INFO: task kworker/u4:5:1011 blocked for more than 165 seconds. Not tainted 5.15.0-rc3-next-20211001-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:5 state:D stack:24440 pid: 1011 ppid: 2 flags:0x00004000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:4955 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6236 schedule+0xd3/0x270 kernel/sched/core.c:6315 schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857 do_wait_for_common kernel/sched/completion.c:85 [inline] __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x176/0x280 kernel/sched/completion.c:138 rcu_barrier+0x2db/0x440 kernel/rcu/tree.c:4061 l2tp_exit_net+0x247/0x500 net/l2tp/l2tp_core.c:1669 ops_exit_list+0xb0/0x160 net/core/net_namespace.c:168 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:593 process_one_work+0x9b2/0x1690 kernel/workqueue.c:2297 worker_thread+0x658/0x11f0 kernel/workqueue.c:2444 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 INFO: task syz-executor.2:30173 can't die for more than 165 seconds. task:syz-executor.2 state:R running task stack:26808 pid:30173 ppid: 29771 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:4955 [inline] __schedule+0x940/0x26f0 kernel/sched/core.c:6236 schedule+0xd3/0x270 kernel/sched/core.c:6315 exit_to_user_mode_loop kernel/entry/common.c:163 [inline] exit_to_user_mode_prepare+0x14a/0x290 kernel/entry/common.c:207 __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f217954c8d9 RSP: 002b:00007f2176a60188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055 RAX: fffffffffffffffb RBX: 00007f21796511a0 RCX: 00007f217954c8d9 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000080 RBP: 00007f21795a6cb4 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc784be57f R14: 00007f2176a60300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by ksoftirqd/1/19: 1 lock held by khungtaskd/27: #0: ffffffff8b981260 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458 1 lock held by kswapd0/97: 4 locks held by kworker/u4:5/1011: #0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268 #1: ffffc90004577db0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272 #2: ffffffff8d0d4190 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xb00 net/core/net_namespace.c:555 #3: ffffffff8b98a4f0 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x44/0x440 kernel/rcu/tree.c:3996 1 lock held by in:imklog/6231: 3 locks held by kworker/1:17/11533: 2 locks held by kworker/u4:8/13206: #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268 #1: ffffc90004617db0 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272 2 locks held by kworker/1:0/25941: #0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268 #1: ffffc90004517db0 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272 3 locks held by kworker/1:2/31180: #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline] #0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268 #1: ffffc9000ab8fdb0 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272 #2: ffffffff8b98a5e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #2: ffffffff8b98a5e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x4fc/0x620 kernel/rcu/tree_exp.h:839 4 locks held by syz-executor.1/31280: #0: ffff88807e4dcff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0xb7/0x1150 net/bluetooth/hci_core.c:1614 #1: ffff88807e4dc078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x283/0x1150 net/bluetooth/hci_core.c:1659 #2: ffffffff8d2fb108 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1540 [inline] #2: ffffffff8d2fb108 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1742 #3: ffffffff8b98a5e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #3: ffffffff8b98a5e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d5/0x620 kernel/rcu/tree_exp.h:839 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-rc3-next-20211001-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:254 [inline] watchdog+0xcb7/0xed0 kernel/hung_task.c:339 kthread+0x405/0x4f0 kernel/kthread.c:327 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 2965 Comm: systemd-journal Not tainted 5.15.0-rc3-next-20211001-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:qlink_to_object mm/kasan/quarantine.c:129 [inline] RIP: 0010:qlink_free mm/kasan/quarantine.c:134 [inline] RIP: 0010:qlist_free_all+0x46/0xc0 mm/kasan/quarantine.c:165 Code: 49 be 00 00 00 00 00 ea ff ff 49 89 fd 49 bc 00 00 00 00 00 fc ff df eb 2d 48 63 87 c0 00 00 00 48 c7 c2 65 d7 bc 81 4c 8b 3e <48> 29 c6 48 89 f0 48 c1 e8 03 42 c6 04 20 fb e8 16 c3 ff ff 4d 85 RSP: 0018:ffffc90002a47d78 EFLAGS: 00000246 RAX: 0000000000000000 RBX: ffff888019b69300 RCX: ffffea0002bd303f RDX: ffffffff81bcd765 RSI: ffff8880af4c03a0 RDI: ffff8880118ba8c0 RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000002e R10: ffffffff8134bdba R11: 000000000000003f R12: dffffc0000000000 R13: ffffc90002a47db0 R14: ffffea0000000000 R15: ffff8880af4c02b8 FS: 00007f4f74bfa8c0(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4f71b17000 CR3: 000000001b7ff000 CR4: 00000000003506e0 Call Trace: kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:259 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:3213 [inline] slab_alloc mm/slub.c:3221 [inline] kmem_cache_alloc+0x209/0x390 mm/slub.c:3226 prepare_creds+0x3f/0x7b0 kernel/cred.c:262 access_override_creds fs/open.c:351 [inline] do_faccessat+0x3f4/0x850 fs/open.c:415 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f4f73eb59c7 Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffe027a5078 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 00007ffe027a7f90 RCX: 00007f4f73eb59c7 RDX: 00007f4f74926a00 RSI: 0000000000000000 RDI: 00005580e394b9a3 RBP: 00007ffe027a50b0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffe027a7f90 R15: 00007ffe027a55a0 ---------------- Code disassembly (best guess): 0: 49 be 00 00 00 00 00 movabs $0xffffea0000000000,%r14 7: ea ff ff a: 49 89 fd mov %rdi,%r13 d: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12 14: fc ff df 17: eb 2d jmp 0x46 19: 48 63 87 c0 00 00 00 movslq 0xc0(%rdi),%rax 20: 48 c7 c2 65 d7 bc 81 mov $0xffffffff81bcd765,%rdx 27: 4c 8b 3e mov (%rsi),%r15 * 2a: 48 29 c6 sub %rax,%rsi <-- trapping instruction 2d: 48 89 f0 mov %rsi,%rax 30: 48 c1 e8 03 shr $0x3,%rax 34: 42 c6 04 20 fb movb $0xfb,(%rax,%r12,1) 39: e8 16 c3 ff ff callq 0xffffc354 3e: 4d rex.WRB 3f: 85 .byte 0x85