INFO: task syz-executor.4:3705 blocked for more than 143 seconds. Not tainted 5.1.0-rc5-next-20190418 #28 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28520 3705 13576 0x00004004 Call Trace: context_switch kernel/sched/core.c:2817 [inline] __schedule+0x7d1/0x15c0 kernel/sched/core.c:3444 schedule+0xa8/0x260 kernel/sched/core.c:3508 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3567 __mutex_lock_common kernel/locking/mutex.c:1002 [inline] __mutex_lock+0x726/0x1310 kernel/locking/mutex.c:1072 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087 rtnl_lock+0x17/0x20 net/core/rtnetlink.c:76 dev_ioctl+0x289/0xe30 net/core/dev_ioctl.c:488 sock_do_ioctl+0x1bd/0x300 net/socket.c:1060 sock_ioctl+0x32b/0x610 net/socket.c:1168 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458c29 Code: Bad RIP value. RSP: 002b:00007f3cd2e5bc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29 RDX: 0000000020000240 RSI: 0000000000008990 RDI: 0000000000000005 RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3cd2e5c6d4 R13: 00000000004c42bc R14: 00000000004d7ad8 R15: 00000000ffffffff INFO: task syz-executor.4:3727 blocked for more than 143 seconds. Not tainted 5.1.0-rc5-next-20190418 #28 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D27560 3727 13576 0x00004004 Call Trace: context_switch kernel/sched/core.c:2817 [inline] __schedule+0x7d1/0x15c0 kernel/sched/core.c:3444 schedule+0xa8/0x260 kernel/sched/core.c:3508 synchronize_rcu_expedited+0x431/0x5b0 kernel/rcu/tree_exp.h:807 synchronize_net+0x3b/0x60 net/core/dev.c:9277 dev_deactivate_many+0x46f/0xb60 net/sched/sch_generic.c:1203 __dev_close_many+0x13d/0x300 net/core/dev.c:1480 dev_close_many+0x25b/0x6f0 net/core/dev.c:1518 dev_close.part.0+0x11a/0x1e0 net/core/dev.c:1544 dev_close+0x63/0x80 net/core/dev.c:1547 __bond_release_one.cold+0x83c/0xe6f drivers/net/bonding/bond_main.c:2004 bond_release drivers/net/bonding/bond_main.c:2030 [inline] bond_do_ioctl+0x416/0x870 drivers/net/bonding/bond_main.c:3557 dev_ifsioc+0x257/0x990 net/core/dev_ioctl.c:322 dev_ioctl+0x297/0xe30 net/core/dev_ioctl.c:489 sock_do_ioctl+0x1bd/0x300 net/socket.c:1060 sock_ioctl+0x32b/0x610 net/socket.c:1168 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458c29 Code: Bad RIP value. RSP: 002b:00007f3cd2e19c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458c29 RDX: 00000000200000c0 RSI: 0000000000008991 RDI: 0000000000000005 RBP: 000000000073c0e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3cd2e1a6d4 R13: 00000000004c42bc R14: 00000000004d7ad8 R15: 00000000ffffffff INFO: task syz-executor.2:3712 blocked for more than 144 seconds. Not tainted 5.1.0-rc5-next-20190418 #28 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D28240 3712 7478 0x00004004 Call Trace: context_switch kernel/sched/core.c:2817 [inline] __schedule+0x7d1/0x15c0 kernel/sched/core.c:3444 schedule+0xa8/0x260 kernel/sched/core.c:3508 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3567 __mutex_lock_common kernel/locking/mutex.c:1002 [inline] __mutex_lock+0x726/0x1310 kernel/locking/mutex.c:1072 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087 __netlink_dump_start+0x10c/0x7e0 net/netlink/af_netlink.c:2325 netlink_dump_start include/linux/netlink.h:226 [inline] rtnetlink_rcv_msg+0x73f/0xb00 net/core/rtnetlink.c:5158 netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2486 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5213 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline] netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1337 netlink_sendmsg+0x8a5/0xd60 net/netlink/af_netlink.c:1926 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xdd/0x130 net/socket.c:661 __sys_sendto+0x262/0x380 net/socket.c:1932 __do_sys_sendto net/socket.c:1944 [inline] __se_sys_sendto net/socket.c:1940 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1940 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458c29 