INFO: task syz-executor.4:13975 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28648 13975 8138 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline] rwsem_down_read_failed+0x20a/0x390 kernel/locking/rwsem-xadd.c:309 call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94 __down_read arch/x86/include/asm/rwsem.h:83 [inline] down_read+0x44/0x80 kernel/locking/rwsem.c:26 exit_mm kernel/exit.c:512 [inline] do_exit+0x6e4/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 __do_sys_exit_group kernel/exit.c:978 [inline] __se_sys_exit_group kernel/exit.c:976 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:976 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f33d63925a9 Code: Bad RIP value. RSP: 002b:00007ffef6e1e118 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 000000000000001e RCX: 00007f33d63925a9 RDX: 00007f33d634437b RSI: ffffffffffffffb8 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000004f5e4132f3 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffef6e1e200 INFO: task syz-executor.4:13977 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28344 13977 8138 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline] rwsem_down_read_failed+0x20a/0x390 kernel/locking/rwsem-xadd.c:309 call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94 __down_read arch/x86/include/asm/rwsem.h:83 [inline] down_read+0x44/0x80 kernel/locking/rwsem.c:26 exit_mm kernel/exit.c:512 [inline] do_exit+0x6e4/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f33d63925a9 Code: Bad RIP value. RSP: 002b:00007f33d4905218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f33d64b2f88 RCX: 00007f33d63925a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f33d64b2f88 RBP: 00007f33d64b2f80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33d64b2f8c R13: 00007ffef6e1dedf R14: 00007f33d4905300 R15: 0000000000022000 INFO: task syz-executor.4:13980 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29760 13980 8138 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline] rwsem_down_read_failed+0x20a/0x390 kernel/locking/rwsem-xadd.c:309 call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94 __down_read arch/x86/include/asm/rwsem.h:83 [inline] down_read+0x44/0x80 kernel/locking/rwsem.c:26 exit_mm kernel/exit.c:512 [inline] do_exit+0x6e4/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f33d63925a9 Code: Bad RIP value. RSP: 002b:00007f33d48e4218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f33d64b3058 RCX: 00007f33d63925a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f33d64b3058 RBP: 00007f33d64b3050 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33d64b305c R13: 00007ffef6e1dedf R14: 00007f33d48e4300 R15: 0000000000022000 INFO: task syz-executor.4:13982 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29760 13982 8138 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline] rwsem_down_read_failed+0x20a/0x390 kernel/locking/rwsem-xadd.c:309 call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94 __down_read arch/x86/include/asm/rwsem.h:83 [inline] down_read+0x44/0x80 kernel/locking/rwsem.c:26 exit_mm kernel/exit.c:512 [inline] do_exit+0x6e4/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f33d63925a9 Code: Bad RIP value. RSP: 002b:00007f33d48a2218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f33d64b31f8 RCX: 00007f33d63925a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f33d64b31f8 RBP: 00007f33d64b31f0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33d64b31fc R13: 00007ffef6e1dedf R14: 00007f33d48a2300 R15: 0000000000022000 INFO: task syz-executor.4:13983 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28856 13983 8138 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline] rwsem_down_read_failed+0x20a/0x390 kernel/locking/rwsem-xadd.c:309 call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94 __down_read arch/x86/include/asm/rwsem.h:83 [inline] down_read+0x44/0x80 kernel/locking/rwsem.c:26 exit_mm kernel/exit.c:512 [inline] do_exit+0x6e4/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f33d63925a9 Code: Bad RIP value. RSP: 002b:00007f33d4881218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f33d64b32c8 RCX: 00007f33d63925a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f33d64b32c8 RBP: 00007f33d64b32c0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33d64b32cc R13: 00007ffef6e1dedf R14: 00007f33d4881300 R15: 0000000000022000 INFO: task syz-executor.4:13984 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D29088 13984 8138 0x80000000 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 __rwsem_down_read_failed_common kernel/locking/rwsem-xadd.c:292 [inline] rwsem_down_read_failed+0x20a/0x390 kernel/locking/rwsem-xadd.c:309 call_rwsem_down_read_failed+0x14/0x30 arch/x86/lib/rwsem.S:94 __down_read arch/x86/include/asm/rwsem.h:83 [inline] down_read+0x44/0x80 kernel/locking/rwsem.c:26 exit_mm kernel/exit.c:512 [inline] do_exit+0x6e4/0x2be0 kernel/exit.c:857 do_group_exit+0x125/0x310 kernel/exit.c:967 get_signal+0x3f2/0x1f70 kernel/signal.c:2589 do_signal+0x8f/0x1670 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x204/0x2a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x538/0x620 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f33d63925a9 Code: Bad RIP value. RSP: 002b:00007f33d4860218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f33d64b3398 RCX: 00007f33d63925a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f33d64b3398 RBP: 00007f33d64b3390 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33d64b339c overlayfs: unrecognized mount option "uppevdir=./busfworX5өkdir=./file1" or missing value R13: 00007ffef6e1dedf R14: 00007f33d4860300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/1570: #0: 000000001cd953ca (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 kernel/locking/lockdep.c:4441 2 locks held by kworker/u4:4/2967: #0: 0000000086bc1bdc (&rq->lock){-.