INFO: task kworker/u4:5:1011 blocked for more than 165 seconds.
Not tainted 5.15.0-rc3-next-20211001-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:5 state:D stack:24440 pid: 1011 ppid: 2 flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
context_switch kernel/sched/core.c:4955 [inline]
__schedule+0x940/0x26f0 kernel/sched/core.c:6236
schedule+0xd3/0x270 kernel/sched/core.c:6315
schedule_timeout+0x1db/0x2a0 kernel/time/timer.c:1857
do_wait_for_common kernel/sched/completion.c:85 [inline]
__wait_for_common kernel/sched/completion.c:106 [inline]
wait_for_common kernel/sched/completion.c:117 [inline]
wait_for_completion+0x176/0x280 kernel/sched/completion.c:138
rcu_barrier+0x2db/0x440 kernel/rcu/tree.c:4061
l2tp_exit_net+0x247/0x500 net/l2tp/l2tp_core.c:1669
ops_exit_list+0xb0/0x160 net/core/net_namespace.c:168
cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:593
process_one_work+0x9b2/0x1690 kernel/workqueue.c:2297
worker_thread+0x658/0x11f0 kernel/workqueue.c:2444
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
INFO: task syz-executor.2:30173 can't die for more than 165 seconds.
task:syz-executor.2 state:R running task stack:26808 pid:30173 ppid: 29771 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:4955 [inline]
__schedule+0x940/0x26f0 kernel/sched/core.c:6236
schedule+0xd3/0x270 kernel/sched/core.c:6315
exit_to_user_mode_loop kernel/entry/common.c:163 [inline]
exit_to_user_mode_prepare+0x14a/0x290 kernel/entry/common.c:207
__syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f217954c8d9
RSP: 002b:00007f2176a60188 EFLAGS: 00000246 ORIG_RAX: 0000000000000055
RAX: fffffffffffffffb RBX: 00007f21796511a0 RCX: 00007f217954c8d9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000080
RBP: 00007f21795a6cb4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc784be57f R14: 00007f2176a60300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by ksoftirqd/1/19:
1 lock held by khungtaskd/27:
#0: ffffffff8b981260 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6458
1 lock held by kswapd0/97:
4 locks held by kworker/u4:5/1011:
#0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
#0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
#0: ffff88814007b138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268
#1: ffffc90004577db0 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272
#2: ffffffff8d0d4190 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x9b/0xb00 net/core/net_namespace.c:555
#3: ffffffff8b98a4f0 (rcu_state.barrier_mutex){+.+.}-{3:3}, at: rcu_barrier+0x44/0x440 kernel/rcu/tree.c:3996
1 lock held by in:imklog/6231:
3 locks held by kworker/1:17/11533:
2 locks held by kworker/u4:8/13206:
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268
#1: ffffc90004617db0 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272
2 locks held by kworker/1:0/25941:
#0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
#0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
#0: ffff888010c66538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268
#1: ffffc90004517db0 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272
3 locks held by kworker/1:2/31180:
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
#0: ffff888010c64d38 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268
#1: ffffc9000ab8fdb0 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272
#2: ffffffff8b98a5e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
#2: ffffffff8b98a5e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x4fc/0x620 kernel/rcu/tree_exp.h:839
4 locks held by syz-executor.1/31280:
#0: ffff88807e4dcff0 (&hdev->req_lock){+.+.}-{3:3}, at: hci_dev_do_close+0xb7/0x1150 net/bluetooth/hci_core.c:1614