Code: Bad RIP value. RSP: 002b:00007f6a22ba7c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000458c29 RDX: 0000000000000012 RSI: 0000000020000140 RDI: 0000000000000003 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6a22ba86d4 R13: 00000000004c6580 R14: 00000000004daf28 R15: 00000000ffffffff INFO: task syz-executor.2:3718 blocked for more than 145 seconds. Not tainted 5.1.0-rc5-next-20190418 #28 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D28336 3718 7478 0x00004006 Call Trace: context_switch kernel/sched/core.c:2817 [inline] __schedule+0x7d1/0x15c0 kernel/sched/core.c:3444 schedule+0xa8/0x260 kernel/sched/core.c:3508 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3567 __mutex_lock_common kernel/locking/mutex.c:1002 [inline] __mutex_lock+0x726/0x1310 kernel/locking/mutex.c:1072 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:1087 netlink_dump+0xe7/0xfb0 net/netlink/af_netlink.c:2208 netlink_recvmsg+0xb9f/0xf10 net/netlink/af_netlink.c:2009 sock_recvmsg_nosec net/socket.c:881 [inline] sock_recvmsg net/socket.c:888 [inline] sock_recvmsg+0xd0/0x110 net/socket.c:884 ___sys_recvmsg+0x273/0x5a0 net/socket.c:2422 do_recvmmsg+0x27e/0x7a0 net/socket.c:2535 __sys_recvmmsg+0xe5/0x270 net/socket.c:2616 __do_sys_recvmmsg net/socket.c:2637 [inline] __se_sys_recvmmsg net/socket.c:2630 [inline] __x64_sys_recvmmsg+0xe6/0x140 net/socket.c:2630 do_syscall_64+0x103/0x670 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458c29 Code: Bad RIP value. RSP: 002b:00007f6a22b86c78 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000458c29 RDX: 04000000000001de RSI: 00000000200037c0 RDI: 0000000000000003 RBP: 000000000073bfa0 R08: 0000000020003700 R09: 0000000000000000 R10: 000000000000000a R11: 0000000000000246 R12: 00007f6a22b876d4 R13: 00000000004c5b80 R14: 00000000004da118 R15: 00000000ffffffff Showing all locks held in the system: 3 locks held by kworker/0:1/12: 1 lock held by khungtaskd/1042: #0: 0000000030f4edda (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e kernel/locking/lockdep.c:5046 1 lock held by rsyslogd/7345: #0: 00000000c22477e7 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110 fs/file.c:801 2 locks held by getty/7435: #0: 0000000028737c47 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 00000000e5493237 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156 2 locks held by getty/7436: #0: 000000004e7e371d (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 0000000055ab4fd5 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156 2 locks held by getty/7437: #0: 00000000480f529e (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 000000001a42f764 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156 2 locks held by getty/7438: #0: 00000000d9d7cf0c (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 00000000287bcead (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156 2 locks held by getty/7439: #0: 0000000067b855cf (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 00000000a8763d5e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156 2 locks held by getty/7440: #0: 0000000071ea3177 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 00000000b8d392be (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156 2 locks held by getty/7441: #0: 0000000054d5f05a (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:341 #1: 0000000047c6cb14 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70 drivers/tty/n_tty.c:2156 1 lock held by syz-executor.2/13298: #0: 000000002f80ee2c (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236 1 lock held by syz-executor.2/20398: #0: 000000005c65ccc0 (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline] #0: 000000005c65ccc0 (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598 3 locks held by kworker/u4:0/4505: #0: 0000000070829e24 (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1168 [inline] #0: 0000000070829e24 (&rq->lock){-.