-.}, at: rq_lock kernel/sched/sched.h:1826 [inline] #0: 0000000086bc1bdc (&rq->lock){-.-.}, at: __schedule+0x1f9/0x2040 kernel/sched/core.c:3455 #1: 00000000b028f890 ((work_completion)(&(&bat_priv->nc.work)->work)){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2128 1 lock held by in:imklog/7861: #0: 00000000a7f456a0 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 fs/file.c:767 2 locks held by agetty/8034: #0: 000000003d801950 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272 #1: 00000000e26a84ff (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1950 drivers/tty/n_tty.c:2154 1 lock held by syz-executor.4/13975: #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:512 [inline] #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: do_exit+0x6e4/0x2be0 kernel/exit.c:857 1 lock held by syz-executor.4/13977: #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:512 [inline] #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: do_exit+0x6e4/0x2be0 kernel/exit.c:857 1 lock held by syz-executor.4/13980: #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:512 [inline] #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: do_exit+0x6e4/0x2be0 kernel/exit.c:857 1 lock held by syz-executor.4/13981: 1 lock held by syz-executor.4/13982: #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:512 [inline] #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: do_exit+0x6e4/0x2be0 kernel/exit.c:857 1 lock held by syz-executor.4/13983: #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:512 [inline] #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: do_exit+0x6e4/0x2be0 kernel/exit.c:857 1 lock held by syz-executor.4/13984: #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: exit_mm kernel/exit.c:512 [inline] #0: 0000000089cc2dc4 (&mm->mmap_sem){++++}, at: do_exit+0x6e4/0x2be0 kernel/exit.c:857 5 locks held by kworker/u4:9/19500: #0: 000000006932bff2 ((wq_completion)"%s""netns"){+.+.}, at: process_one_work+0x767/0x1570 kernel/workqueue.c:2124 #1: 00000000a94a6a73 (net_cleanup_work){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2128 #2: 00000000b8d80c71 (pernet_ops_rwsem){++++}, at: cleanup_net+0xa8/0x8b0 net/core/net_namespace.c:521 #3: 000000007d80cb55 (rtnl_mutex){+.+.}, at: ip_tunnel_delete_nets+0x8e/0x580 net/ipv4/ip_tunnel.c:1083 #4: 00000000883f9477 (rcu_preempt_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:297 [inline] #4: 00000000883f9477 (rcu_preempt_state.exp_mutex){+.+.}, at: _synchronize_rcu_expedited+0x4dc/0x6f0 kernel/rcu/tree_exp.h:667 1 lock held by syz-executor.3/21296: #0: 000000007d80cb55 (rtnl_mutex){+.+.}, at: rtnl_lock net/core/rtnetlink.c:77 [inline] #0: 000000007d80cb55 (rtnl_mutex){+.+.}, at: rtnetlink_rcv_msg+0x3fe/0xb80 net/core/rtnetlink.c:4779 IPVS: ftp: loaded support on port[0] = 21 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1570 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x991/0xe60 kernel/hung_task.c:287 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 19500 Comm: kworker/u4:9 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 Workqueue: netns cleanup_net RIP: 0010:debug_lockdep_rcu_enabled+0x7/0xe0 kernel/rcu/update.c:252 Code: c4 47 00 e9 fa fd ff ff 48 89 ef e8 83 c4 47 00 e9 62 fe ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 c7 c0 44 e0 26 8b <53> 48 ba 00 00 00 00 00 fc ff df 48 89 c1 83 e0 07 48 c1 e9 03 83 RSP: 0018:ffff888054087678 EFLAGS: 00000083 RAX: ffffffff8b26e044 RBX: ffff8880afe4a180 RCX: ffffffff86a43eea RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8880afe4aa04 RBP: ffffffff89e67a68 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1100a810ed3 R13: ffffffff86a43e23 R14: 0000000000000000 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2bc2c000 CR3: 00000000a0f69000 CR4: 00000000003406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: trace_lock_release include/trace/events/lock.h:58 [inline] lock_release+0x5c3/0x8b0 kernel/locking/lockdep.c:3926 __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline] _raw_spin_unlock+0x17/0x40 kernel/locking/spinlock.c:176 spin_unlock include/linux/spinlock.h:369 [inline] get_next_corpse net/netfilter/nf_conntrack_core.c:1906 [inline] nf_ct_iterate_cleanup+0x223/0x520 net/netfilter/nf_conntrack_core.c:1930 nf_ct_iterate_cleanup_net net/netfilter/nf_conntrack_core.c:2015 [inline] nf_ct_iterate_cleanup_net+0x113/0x170 net/netfilter/nf_conntrack_core.c:2000 masq_device_event+0xd6/0x110 net/ipv4/netfilter/nf_nat_masquerade_ipv4.c:100 notifier_call_chain+0xc0/0x230 kernel/notifier.c:93 call_netdevice_notifiers net/core/dev.c:1762 [inline] dev_close_many+0x323/0x670 net/core/dev.c:1514 rollback_registered_many+0x2f7/0xe70 net/core/dev.c:8173 unregister_netdevice_many.part.0+0x1a/0x300 net/core/dev.c:9324 unregister_netdevice_many+0x36/0x50 net/core/dev.c:9323 ip_tunnel_delete_nets+0x3d3/0x580 net/ipv4/ip_tunnel.c:1088 ops_exit_list+0xf9/0x150 net/core/net_namespace.c:156 cleanup_net+0x3b4/0x8b0 net/core/net_namespace.c:554 process_one_work+0x864/0x1570 kernel/workqueue.c:2153 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415