 EFLAGS: 00000246 ORIG_RAX: 0000000000000067 RAX: ffffffffffffffda RBX: 00007ffdade89d58 RCX: 00007f0f829ed209 RDX: 000000000000003f RSI: 00007ffdade897f0 RDI: 0000000000000003 RBP: 0000000000000000 R08: 000000b6ad5c4d3c R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000fffffff1 R13: 00007ffdade897f0 R14: 0000000000000000 R15: 0000000000000000 Code: 00 00 00 fc ff df 80 3c 02 00 75 46 49 89 6d 00 b8 01 00 00 00 48 ba 00 00 00 00 00 fc ff df 48 c7 04 13 00 00 00 00 48 83 c4 48 <5b> 5d 41 5c 41 5d 41 5e c3 e8 66 90 5b 00 e9 fc fe ff ff e8 cc