PF_BRIDGE: br_mdb_parse() with invalid ifindex INFO: task syz-executor3:8003 blocked for more than 140 seconds. Not tainted 4.20.0-rc2+ #294 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor3 D24064 8003 6089 0x00000004 Call Trace: context_switch kernel/sched/core.c:2831 [inline] __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472 schedule+0xfe/0x460 kernel/sched/core.c:3516 exp_funnel_lock kernel/rcu/tree_exp.h:319 [inline] _synchronize_rcu_expedited.constprop.58+0x8df/0x9d0 kernel/rcu/tree_exp.h:620 synchronize_rcu_expedited+0x27/0xa0 kernel/rcu/tree_exp.h:758 synchronize_net+0x3b/0x60 net/core/dev.c:9064 packet_set_ring+0x286/0x1da0 net/packet/af_packet.c:4339 packet_setsockopt+0x16ef/0x23b0 net/packet/af_packet.c:3649 __sys_setsockopt+0x1ba/0x3c0 net/socket.c:1902 __do_sys_setsockopt net/socket.c:1913 [inline] __se_sys_setsockopt net/socket.c:1910 [inline] __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457569 Code: Bad RIP value. RSP: 002b:00007fdf8aadac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457569 RDX: 0000000000000005 RSI: 0000000000000107 RDI: 0000000000000005 RBP: 000000000072bfa0 R08: 0000000000000224 R09: 0000000000000000 R10: 0000000020001000 R11: 0000000000000246 R12: 00007fdf8aadb6d4 R13: 00000000004c3cf1 R14: 00000000004d60a8 R15: 00000000ffffffff Showing all locks held in the system: 1 lock held by khungtaskd/1006: #0: 000000001c193f57 (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379 1 lock held by rsyslogd/5897: #0: 000000001fbf8869 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200 fs/file.c:766 2 locks held by getty/5988: #0: 00000000127109aa (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 000000003c55fb78 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/5989: #0: 000000009f8579b4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 00000000bf2cb57b (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/5990: #0: 00000000fbb84ae3 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 00000000f3d11065 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/5991: #0: 00000000e4c94d89 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 00000000dbd4d9d1 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/5992: #0: 00000000f5cfd19c (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 0000000057c8e346 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/5993: #0: 00000000ac3a5291 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 0000000053349cad (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/5994: #0: 00000000edc24298 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 000000003d83f6f8 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 1 lock held by kworker/0:5/12916: 1 lock held by syz-executor3/8003: #0: 0000000014303ce2 (sk_lock-AF_PACKET){+.+.}, at: lock_sock include/net/sock.h:1492 [inline] #0: 0000000014303ce2 (sk_lock-AF_PACKET){+.+.}, at: packet_setsockopt+0x602/0x23b0 net/packet/af_packet.c:3632 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1006 Comm: khungtaskd Not tainted 4.20.0-rc2+ #294 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xb51/0x1060 kernel/hung_task.c:289 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 12916 Comm: kworker/0:5 Not tainted 4.20.0-rc2+ #294 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events rht_deferred_worker RIP: 0010:do_raw_spin_lock+0x2a/0x350 kernel/locking/spinlock_debug.c:111 Code: 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 57 41 56 4c 8d 7d d8 41 55 4c 8d ad 78 ff ff ff 49 c1 ed 03 41 54 49 8d 4c 05 00 <53> 48 89 fb 48 83 c7 04 48 83 ec 70 48 c7 45 80 74 69 0f 89 48 c7 RSP: 0000:ffff888190e47118 EFLAGS: 00000802 RAX: dffffc0000000000 RBX: ffffffff8b230168 RCX: ffffed10321c8e16 RDX: 1ffffffff12a3f6e RSI: 0000000000000000 RDI: ffffffff8b230168 RBP: ffff888190e47138 R08: ffff8881cc9cce30 R09: 0000000000000008 R10: 0000000000007b9c R11: ffff8881cc9cc540 R12: 0000000000000086 R13: 1ffff110321c8e16 R14: ffffffff8a16c140 R15: ffff888190e47110 FS: 0000000000000000(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007faa6cabd140 CR3: 00000001ceb3e000 CR4: 00000000001406f0 Call Trace: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline] _raw_spin_lock_irqsave+0xa1/0xd0 kernel/locking/spinlock.c:152 debug_object_activate+0x1d4/0x600 lib/debugobjects.c:473 debug_work_activate kernel/workqueue.c:491 [inline] __queue_work+0x17d/0x1440 kernel/workqueue.c:1380 queue_work_on+0x19a/0x1e0 kernel/workqueue.c:1486 queue_work include/linux/workqueue.h:512 [inline] schedule_work include/linux/workqueue.h:570 [inline] rht_deferred_worker+0xf5a/0x1de0 lib/rhashtable.c:425 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352