-.}, at: __schedule+0x1f5/0x15c0 kernel/sched/core.c:3396 #1: 0000000030f4edda (rcu_read_lock){....}, at: trace_sched_stat_runtime include/trace/events/sched.h:435 [inline] #1: 0000000030f4edda (rcu_read_lock){....}, at: update_curr+0x2ce/0x8a0 kernel/sched/fair.c:842 #2: 00000000491206a7 (&base->lock){-.-.}, at: lock_timer_base+0x56/0x1b0 kernel/time/timer.c:932 4 locks held by kworker/u4:2/6896: #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: __write_once_size include/linux/compiler.h:224 [inline] #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:855 [inline] #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:40 [inline] #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: set_work_data kernel/workqueue.c:619 [inline] #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:646 [inline] #0: 00000000fd2a5938 ((wq_completion)netns){+.+.}, at: process_one_work+0x87e/0x1790 kernel/workqueue.c:2239 #1: 00000000b710ecb0 (net_cleanup_work){+.+.}, at: process_one_work+0x8b4/0x1790 kernel/workqueue.c:2243 #2: 0000000002969571 (pernet_ops_rwsem){++++}, at: cleanup_net+0xae/0x960 net/core/net_namespace.c:519 #3: 00000000ad664485 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:76 1 lock held by syz-executor.2/13864: #0: 000000002f80ee2c (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236 1 lock held by syz-executor.4/19301: #0: 000000002f80ee2c (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236 1 lock held by syz-executor.2/23337: #0: 000000002f80ee2c (event_mutex){+.+.}, at: perf_trace_destroy+0x28/0x100 kernel/trace/trace_event_perf.c:236 1 lock held by syz-executor.2/25994: #0: 0000000012a83a0e (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline] #0: 0000000012a83a0e (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598 2 locks held by syz-executor.2/26008: #0: 00000000c76b30c5 (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline] #0: 00000000c76b30c5 (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598 #1: 0000000097776351 (rcu_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:318 [inline] #1: 0000000097776351 (rcu_state.exp_mutex){+.+.}, at: synchronize_rcu_expedited+0x26f/0x5b0 kernel/rcu/tree_exp.h:790 1 lock held by syz-executor.4/26766: #0: 00000000577b4564 (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline] #0: 00000000577b4564 (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598 1 lock held by syz-executor.4/26772: #0: 000000009d0a6cbb (&sb->s_type->i_mutex_key#11){+.+.}, at: inode_lock include/linux/fs.h:772 [inline] #0: 000000009d0a6cbb (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x2b0 net/socket.c:598 1 lock held by syz-executor.4/3705: #0: 00000000ad664485 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:76 2 locks held by syz-executor.4/3727: #0: 00000000ad664485 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:76 #1: 0000000097776351 (rcu_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:286 [inline] #1: 0000000097776351 (rcu_state.exp_mutex){+.+.}, at: synchronize_rcu_expedited+0x4ab/0x5b0 kernel/rcu/tree_exp.h:790 1 lock held by syz-executor.2/3712: #0: 00000000ad664485 (rtnl_mutex){+.+.}, at: __netlink_dump_start+0x10c/0x7e0 net/netlink/af_netlink.c:2325 1 lock held by syz-executor.2/3718: #0: 00000000ad664485 (rtnl_mutex){+.+.}, at: netlink_dump+0xe7/0xfb0 net/netlink/af_netlink.c:2208 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1042 Comm: khungtaskd Not tainted 5.1.0-rc5-next-20190418 #28 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 nmi_cpu_backtrace.cold+0x63/0xa4 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1be/0x236 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:204 [inline] watchdog+0x9b7/0xec0 kernel/hung_task.c:288 kthread+0x357/0x430 kernel/kthread.c:254 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 1 to CPUs 0: