INFO: task kworker/u4:4:75 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:4 state:D stack:21232 pid:75 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __synchronize_srcu+0x2b9/0x350 kernel/rcu/srcutree.c:1243 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task dhcpcd:3932 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd state:D stack:22928 pid:3932 ppid:1 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 __netlink_dump_start+0x11f/0x6f0 net/netlink/af_netlink.c:2305 netlink_dump_start include/linux/netlink.h:269 [inline] rtnetlink_rcv_msg+0xe63/0xfc0 net/core/rtnetlink.c:6106 netlink_rcv_skb+0x1fb/0x450 net/netlink/af_netlink.c:2511 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ad/0xbd0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x5be/0x970 net/socket.c:2518 ___sys_sendmsg+0x2a2/0x360 net/socket.c:2572 __sys_sendmsg net/socket.c:2601 [inline] __do_sys_sendmsg net/socket.c:2610 [inline] __se_sys_sendmsg+0x1bb/0x2a0 net/socket.c:2608 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f18fdcec407 RSP: 002b:00007ffe8cb80590 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f18fdc62740 RCX: 00007f18fdcec407 RDX: 0000000000000000 RSI: 00007ffe8cb80610 RDI: 000000000000000c RBP: 00007ffe8cb84830 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000563c6e380c60 R13: 000000000000000c R14: 00007ffe8cb847f0 R15: 00007ffe8cb84830 INFO: task kworker/u4:9:4375 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:9 state:D stack:20432 pid:4375 ppid:2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2144 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x2c7/0x5a0 kernel/sched/completion.c:138 __synchronize_srcu+0x2b9/0x350 kernel/rcu/srcutree.c:1243 fsnotify_mark_destroy_workfn+0x106/0x2f0 fs/notify/mark.c:924 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/u4:2:17146 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:2 state:D stack:23184 pid:17146 ppid:2 flags:0x00004000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 synchronize_rcu_expedited+0x6e6/0x890 kernel/rcu/tree_exp.h:977 dev_deactivate_many+0x635/0xcb0 net/sched/sch_generic.c:1346 __dev_close_many+0x162/0x2b0 net/core/dev.c:1572 dev_close_many+0x21f/0x400 net/core/dev.c:1610 unregister_netdevice_many+0x487/0x1930 net/core/dev.c:10990 ip_tunnel_delete_nets+0x320/0x370 net/ipv4/ip_tunnel.c:1157 ops_exit_list net/core/net_namespace.c:177 [inline] cleanup_net+0x791/0xba0 net/core/net_namespace.c:640 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task kworker/1:1:18489 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/1:1 state:D stack:25456 pid:18489 ppid:2 flags:0x00004000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 addrconf_dad_work+0xca/0x14f0 net/ipv6/addrconf.c:4131 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor:18640 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:22096 pid:18640 ppid:1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 namespace_unlock+0x23f/0x430 fs/namespace.c:1502 do_umount fs/namespace.c:1726 [inline] path_umount+0xf19/0xf90 fs/namespace.c:1809 ksys_umount fs/namespace.c:1832 [inline] __do_sys_umount fs/namespace.c:1837 [inline] __se_sys_umount fs/namespace.c:1835 [inline] __x64_sys_umount+0x12d/0x170 fs/namespace.c:1835 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7ff4fbb9da57 RSP: 002b:00007fff3a0e3658 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: ffffffffffffffda RBX: 00007ff4fbc326d5 RCX: 00007ff4fbb9da57 RDX: 00007ff4fbb9b687 RSI: 0000000000000002 RDI: 00007ff4fbc32961 RBP: 00007ff4fbc32909 R08: 0000000000000000 R09: 00007ff4fbe167b8 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff4fbc074a0 R13: 00007ff4fbc07478 R14: 00007fff3a0e38c8 R15: 0000000000000000 INFO: task syz.1.2996:19031 blocked for more than 147 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.2996 state:D stack:27408 pid:19031 ppid:17488 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 synchronize_rcu+0x128/0x3f0 kernel/rcu/tree.c:3580 pfkey_release+0x24f/0x310 net/key/af_key.c:185 __sock_release net/socket.c:654 [inline] sock_close+0xd5/0x240 net/socket.c:1399 __fput+0x22c/0x920 fs/file_table.c:320 task_work_run+0x1d0/0x260 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x982/0x2480 kernel/exit.c:880 do_group_exit+0x217/0x2d0 kernel/exit.c:1022 get_signal+0x1272/0x1350 kernel/signal.c:2871 arch_do_signal_or_restart+0xc4/0x1350 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f497279c819 RSP: 002b:00007f49735ed0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f4972a16098 RCX: 00007f497279c819 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4972a16098 RBP: 00007f4972a16090 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f4972a16128 R14: 00007ffc1c1cef30 R15: 00007ffc1c1cf018 INFO: task syz.8.2990:19042 blocked for more than 148 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.8.2990 state:D stack:26256 pid:19042 ppid:8832 flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 namespace_unlock+0x23f/0x430 fs/namespace.c:1502 drop_collected_mounts fs/namespace.c:1991 [inline] put_mnt_ns+0xdb/0x120 fs/namespace.c:4488 free_nsproxy+0x49/0x3c0 kernel/nsproxy.c:191 do_exit+0x97d/0x2480 