INFO: task kworker/u8:22:9324 blocked for more than 143 seconds.
Not tainted 6.15.0-rc2-syzkaller-00578-g12b196568a3a #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:22 state:D stack:22664 pid:9324 tgid:9324 ppid:2 task_flags:0x4208060 flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x1b88/0x5240 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x163/0x360 kernel/sched/core.c:6860
schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6917
__mutex_lock_common kernel/locking/mutex.c:678 [inline]
__mutex_lock+0x805/0x10c0 kernel/locking/mutex.c:746
rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
rdma_dev_exit_net+0x220/0x360 drivers/infiniband/core/device.c:1144
ops_exit_list net/core/net_namespace.c:200 [inline]
ops_undo_list+0x3f6/0x8b0 net/core/net_namespace.c:250
cleanup_net+0x530/0x940 net/core/net_namespace.c:684
process_one_work kernel/workqueue.c:3238 [inline]
process_scheduled_works+0xac3/0x18e0 kernel/workqueue.c:3319
worker_thread+0x870/0xd50 kernel/workqueue.c:3400
kthread+0x7b7/0x940 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
INFO: task syz.4.2103:13392 blocked for more than 144 seconds.
Not tainted 6.15.0-rc2-syzkaller-00578-g12b196568a3a #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.2103 state:D stack:24840 pid:13392 tgid:13391 ppid:5838 task_flags:0x400140 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x1b88/0x5240 kernel/sched/core.c:6767
__schedule_loop kernel/sched/core.c:6845 [inline]
schedule+0x163/0x360 kernel/sched/core.c:6860
schedule_timeout+0xb1/0x2b0 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common kernel/sched/completion.c:116 [inline]
wait_for_common kernel/sched/completion.c:127 [inline]
wait_for_completion+0x32f/0x600 kernel/sched/completion.c:148
disable_device+0x1c9/0x370 drivers/infiniband/core/device.c:1288
__ib_unregister_device+0x2ac/0x3d0 drivers/infiniband/core/device.c:1516
ib_unregister_device_and_put+0xb9/0xf0 drivers/infiniband/core/device.c:1581
nldev_dellink+0x2e9/0x330 drivers/infiniband/core/nldev.c:1826
rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:-1 [inline]
rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
rdma_nl_rcv+0x6e5/0x9e0 drivers/infiniband/core/netlink.c:259
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f8/0x9a0 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8c3/0xcd0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:712 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:727
____sys_sendmsg+0x523/0x860 net/socket.c:2566
___sys_sendmsg net/socket.c:2620 [inline]
__sys_sendmsg+0x271/0x360 net/socket.c:2652
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xf3/0x210 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe2b5b8e169
RSP: 002b:00007fe2b39f6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fe2b5db5fa0 RCX: 00007fe2b5b8e169
RDX: 0000000020000040 RSI: 0000200000003600 RDI: 0000000000000005
RBP: 00007fe2b5c10a68 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fe2b5db5fa0 R15: 00007ffd79cdf218
Showing all locks held in the system:
1 lock held by ksoftirqd/0/15:
1 lock held by khungtaskd/31:
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#0: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x30/0x180 kernel/locking/lockdep.c:6764
5 locks held by kworker/u8:5/152:
2 locks held by getty/5595:
#0: ffff8880362da0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc90002ffe2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x5bb/0x1700 drivers/tty/n_tty.c:2222
6 locks held by kworker/0:6/5960:
#0: ffff88801b080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
#0: ffff88801b080d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x990/0x18e0 kernel/workqueue.c:3319
#1: ffffc90004d7fc60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
#1: ffffc90004d7fc60 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9cb/0x18e0 kernel/workqueue.c:3319
#2: ffff88805bc6c240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x316/0x3f10 drivers/net/netdevsim/fib.c:1490
#3: ffff8880b8639b18 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:605
#4: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
#4: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline]
#4: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: __bpf_trace_run kernel/trace/bpf_trace.c:2362 [inline]
#4: ffffffff8ed3df20 (rcu_read_lock){....}-{1:3}, at: bpf_trace_run4+0x246/0x5a0 kernel/trace/bpf_trace.c:2406
#5: ffff88801d6d2828 (&p->pi_lock){-.-.}-{2:2}, at: local_bh_disable include/linux/bottom_half.h:20 [inline]
#5: ffff88801d6d2828 (&p->pi_lock){-.-.}-{2:2}, at: rcu_read_lock_bh include/linux/rcupdate.h:892 [inline]
#5: ffff88801d6d2828 (&p->pi_lock){-.-.}-{2:2}, at: __dev_queue_xmit+0x2f9/0x3f60 net/core/dev.c:4606
3 locks held by kworker/u8:13/9313:
5 locks held by kworker/u8:17/9317:
4 locks held by kworker/u8:22/9324:
#0: ffff88801bef6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
#0: ffff88801bef6148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x990/0x18e0 kernel/workqueue.c:3319
#1: ffffc90003007c60 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
#1: ffffc90003007c60 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9cb/0x18e0 kernel/workqueue.c:3319
#2: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x100/0x940 net/core/net_namespace.c:660
#3: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
2 locks held by syz.4.2103/13392:
#0: ffffffff9aae5078 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:164 [inline]
#0: ffffffff9aae5078 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
