INFO: task syz.3.6280:27708 blocked for more than 156 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.6280 state:D stack:27912 pid:27708 ppid:19900 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
tun_detach drivers/net/tun.c:698 [inline]
tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3525
__fput+0x221/0x940 fs/file_table.c:418
__do_sys_close fs/open.c:1574 [inline]
__se_sys_close+0x15c/0x1e0 fs/open.c:1559
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd23499e159
RSP: 002b:00007fd2358e5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007fd234c25fa0 RCX: 00007fd23499e159
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005
RBP: 00007fd234a3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd234c26038 R14: 00007fd234c25fa0 R15: 00007ffcab815698
INFO: task syz.3.6280:27716 blocked for more than 156 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.6280 state:D stack:27048 pid:27716 ppid:19900 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
ppp_create_interface drivers/net/ppp/ppp_generic.c:3376 [inline]
ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1065 [inline]
ppp_ioctl+0xaeb/0x1bc0 drivers/net/ppp/ppp_generic.c:731
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd23499e159
RSP: 002b:00007fd2358a3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fd234c26180 RCX: 00007fd23499e159
RDX: 000000110e22fff6 RSI: 00000000c004743e RDI: 0000000000000009
RBP: 00007fd234a3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd234c26218 R14: 00007fd234c26180 R15: 00007ffcab815698
INFO: task syz.3.6280:27721 blocked for more than 157 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.6280 state:D stack:27912 pid:27721 ppid:19900 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
ppp_ioctl+0xe0/0x1bc0 drivers/net/ppp/ppp_generic.c:727
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd23499e159
RSP: 002b:00007fd2357fe028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fd234c26630 RCX: 00007fd23499e159
RDX: 000000110e22fff6 RSI: 000000004004743d RDI: 000000000000000c
RBP: 00007fd234a3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd234c266c8 R14: 00007fd234c26630 R15: 00007ffcab815698
INFO: task syz.0.6279:27710 blocked for more than 157 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.6279 state:D stack:25768 pid:27710 ppid:21828 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
rtnl_lock net/core/rtnetlink.c:78 [inline]
rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x61b/0x980 net/socket.c:2595
___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ff13239e159
RSP: 002b:00007ff1331d6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ff132626090 RCX: 00007ff13239e159
RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003
RBP: 00007ff13243506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ff132626128 R14: 00007ff132626090 R15: 00007ffda1097078
INFO: task syz.2.6281:27724 blocked for more than 158 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.6281 state:D stack:26792 pid:27724 ppid:19363 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
rtnl_lock net/core/rtnetlink.c:78 [inline]
rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
sock_write_iter+0x2dc/0x420 net/socket.c:1161
call_write_iter include/linux/fs.h:2018 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x474/0x9a0 fs/read_write.c:584
ksys_write+0x151/0x260 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5a6a79e159
RSP: 002b:00007f5a6b591028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f5a6aa26090 RCX: 00007f5a6a79e159
RDX: 000000000000fe33 RSI: 0000200000000100 RDI: 0000000000000005
RBP: 00007f5a6a83506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5a6aa26128 R14: 00007f5a6aa26090 R15: 00007ffca9e8aff8
INFO: task syz.2.6281:27726 blocked for more than 158 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.6281 state:D stack:27752 pid:27726 ppid:19363 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
schedule+0xbd/0x170 kernel/sched/core.c:6775
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
dev_ioctl+0x83c/0x1140 net/core/dev_ioctl.c:794
sock_ioctl+0x74c/0x7e0 net/socket.c:1266
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f5a6a79e159
RSP: 002b:00007f5a685d3028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f5a6aa26270 RCX: 00007f5a6a79e159
RDX: 0000200000000080 RSI: 00000000000089f0 RDI: 0000000000000009
RBP: 00007f5a6a83506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5a6aa26308 R14: 00007f5a6aa26270 R15: 00007ffca9e8aff8
Showing all locks held in the system:
1 lock held by khungtaskd/29:
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8d1320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6635
3 locks held by kworker/u4:2/42:
#0: ffff88802c262538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff88802c262538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc90000b2fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc90000b2fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4730
2 locks held by getty/5538:
#0: ffff88802ce7d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
2 locks held by kworker/1:1/14774:
