INFO: task khugepaged:1160 blocked for more than 143 seconds. Not tainted 5.8.0-rc4-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. khugepaged D24224 1160 2 0x00004000 Call Trace: context_switch kernel/sched/core.c:3453 [inline] __schedule+0x8e1/0x1eb0 kernel/sched/core.c:4178 schedule+0xd0/0x2a0 kernel/sched/core.c:4253 schedule_timeout+0x1d8/0x250 kernel/time/timer.c:1873 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x163/0x260 kernel/sched/completion.c:138 __flush_work+0x51f/0xab0 kernel/workqueue.c:3046 lru_add_drain_all+0x3ca/0x590 mm/swap.c:807 khugepaged_do_scan mm/khugepaged.c:2177 [inline] khugepaged+0x10b/0x5a10 mm/khugepaged.c:2238 kthread+0x3b5/0x4a0 kernel/kthread.c:291 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Showing all locks held in the system: 4 locks held by kworker/u4:1/21: 1 lock held by khungtaskd/1153: #0: ffffffff89bc0ec0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:5779 1 lock held by khugepaged/1160: #0: ffffffff89c460e8 (lock#4){+.+.}-{3:3}, at: lru_add_drain_all+0x59/0x590 mm/swap.c:778 1 lock held by in:imklog/6509: #0: ffff88809dfeb6b0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:826 3 locks held by kworker/u4:8/15208: #0: ffff8880a97ad138 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880a97ad138 ((wq_completion)netns){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] #0: ffff8880a97ad138 ((wq_completion)netns){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline] #0: ffff8880a97ad138 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline] #0: ffff8880a97ad138 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff8880a97ad138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240 #1: ffffc90001a57da8 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244 #2: ffffffff8a7ac930 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xa00 net/core/net_namespace.c:565 5 locks held by kworker/0:25/16111: 3 locks held by kworker/1:29/24686: #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240 #1: ffffc90001ef7da8 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244 #2: ffffffff89bc5428 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x44/0x4a0 kernel/rcu/tree.c:3596 3 locks held by kworker/1:37/24694: #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240 #1: ffffc900033efda8 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244 #2: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xb/0x60 net/core/link_watch.c:250 3 locks held by kworker/1:40/24697: #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff8880aa026d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240 #1: ffffc9000342fda8 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244 #2: ffffffff89bc5428 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x44/0x4a0 kernel/rcu/tree.c:3596 2 locks held by kworker/1:42/24699: #0: ffff8880aa036538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff8880aa036538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic64_set include/asm-generic/atomic-instrumented.h:856 [inline] #0: ffff8880aa036538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/asm-generic/atomic-long.h:41 [inline] #0: ffff8880aa036538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:616 [inline] #0: ffff8880aa036538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:643 [inline] #0: ffff8880aa036538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x82b/0x1670 kernel/workqueue.c:2240 #1: ffffc9000344fda8 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x85f/0x1670 kernel/workqueue.c:2244 1 lock held by syz-executor.5/31299: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5457 1 lock held by syz-executor.5/31322: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5457 1 lock held by syz-executor.0/31290: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x1a3/0xc40 net/core/dev_ioctl.c:495 1 lock held by syz-executor.0/31295: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5457 1 lock held by syz-executor.0/31303: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x1a3/0xc40 net/core/dev_ioctl.c:495 1 lock held by syz-executor.0/31309: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5457 2 locks held by syz-executor.1/31298: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5457 #1: ffff8880ae735e18 (&rq->lock){-.-.}-{2:2}, at: rq_lock kernel/sched/sched.h:1261 [inline] #1: ffff8880ae735e18 (&rq->lock){-.-.}-{2:2}, at: __schedule+0x22d/0x1eb0 kernel/sched/core.c:4124 1 lock held by syz-executor.1/31302: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5457 1 lock held by syz-executor.1/31327: #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8a7b9768 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x3f9/0xad0 net/core/rtnetlink.c:5457 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1153 Comm: khungtaskd Not tainted 5.8.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x70/0xb1 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1b3/0x223 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:209 [inline] watchdog+0xd7d/0x1000 kernel/hung_task.c:295 kthread+0x3b5/0x4a0 kernel/kthread.c:291 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 16111 Comm: kworker/0:25 Not tainted 5.8.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events ipvlan_process_multicast RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:401 [inline] RIP: 0010:find_match.part.0+0x66/0xc70 net/ipv6/route.c:752 Code: 03 80 3c 02 00 0f 85 eb 0a 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 3b 49 8d bf 28 03 00 00 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 d3 0a 00 00 4d 8b bf 28 03 00 00 e8 48 fe 04 01 31 ff 89 c6 RSP: 0018:ffffc900000075f0 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff88804971aaa0 RCX: 0000000000000003 RDX: 1ffff11006fe8465 RSI: ffffffff86e3429c RDI: ffff888037f42328 RBP: ffffc90000007660 R08: ffffc90000007850 R09: ffffc90000007840 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000003 R13: 0000000000000001 R14: 000000000000040e R15: ffff888037f42000 FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff39779ff0 CR3: 0000000009a79000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: find_match net/ipv6/route.c:839 [inline] __find_rr_leaf+0x17f/0xd10 net/ipv6/route.c:840 find_rr_leaf net/ipv6/route.c:861 [inline] rt6_select net/ipv6/route.c:905 [inline] fib6_table_lookup+0x5b3/0xa20 net/ipv6/route.c:2192 ip6_pol_route+0x1e1/0x1190 net/ipv6/route.c:2228 pol_lookup_func include/net/ip6_fib.h:583 [inline] fib6_rule_lookup+0x111/0x6f0 net/ipv6/fib6_rules.c:114 ip6_route_input_lookup net/ipv6/route.c:2298 [inline] ip6_route_input+0x68a/0xae0 net/ipv6/route.c:2467 ip6_rcv_finish_core.constprop.0.isra.0+0x168/0x570 net/ipv6/ip6_input.c:63 ip6_rcv_finish net/ipv6/ip6_input.c:74 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x22b/0x3c0 net/ipv6/ip6_input.c:307 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5287 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5401 process_backlog+0x28d/0x7f0 net/core/dev.c:6245 napi_poll net/core/dev.c:6690 [inline] net_rx_action+0x4a1/0xe80 net/core/dev.c:6760 __do_softirq+0x34c/0xa60 kernel/softirq.c:292 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline] do_softirq_own_stack+0x111/0x170 arch/x86/kernel/irq_64.c:77 do_softirq kernel/softirq.c:337 [inline] do_softirq+0x16b/0x1e0 kernel/softirq.c:324 __local_bh_enable_ip+0x1f8/0x250 kernel/softirq.c:189 local_bh_enable include/linux/bottom_half.h:32 [inline] ipvlan_process_multicast+0x829/0xd50 drivers/net/ipvlan/ipvlan_core.c:279 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 kthread+0x3b5/0x4a0 kernel/kthread.c:291 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293