IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready team0: Port device team_slave_1 added IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready INFO: task syz-executor0:11721 blocked for more than 140 seconds. IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready Not tainted 4.20.0-rc3+ #341 IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor0 D20632 11721 6065 0x80000006 Call Trace: IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready context_switch kernel/sched/core.c:2831 [inline] __schedule+0x8cf/0x21d0 kernel/sched/core.c:3472 IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready schedule+0xfe/0x460 kernel/sched/core.c:3516 IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready __rwsem_down_write_failed_common+0xc9a/0x15e0 kernel/locking/rwsem-xadd.c:577 IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready rwsem_down_write_failed+0xe/0x10 kernel/locking/rwsem-xadd.c:606 call_rwsem_down_write_failed+0x17/0x30 arch/x86/lib/rwsem.S:117 __down_write arch/x86/include/asm/rwsem.h:142 [inline] down_write+0xa5/0x130 kernel/locking/rwsem.c:72 deactivate_super+0x2b3/0x320 fs/super.c:359 cleanup_mnt+0xbf/0x160 fs/namespace.c:1098 __cleanup_mnt+0x16/0x20 fs/namespace.c:1105 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x1ad6/0x26d0 kernel/exit.c:867 do_group_exit+0x177/0x440 kernel/exit.c:970 get_signal+0x8b0/0x1980 kernel/signal.c:2517 do_signal+0x9c/0x21c0 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x2e5/0x380 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457569 Code: Bad RIP value. RSP: 002b:00007f451e701cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000072bf08 RCX: 0000000000457569 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000072bf08 RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000072bf0c R13: 00007fffbc7c4d1f R14: 00007f451e7029c0 R15: 0000000000000000 bridge0: port 2(bridge_slave_1) entered blocking state bridge0: port 2(bridge_slave_1) entered forwarding state Showing all locks held in the system: bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state 3 locks held by kworker/0:1/12: #0: 00000000d1441f6b ((wq_completion)"events"){+.+.}, at: __write_once_size include/linux/compiler.h:209 [inline] #0: 00000000d1441f6b ((wq_completion)"events"){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: 00000000d1441f6b ((wq_completion)"events"){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline] #0: 00000000d1441f6b ((wq_completion)"events"){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline] #0: 00000000d1441f6b ((wq_completion)"events"){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline] #0: 00000000d1441f6b ((wq_completion)"events"){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline] #0: 00000000d1441f6b ((wq_completion)"events"){+.+.}, at: process_one_work+0xb43/0x1c40 kernel/workqueue.c:2124 #1: 00000000fef61451 (deferred_process_work){+.+.}, at: process_one_work+0xb9a/0x1c40 kernel/workqueue.c:2128 #2: 0000000097d8fcf5 (rtnl_mutex){+.+.}, at: rtnl_lock+0x17/0x20 net/core/rtnetlink.c:77 5 locks held by kworker/u4:5/432: 1 lock held by khungtaskd/1021: #0: 00000000b22f9441 (rcu_read_lock){....}, at: debug_show_all_locks+0xd0/0x424 kernel/locking/lockdep.c:4379 1 lock held by rsyslogd/5937: #0: 0000000068c17657 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x1bb/0x200 fs/file.c:766 IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready 2 locks held by getty/6027: #0: 000000001172f48b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 00000000cfb9be4b (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/6028: #0: 0000000070640d00 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 0000000097c7bf5c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/6029: #0: 00000000e287b086 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 000000002847e4b0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/6030: #0: 000000006cde8b3b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 000000000691f859 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready 2 locks held by getty/6031: IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready #0: 000000002604d292 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 000000008a0ddcdd (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/6032: #0: 000000004e56285b (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 000000004b56d527 