#0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c72d38 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc9000c7b7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc9000c7b7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
3 locks held by kworker/0:6/15179:
3 locks held by kworker/1:3/18647:
#0: ffff888017c72538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c72538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900052a7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900052a7d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x92/0xd90 net/wireless/reg.c:2463
3 locks held by kworker/1:6/27199:
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#0: ffff888017c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#1: ffffc900042cfd00 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
#1: ffffc900042cfd00 ((work_completion)(&w->work)#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
#2: ffffffff8e4409c8 (nf_conntrack_mutex){+.+.}-{3:3}, at: nf_ct_iterate_cleanup+0x3f/0x500 net/netfilter/nf_conntrack_core.c:2389
2 locks held by syz.1.6275/27693:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
#1: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline]
#1: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x306/0x880 kernel/rcu/tree_exp.h:1004
1 lock held by syz.3.6280/27708:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3525
5 locks held by syz.3.6280/27713:
2 locks held by syz.3.6280/27716:
#0: ffffffff8dbf9ce8 (ppp_mutex){+.+.}-{3:3}, at: ppp_ioctl+0xe0/0x1bc0 drivers/net/ppp/ppp_generic.c:727
#1: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: ppp_create_interface drivers/net/ppp/ppp_generic.c:3376 [inline]
#1: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: ppp_unattached_ioctl drivers/net/ppp/ppp_generic.c:1065 [inline]
#1: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: ppp_ioctl+0xaeb/0x1bc0 drivers/net/ppp/ppp_generic.c:731
1 lock held by syz.3.6280/27721:
#0: ffffffff8dbf9ce8 (ppp_mutex){+.+.}-{3:3}, at: ppp_ioctl+0xe0/0x1bc0 drivers/net/ppp/ppp_generic.c:727
1 lock held by syz.0.6279/27710:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz.2.6281/27724:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz.2.6281/27726:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x83c/0x1140 net/core/dev_ioctl.c:794
1 lock held by syz-executor/27729:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27738:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27740:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27747:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27754:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27760:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27762:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27766:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
2 locks held by dhcpcd/27772:
#0: ffff8880397bc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff8880397bc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3283
#1: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#1: ffffffff8d137ab8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3da/0x880 kernel/rcu/tree_exp.h:1004
1 lock held by syz-executor/27774:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27781:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27783:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/27786:
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8e3d0988 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by dhcpcd/27788:
#0: ffff888086722130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888086722130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3283
1 lock held by dhcpcd/27789:
#0: ffff888086f3c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff888086f3c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3283
1 lock held by dhcpcd/27790:
#0: ffff8880867bc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff8880867bc130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3283
1 lock held by dhcpcd/27791:
#0: ffff8880871c6130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff8880871c6130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3283
1 lock held by dhcpcd/27792:
#0: ffff88808764e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1780 [inline]
#0: ffff88808764e130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x33/0xd40 net/packet/af_packet.c:3283
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf59/0xfa0 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 27713 Comm: syz.3.6280 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:84 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:127 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:178 [inline]
RIP: 0010:kasan_check_range+0x7f/0x290 mm/kasan/generic.c:187
Code: 49 c1 e9 03 48 bb 01 00 00 00 00 fc ff df 4d 8d 34 19 4d 89 f4 4d 29 dc 49 83 fc 10 7f 29 4d 85 e4 0f 84 3d 01 00 00 4c 89 cb <48> f7 d3 4c 01 fb 41 80 3b 00 0f 85 8d 01 00 00 49 ff c3 48 ff c3
RSP: 0018:ffffc900000066d8 EFLAGS: 00000002
RAX: ffffc90000007601 RBX: 1ffff92000000d17 RCX: ffffffff813bc9f8
RDX: 0000000000000001 RSI: 0000000000000010 RDI: ffffc900000068b0
RBP: 0000000000000000 R08: ffffc900000068bf R09: 1ffff92000000d17
R10: dffffc0000000000 R11: fffff52000000d16 R12: 0000000000000002
R13: ffffc90000006860 R14: fffff52000000d18 R15: 1ffff92000000d16
