INFO: task syz-executor.0:12954 blocked for more than 143 seconds. Not tainted 6.2.0-rc1-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor.0 state:D stack:26408 pid:12954 ppid:5106 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:5244 [inline] __schedule+0xb8a/0x5450 kernel/sched/core.c:6555 schedule+0xde/0x1b0 kernel/sched/core.c:6631 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6690 __mutex_lock_common kernel/locking/mutex.c:679 [inline] __mutex_lock+0xa48/0x1360 kernel/locking/mutex.c:747 ipmr_net_exit_batch+0x15/0xa0 net/ipv4/ipmr.c:3113 ops_exit_list+0x125/0x170 net/core/net_namespace.c:174 setup_net+0x9bd/0xe60 net/core/net_namespace.c:356 copy_net_ns+0x31b/0x6b0 net/core/net_namespace.c:483 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 copy_namespaces+0x3b3/0x4a0 kernel/nsproxy.c:179 copy_process+0x30d3/0x7520 kernel/fork.c:2269 kernel_clone+0xeb/0x990 kernel/fork.c:2681 __do_sys_clone3+0x1cd/0x2e0 kernel/fork.c:2980 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f022308c0a9 RSP: 002b:00007f0223d37038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 RAX: ffffffffffffffda RBX: 00007f02231abf80 RCX: 00007f022308c0a9 RDX: 0000000000000000 RSI: 0000000000000058 RDI: 00007f0223d37050 RBP: 00007f02230e7ae9 R08: 0000000000000000 R09: 0000000000000058 R10: 00007f0223d37050 R11: 0000000000000246 R12: 0000000000000058 R13: 00007ffc8b29b0df R14: 00007f0223d37300 R15: 0000000000022000 Showing all locks held in the system: 2 locks held by init/1: #0: ffff8880269b05a0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:811 [inline] ffff8880269b05a0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_fault+0x1552/0x23f0 mm/filemap.c:3161 #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4747 [inline] #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4772 [inline] #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0x808/0x23d0 mm/page_alloc.c:5178 1 lock held by rcu_tasks_kthre/12: #0: ffffffff8c790c70 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 kernel/rcu/tasks.h:507 1 lock held by rcu_tasks_trace/13: #0: ffffffff8c790970 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x26/0xc70 kernel/rcu/tasks.h:507 1 lock held by khungtaskd/28: #0: ffffffff8c7917c0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x57/0x264 kernel/locking/lockdep.c:6494 1 lock held by kswapd0/78: 1 lock held by syslogd/4411: #0: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4747 [inline] #0: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4772 [inline] #0: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0x808/0x23d0 mm/page_alloc.c:5178 4 locks held by udevd/4429: #0: ffffffff8c87bff0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap+0x106/0x10b0 kernel/fork.c:591 #1: ffff88807de83e98 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #1: ffff88807de83e98 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap+0x127/0x10b0 kernel/fork.c:592 #2: ffff88802040f318 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:78 [inline] #2: ffff88802040f318 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap+0x178/0x10b0 kernel/fork.c:601 #3: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4747 [inline] #3: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4772 [inline] #3: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0x808/0x23d0 mm/page_alloc.c:5178 2 locks held by dhcpcd/4641: #0: ffff8880269ce9f0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_invalidate_lock_shared include/linux/fs.h:811 [inline] #0: ffff8880269ce9f0 (mapping.invalidate_lock){++++}-{3:3}, at: filemap_fault+0x1552/0x23f0 mm/filemap.c:3161 #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4747 [inline] #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4772 [inline] #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0x808/0x23d0 mm/page_alloc.c:5178 4 locks held by dhcpcd/4642: #0: ffffffff8c87bff0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap+0x106/0x10b0 kernel/fork.c:591 #1: ffff88801246f318 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #1: ffff88801246f318 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap+0x127/0x10b0 kernel/fork.c:592 #2: ffff8880768b6198 (&mm->mmap_lock/1){+.+.}-{3:3}, at: mmap_write_lock_nested include/linux/mmap_lock.h:78 [inline] #2: ffff8880768b6198 (&mm->mmap_lock/1){+.+.}-{3:3}, at: dup_mmap+0x178/0x10b0 kernel/fork.c:601 #3: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4747 [inline] #3: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4772 [inline] #3: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0x808/0x23d0 mm/page_alloc.c:5178 2 locks held by getty/4751: #0: ffff88802b86b098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x26/0x80 drivers/tty/tty_ldisc.c:244 #1: ffffc900015a02f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xef4/0x13e0 drivers/tty/n_tty.c:2177 2 locks held by syz-fuzzer/5063: #0: ffff888029030a18 (&mm->mmap_lock){++++}-{3:3}, at: mmap_read_trylock include/linux/mmap_lock.h:136 [inline] #0: ffff888029030a18 (&mm->mmap_lock){++++}-{3:3}, at: do_user_addr_fault+0x276/0x1210 arch/x86/mm/fault.c:1369 #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __perform_reclaim mm/page_alloc.c:4747 [inline] #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_direct_reclaim mm/page_alloc.c:4772 [inline] #1: ffffffff8c8d4e40 (fs_reclaim){+.+.}-{0:0}, at: __alloc_pages_slowpath.constprop.0+0x808/0x23d0 mm/page_alloc.c:5178 1 lock held by syz-fuzzer/5101: #0: ffff888029030a18 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline] #0: ffff888029030a18 (&mm->mmap_lock){++++}-{3:3}, at: do_madvise.part.0+0x147/0x340 mm/madvise.c:1437 1 lock held by syz-executor.5/5107: #0: ffffffff8e0bdbe8 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:697 [inline] #0: ffffffff8e0bdbe8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3e/0x230 drivers/net/tun.c:3468 2 locks held by syz-executor.3/5124: #0: ffffffff8e0bdbe8 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:697 [inline] #0: ffffffff8e0bdbe8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3e/0x230 drivers/net/tun.c:3468