#1: ffff88807e4dc078 (&hdev->lock){+.+.}-{3:3}, at: hci_dev_do_close+0x283/0x1150 net/bluetooth/hci_core.c:1659
#2: ffffffff8d2fb108 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_disconn_cfm include/net/bluetooth/hci_core.h:1540 [inline]
#2: ffffffff8d2fb108 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_hash_flush+0xda/0x260 net/bluetooth/hci_conn.c:1742
#3: ffffffff8b98a5e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
#3: ffffffff8b98a5e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d5/0x620 kernel/rcu/tree_exp.h:839
=============================================
NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.0-rc3-next-20211001-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
nmi_cpu_backtrace.cold+0x47/0x144 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1ae/0x220 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:254 [inline]
watchdog+0xcb7/0xed0 kernel/hung_task.c:339
kthread+0x405/0x4f0 kernel/kthread.c:327
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 2965 Comm: systemd-journal Not tainted 5.15.0-rc3-next-20211001-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:qlink_to_object mm/kasan/quarantine.c:129 [inline]
RIP: 0010:qlink_free mm/kasan/quarantine.c:134 [inline]
RIP: 0010:qlist_free_all+0x46/0xc0 mm/kasan/quarantine.c:165
Code: 49 be 00 00 00 00 00 ea ff ff 49 89 fd 49 bc 00 00 00 00 00 fc ff df eb 2d 48 63 87 c0 00 00 00 48 c7 c2 65 d7 bc 81 4c 8b 3e <48> 29 c6 48 89 f0 48 c1 e8 03 42 c6 04 20 fb e8 16 c3 ff ff 4d 85
RSP: 0018:ffffc90002a47d78 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888019b69300 RCX: ffffea0002bd303f
RDX: ffffffff81bcd765 RSI: ffff8880af4c03a0 RDI: ffff8880118ba8c0
RBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000002e
R10: ffffffff8134bdba R11: 000000000000003f R12: dffffc0000000000
R13: ffffc90002a47db0 R14: ffffea0000000000 R15: ffff8880af4c02b8
FS: 00007f4f74bfa8c0(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4f71b17000 CR3: 000000001b7ff000 CR4: 00000000003506e0
Call Trace:
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272
__kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:444
kasan_slab_alloc include/linux/kasan.h:259 [inline]
slab_post_alloc_hook mm/slab.h:519 [inline]
slab_alloc_node mm/slub.c:3213 [inline]
slab_alloc mm/slub.c:3221 [inline]
kmem_cache_alloc+0x209/0x390 mm/slub.c:3226
prepare_creds+0x3f/0x7b0 kernel/cred.c:262
access_override_creds fs/open.c:351 [inline]
do_faccessat+0x3f4/0x850 fs/open.c:415
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f4f73eb59c7
Code: 83 c4 08 48 3d 01 f0 ff ff 73 01 c3 48 8b 0d c8 d4 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 15 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a1 d4 2b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe027a5078 EFLAGS: 00000246 ORIG_RAX: 0000000000000015
RAX: ffffffffffffffda RBX: 00007ffe027a7f90 RCX: 00007f4f73eb59c7
RDX: 00007f4f74926a00 RSI: 0000000000000000 RDI: 00005580e394b9a3
RBP: 00007ffe027a50b0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ffe027a7f90 R15: 00007ffe027a55a0
----------------
Code disassembly (best guess):
0: 49 be 00 00 00 00 00 movabs $0xffffea0000000000,%r14
7: ea ff ff
a: 49 89 fd mov %rdi,%r13
d: 49 bc 00 00 00 00 00 movabs $0xdffffc0000000000,%r12
14: fc ff df
17: eb 2d jmp 0x46
19: 48 63 87 c0 00 00 00 movslq 0xc0(%rdi),%rax
20: 48 c7 c2 65 d7 bc 81 mov $0xffffffff81bcd765,%rdx
27: 4c 8b 3e mov (%rsi),%r15
* 2a: 48 29 c6 sub %rax,%rsi <-- trapping instruction
2d: 48 89 f0 mov %rsi,%rax
30: 48 c1 e8 03 shr $0x3,%rax
34: 42 c6 04 20 fb movb $0xfb,(%rax,%r12,1)
39: e8 16 c3 ff ff callq 0xffffc354
3e: 4d rex.WRB
3f: 85 .byte 0x85