FS: 00007fd2358c46c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100000001 CR3: 0000000079874000 CR4: 00000000003506f0
DR0: ffff8880b8e27e90 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000200000000300 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
__asan_memset+0x22/0x40 mm/kasan/shadow.c:84
unwind_next_frame+0x1628/0x2990 arch/x86/kernel/unwind_orc.c:592
perf_callchain_kernel+0x42e/0x690 arch/x86/events/core.c:2780
get_perf_callchain+0x231/0x510 kernel/events/callchain.c:204
perf_callchain kernel/events/core.c:7742 [inline]
perf_sample_save_callchain include/linux/perf_event.h:1232 [inline]
perf_prepare_sample+0x3c7/0x1db0 kernel/events/core.c:7786
__perf_event_output kernel/events/core.c:7974 [inline]
perf_event_output_forward+0x187/0x3e0 kernel/events/core.c:7995
__perf_event_overflow+0x461/0x660 kernel/events/core.c:9720
perf_swevent_overflow kernel/events/core.c:9803 [inline]
perf_swevent_event+0x319/0x570 kernel/events/core.c:9854
perf_tp_event+0x620/0x1550 kernel/events/core.c:10381
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10300
perf_trace_preemptirq_template+0x269/0x330 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbb/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:80 [inline]
RIP: 0010:__orc_find arch/x86/kernel/unwind_orc.c:102 [inline]
RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:227 [inline]
RIP: 0010:unwind_next_frame+0x4ac/0x2990 arch/x86/kernel/unwind_orc.c:494
Code: c1 48 c1 f9 02 48 c1 e8 3f 48 01 c8 48 83 e0 fe 4d 8d 7c 45 00 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df 0f b6 04 08 <84> c0 75 34 4d 63 27 4d 01 fc 4c 89 e7 4c 89 f6 e8 cf d4 4b 00 49
RSP: 0018:ffffc90000007238 EFLAGS: 00000a06
RAX: 0000000000000000 RBX: ffffffff8e9b7a7c RCX: dffffc0000000000
RDX: ffff888065eb3c00 RSI: 000000000000af51 RDI: 000000000000af58
RBP: ffffffff8e9b7a64 R08: ffffc900000073d0 R09: 0000000000000016
R10: 0000000000000004 R11: 0000000000000100 R12: 000000000000af51
R13: ffffffff8e9b7a64 R14: ffffffff8133204c R15: ffffffff8e9b7a70
arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
ref_tracker_alloc+0x163/0x4b0 lib/ref_tracker.c:203
__netdev_tracker_alloc include/linux/netdevice.h:4159 [inline]
netdev_hold include/linux/netdevice.h:4188 [inline]
dst_init+0xc0/0x470 net/core/dst.c:52
dst_alloc+0x12e/0x170 net/core/dst.c:94
ip6_dst_alloc net/ipv6/route.c:344 [inline]
icmp6_dst_alloc+0x7c/0x400 net/ipv6/route.c:3320
ndisc_send_skb+0x422/0x1480 net/ipv6/ndisc.c:493
addrconf_rs_timer+0x36b/0x640 net/ipv6/addrconf.c:4036
call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x570/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:rcu_read_unlock_special+0x83/0x4d0 kernel/rcu/tree_plugin.h:763
Code: eb 03 48 b8 f1 f1 f1 f1 f8 f2 f2 f2 4a 89 04 2b 42 c7 44 2b 08 f8 f3 f3 f3 65 44 8b 35 de 9a 91 7e 41 f7 c6 00 00 f0 00 74 40 <48> c7 44 24 20 0e 36 e0 45 4a c7 04 2b 00 00 00 00 42 c7 44 2b 08
RSP: 0018:ffffc9000e35ee20 EFLAGS: 00000206
RAX: 38d848dab281bf00 RBX: 1ffff92001c6bdc8 RCX: 38d848dab281bf00
RDX: dffffc0000000000 RSI: ffffffff8acacce0 RDI: ffffffff8b1d3ba0
RBP: ffffc9000e35eee8 R08: ffffffff8e8c316f R09: 1ffffffff1d1862d
R10: dffffc0000000000 R11: fffffbfff1d1862e R12: ffffffff8d137300
R13: dffffc0000000000 R14: ffff8880b8e3d190 R15: 1ffff110171c7a32
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
is_bpf_text_address+0x27e/0x2a0 kernel/bpf/core.c:744
kernel_text_address+0xa0/0xd0 kernel/extable.c:125
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x5d/0xc0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0x11d/0x190 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1811 [inline]
slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
slab_free mm/slub.c:3830 [inline]
kmem_cache_free+0xf8/0x290 mm/slub.c:3852
mmdrop include/linux/sched/mm.h:54 [inline]
mmdrop_sched include/linux/sched/mm.h:82 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:109 [inline]
finish_task_switch+0x3da/0x8f0 kernel/sched/core.c:5281
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x15b6/0x4660 kernel/sched/core.c:6701
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6868
preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6892
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x111/0x120 kernel/locking/spinlock.c:194
rcu_report_exp_rnp kernel/rcu/tree_exp.h:225 [inline]
rcu_preempt_deferred_qs_irqrestore+0x85e/0xc30 kernel/rcu/tree_plugin.h:570
rcu_read_unlock_special+0x3ca/0x4d0 kernel/rcu/tree_plugin.h:762
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
sched_mm_cid_remote_clear_old kernel/sched/core.c:11941 [inline]
task_mm_cid_work+0x217/0x770 kernel/sched/core.c:11998
task_work_run+0x1d4/0x260 kernel/task_work.c:245
get_signal+0x11da/0x1390 kernel/signal.c:2691
arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
__syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd23499e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd2358c40e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000000 RBX: 00007fd234c26098 RCX: 00007fd23499e159
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fd234c2609c
RBP: 00007fd234c26090 R08: 0000000000745a1d R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fd234c26128 R14: 00007ffcab8155b0 R15: 00007ffcab815698