kernel/exit.c:879 do_group_exit+0x217/0x2d0 kernel/exit.c:1022 get_signal+0x1272/0x1350 kernel/signal.c:2871 arch_do_signal_or_restart+0xc4/0x1350 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f560979c819 RSP: 002b:00007f560a5a70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f5609a16188 RCX: 00007f560979c819 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f5609a16188 RBP: 00007f5609a16180 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f5609a16218 R14: 00007fffcaaf5090 R15: 00007fffcaaf5178 INFO: task syz.0.2998:19049 blocked for more than 149 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.2998 state:D stack:27696 pid:19049 ppid:18039 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 exp_funnel_lock kernel/rcu/tree_exp.h:314 [inline] synchronize_rcu_expedited+0x7ad/0x890 kernel/rcu/tree_exp.h:962 packet_set_ring+0x13dd/0x2410 net/packet/af_packet.c:4550 packet_setsockopt+0xe32/0x1390 net/packet/af_packet.c:3883 __sys_setsockopt+0x2bf/0x3d0 net/socket.c:2287 __do_sys_setsockopt net/socket.c:2298 [inline] __se_sys_setsockopt net/socket.c:2295 [inline] __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2295 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f27be79c819 RSP: 002b:00007f27bf68e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f27bea15fa0 RCX: 00007f27be79c819 RDX: 0000000000000005 RSI: 0000000000000107 RDI: 0000000000000003 RBP: 00007f27be832c91 R08: 000000000000001c R09: 0000000000000000 R10: 0000200000000140 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f27bea16038 R14: 00007f27bea15fa0 R15: 00007ffe5c171598 INFO: task syz.4.2999:19058 blocked for more than 149 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.2999 state:D stack:26864 pid:19058 ppid:17480 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5245 [inline] __schedule+0x11d1/0x40e0 kernel/sched/core.c:6562 schedule+0xb9/0x180 kernel/sched/core.c:6638 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747 __netlink_dump_start+0x11f/0x6f0 net/netlink/af_netlink.c:2305 netlink_dump_start include/linux/netlink.h:269 [inline] rtnetlink_rcv_msg+0xe63/0xfc0 net/core/rtnetlink.c:6106 netlink_rcv_skb+0x1fb/0x450 net/netlink/af_netlink.c:2511 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x74d/0x8d0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ad/0xbd0 net/netlink/af_netlink.c:1872 sock_sendmsg_nosec net/socket.c:718 [inline] __sock_sendmsg net/socket.c:730 [inline] ____sys_sendmsg+0x5be/0x970 net/socket.c:2518 ___sys_sendmsg+0x2a2/0x360 net/socket.c:2572 __sys_sendmsg net/socket.c:2601 [inline] __do_sys_sendmsg net/socket.c:2610 [inline] __se_sys_sendmsg+0x1bb/0x2a0 net/socket.c:2608 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f870739c819 RSP: 002b:00007f87081fc028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8707616180 RCX: 00007f870739c819 RDX: 0000000000000000 RSI: 0000200000000400 RDI: 0000000000000008 RBP: 00007f8707432c91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f8707616218 R14: 00007f8707616180 R15: 00007ffe2fb72f68 Showing all locks held in the system: 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8cb2df30 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by rcu_tasks_trace/13: #0: ffffffff8cb2e750 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517 1 lock held by khungtaskd/28: #0: ffffffff8cb2d5a0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline] #0: ffffffff8cb2d5a0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline] #0: ffffffff8cb2d5a0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6513 2 locks held by kworker/u4:4/75: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc900015b7d00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 1 lock held by dhcpcd/3932: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: __netlink_dump_start+0x11f/0x6f0 net/netlink/af_netlink.c:2305 2 locks held by getty/4032: #0: ffff88802fc0f098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244 #1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x429/0x1390 drivers/tty/n_tty.c:2198 2 locks held by kworker/u4:9/4375: #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90004667d00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 6 locks held by kworker/0:26/13176: 5 locks held by kworker/u4:2/17146: #0: ffff888017616938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc90003737d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd39fd0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:594 #3: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_delete_nets+0xd0/0x370 net/ipv4/ip_tunnel.c:1152 #4: ffffffff8cb33278 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline] #4: ffffffff8cb33278 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962 3 locks held by kworker/1:1/18489: #0: ffff88814cf39938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #1: ffffc900044a7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267 #2: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xca/0x14f0 net/ipv6/addrconf.c:4131 1 lock held by syz-executor/18640: #0: ffffffff8cb33278 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline] #0: ffffffff8cb33278 