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 2 locks held by getty/6033: #0: 0000000098c179d4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:353 #1: 00000000aaa7718c (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x335/0x1e80 drivers/tty/n_tty.c:2154 1 lock held by syz-executor0/11721: #0: 00000000af0bd1ca (&type->s_umount_key#52){++++}, at: deactivate_super+0x2b3/0x320 fs/super.c:359 bridge0: port 2(bridge_slave_1) entered blocking state 4 locks held by kworker/u4:8/16672: bridge0: port 2(bridge_slave_1) entered forwarding state bridge0: port 1(bridge_slave_0) entered blocking state bridge0: port 1(bridge_slave_0) entered forwarding state #0: 00000000657e7fa5 ((wq_completion)"%s""netns"){+.+.}, at: __write_once_size include/linux/compiler.h:209 [inline] #0: 00000000657e7fa5 ((wq_completion)"%s""netns"){+.+.}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: 00000000657e7fa5 ((wq_completion)"%s""netns"){+.+.}, at: atomic64_set include/asm-generic/atomic-instrumented.h:40 [inline] #0: 00000000657e7fa5 ((wq_completion)"%s""netns"){+.+.}, at: atomic_long_set include/asm-generic/atomic-long.h:59 [inline] #0: 00000000657e7fa5 ((wq_completion)"%s""netns"){+.+.}, at: set_work_data kernel/workqueue.c:617 [inline] #0: 00000000657e7fa5 ((wq_completion)"%s""netns"){+.+.}, at: set_work_pool_and_clear_pending kernel/workqueue.c:644 [inline] #0: 00000000657e7fa5 ((wq_completion)"%s""netns"){+.+.}, at: process_one_work+0xb43/0x1c40 kernel/workqueue.c:2124 #1: 0000000055fe1376 (net_cleanup_work){+.+.}, at: process_one_work+0xb9a/0x1c40 kernel/workqueue.c:2128 IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready #2: 000000001d953daf (pernet_ops_rwsem){++++}, at: cleanup_net+0x13f/0xb10 net/core/net_namespace.c:518 #3: 00000000e2466240 (rcu_state.barrier_mutex){+.+.}, at: rcu_barrier+0x109/0x4a0 kernel/rcu/tree.c:3077 2 locks held by syz-executor0/19477: 3 locks held by syz-executor2/19478: ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1021 Comm: khungtaskd Not tainted 4.20.0-rc3+ #341 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 nmi_cpu_backtrace.cold.2+0x5c/0xa1 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1e8/0x22a lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline] watchdog+0xb51/0x1060 kernel/hung_task.c:289 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Sending NMI from CPU 0 to CPUs 1: INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 2.083 msecs NMI backtrace for cpu 1 CPU: 1 PID: 16672 Comm: kworker/u4:8 Not tainted 4.20.0-rc3+ #341 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:__lock_acquire+0x44b/0x4c20 kernel/locking/lockdep.c:3291 Code: 83 e2 03 83 e0 01 41 09 f6 c1 e0 02 45 88 77 21 83 e1 f8 09 d1 09 c1 83 e1 f7 44 09 c9 41 88 4f 22 0f b7 55 20 41 0f b7 47 22 e2 04 83 e0 0f 09 d0 48 89 fa 66 41 89 47 22 48 c1 ea 03 48 b8 RSP: 0018:ffff8881ba5ae5b0 EFLAGS: 00000002 RAX: 0000000000000004 RBX: 000000000000033c RCX: 0000000000000004 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888183038cc4 RBP: ffff8881ba5ae940 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000000a0 R11: ffff888183038380 R12: 0000000000000004 R13: ffff888183038bec R14: 0000000000000003 R15: ffff888183038ca0 FS: 0000000000000000(0000) GS:ffff8881daf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000063f210 CR3: 00000001c75a5000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x1ed/0x520 kernel/locking/lockdep.c:3844 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] nf_conntrack_lock+0x75/0x170 net/netfilter/nf_conntrack_core.c:95 get_next_corpse net/netfilter/nf_conntrack_core.c:1881 [inline] nf_ct_iterate_cleanup+0x255/0x5e0 net/netfilter/nf_conntrack_core.c:1915 nf_ct_iterate_cleanup_net+0x237/0x2d0 net/netfilter/nf_conntrack_core.c:2000 masq_device_event+0xcf/0x100 net/ipv4/netfilter/nf_nat_masquerade_ipv4.c:100 notifier_call_chain+0x17e/0x380 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1733 call_netdevice_notifiers net/core/dev.c:1751 [inline] dev_close_many+0x40e/0x860 net/core/dev.c:1503 rollback_registered_many+0x543/0x1250 net/core/dev.c:7983 unregister_netdevice_many+0xfa/0x4c0 net/core/dev.c:9111 ip6gre_exit_batch_net+0x5cd/0x7f0 net/ipv6/ip6_gre.c:1594 ops_exit_list.isra.5+0x105/0x160 net/core/net_namespace.c:156 cleanup_net+0x555/0xb10 net/core/net_namespace.c:551 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352