#0: ffffffff9aae5078 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv+0x32f/0x9e0 drivers/infiniband/core/netlink.c:259
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: __ib_unregister_device+0x264/0x3d0 drivers/infiniband/core/device.c:1512
2 locks held by syz.1.2239/13844:
#0: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:568
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
2 locks held by syz.3.2439/14568:
#0: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:568
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
2 locks held by syz.0.2686/15421:
#0: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:568
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
2 locks held by syz.5.2691/15450:
#0: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:568
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
2 locks held by syz.7.2801/15801:
#0: ffffffff9aae5078 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:164 [inline]
#0: ffffffff9aae5078 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline]
#0: ffffffff9aae5078 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv+0x32f/0x9e0 drivers/infiniband/core/netlink.c:259
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: __ib_unregister_device+0x264/0x3d0 drivers/infiniband/core/device.c:1512
2 locks held by syz.8.2955/16397:
#0: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:568
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
4 locks held by syz-executor/16769:
#0: ffff8880809c0d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline]
#0: ffff8880809c0d80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x203/0x510 net/bluetooth/hci_core.c:2678
#1: ffff8880809c0078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x60f/0x1260 net/bluetooth/hci_sync.c:5213
#2: ffffffff902654a8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:2066 [inline]
#2: ffffffff902654a8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa6/0x240 net/bluetooth/hci_conn.c:2701
#3: ffff888033060b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x71/0x690 net/bluetooth/l2cap_core.c:1761
2 locks held by syz.2.3110/17009:
#0: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:568
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
2 locks held by syz.4.3151/17161:
#0: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:568
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
2 locks held by syz.9.3180/17276:
#0: ffffffff900f1dd0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x328/0x570 net/core/net_namespace.c:568
#1: ffff8880296106d0 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x3a/0x2f0 drivers/infiniband/core/device.c:1664
1 lock held by syz-executor/17586:
#0: ffffffff8ed43438 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:336 [inline]
#0: ffffffff8ed43438 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x454/0x830 kernel/rcu/tree_exp.h:998
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.15.0-rc2-syzkaller-00578-g12b196568a3a #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
nmi_cpu_backtrace+0x4ab/0x4e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x198/0x320 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:274 [inline]
watchdog+0x1058/0x10a0 kernel/hung_task.c:437
kthread+0x7b7/0x940 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 17519 Comm: syz-executor Not tainted 6.15.0-rc2-syzkaller-00578-g12b196568a3a #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:page_zonenum include/linux/mmzone.h:1153 [inline]
RIP: 0010:page_zone include/linux/mm.h:1940 [inline]
RIP: 0010:__free_frozen_pages+0x648/0x10b0 mm/page_alloc.c:2731
Code: 8d 2c c5 e0 68 79 9a 48 89 e8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 80 3c 08 00 74 08 48 89 ef e8 fc 91 0e 00 4c 8b 65 00 <48> c1 eb 37 83 e3 07 83 fb 06 0f 83 93 03 00 00 48 b8 c0 ff ff ff
RSP: 0018:ffffc90003f17840 EFLAGS: 00000246
RAX: 1ffffffff34f2d1c RBX: 00fff00000000000 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 00000000000000ff RDI: ffffed101206ea00
RBP: ffffffff9a7968e0 R08: dffffc0000000000 R09: 0000000000000000
R10: ffffed101206e800 R11: fffffbfff20bfb8f R12: ffff88813fffb400
R13: 1ffffd4000481ba0 R14: 0000000000090374 R15: ffffea000240dd00
FS: 0000000000000000(0000) GS:ffff8881250ab000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f93552e7d60 CR3: 000000000eb38000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
vfree+0x1c3/0x360 mm/vmalloc.c:3383
kcov_put kernel/kcov.c:439 [inline]
kcov_close+0x28/0x50 kernel/kcov.c:535
__fput+0x3e9/0x9f0 fs/file_table.c:465
task_work_run+0x251/0x310 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xa11/0x27f0 kernel/exit.c:953
do_group_exit+0x207/0x2c0 kernel/exit.c:1102
get_signal+0x1696/0x1730 kernel/signal.c:3034
arch_do_signal_or_restart+0x98/0x810 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218
do_syscall_64+0x100/0x210 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f780298cc1f
Code: Unable to access opcode bytes at 0x7f780298cbf5.
RSP: 002b:00007ffdfb181ac0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: 0000000000000003 RBX: 0000000000000005 RCX: 00007f780298cc1f
RDX: 0000000000000003 RSI: 00007ffdfb181b10 RDI: 0000000000000005
RBP: 00007f7802a11ce9 R08: 0000000000000000 R09: 00007ffdfb181917
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 00007ffdfb181b10 R14: 00007f78036e4620 R15: 0000000000000003
IPVS: ovf: UDP 224.0.0.2:0 - no destination available
IPVS: lblc: UDP 224.0.0.2:0 - no destination available