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962 1 lock held by syz.1.2996/19031: #0: ffff88807f9a3210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:758 [inline] #0: ffff88807f9a3210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline] #0: ffff88807f9a3210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1399 1 lock held by syz.0.2998/19049: #0: ffff88807cf18130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1805 [inline] #0: ffff88807cf18130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_setsockopt+0x741/0x1390 net/packet/af_packet.c:3863 1 lock held by syz.4.2999/19058: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: __netlink_dump_start+0x11f/0x6f0 net/netlink/af_netlink.c:2305 1 lock held by syz-executor/19063: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19069: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19071: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19075: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19077: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19082: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19086: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19088: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19092: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19094: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19098: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19103: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19107: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19109: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 1 lock held by syz-executor/19111: #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline] #0: ffffffff8dd46ea8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x824/0xfc0 net/core/rtnetlink.c:6147 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 28 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Call Trace: dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106 nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline] watchdog+0xeee/0xf30 kernel/hung_task.c:377 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 13176 Comm: kworker/0:26 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:unwind_next_frame+0x6dd/0x20b0 arch/x86/kernel/unwind_orc.c:471 Code: 00 00 44 89 f9 80 e1 07 38 c1 0f 8c 75 02 00 00 be 02 00 00 00 49 89 d6 4c 89 ff e8 6d 5f 9a 00 e9 3b 18 00 00 48 8b 44 24 50 <42> 80 3c 28 00 4c 8b 74 24 58 74 08 4c 89 f7 e8 8f 5e 9a 00 49 8b RSP: 0018:ffffc90003f7e5f0 EFLAGS: 00000297 RAX: 1ffff920007efce0 RBX: ffffc90003f7e6c8 RCX: ffffffff8e5b598c RDX: ffffffff8ee0f1b4 RSI: ffffffff8e5b5988 RDI: ffffffff81391adf RBP: ffffffff8ee0f1b8 R08: 0000000000000001 R09: 000000000000001d R10: dffffc0000000000 R11: fffff520007efce5 R12: ffffffff8ee0f1b4 R13: dffffc0000000000 R14: ffffffff8e5b5988 R15: 0000000000000005 FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000557b1498ff70 CR3: 000000000c88e000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 __kasan_slab_alloc+0x6b/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x4b/0x480 mm/slab.h:737 slab_alloc_node mm/slub.c:3359 [inline] kmem_cache_alloc_node+0x14d/0x320 mm/slub.c:3404 __alloc_skb+0xfc/0x7e0 net/core/skbuff.c:505 __netdev_alloc_skb+0x114/0x4f0 net/core/skbuff.c:579 netdev_alloc_skb include/linux/skbuff.h:3261 [inline] dev_alloc_skb include/linux/skbuff.h:3274 [inline] ath6kl_usb_post_recv_transfers+0x207/0x6f0 drivers/net/wireless/ath/ath6kl/usb.c:428 ath6kl_usb_start_recv_pipes drivers/net/wireless/ath/ath6kl/usb.c:498 [inline] hif_start drivers/net/wireless/ath/ath6kl/usb.c:703 [inline] ath6kl_usb_power_on+0x66/0x280 drivers/net/wireless/ath/ath6kl/usb.c:1062 ath6kl_hif_power_on drivers/net/wireless/ath/ath6kl/hif-ops.h:136 [inline] ath6kl_core_init+0x1d6/0x1090 drivers/net/wireless/ath/ath6kl/core.c:97 ath6kl_usb_probe+0x144a/0x1540 drivers/net/wireless/ath/ath6kl/usb.c:1168 usb_probe_interface+0x5c5/0xb20 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2aa/0xc70 drivers/base/dd.c:639 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489 device_add+0xa00/0xfb0 drivers/base/core.c:3697 usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2223 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238 usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x2aa/0xc70 drivers/base/dd.c:639 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:785 driver_probe_device+0x4f/0x420 drivers/base/dd.c:815 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:943 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429 __device_attach+0x2a8/0x480 drivers/base/dd.c:1015 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489 device_add+0xa00/0xfb0 drivers/base/core.c:3697 usb_new_device+0xd66/0x1650 drivers/usb/core/hub.c:2659 hub_port_connect drivers/usb/core/hub.c:5517 [inline] hub_port_connect_change drivers/usb/core/hub.c:5657 [inline] port_event drivers/usb/core/hub.c:5817 [inline] hub_event+0x2dcf/0x5560 drivers/usb/core/hub.c:5899 process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292 worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439 kthread+0x29d/0x330 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295