INFO: task kworker/u4:1:144 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:1 state:D stack:21696 pid: 144 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_connector_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2b5/0x350 kernel/rcu/srcutree.c:930 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/u4:3:155 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:3 state:D stack:25680 pid: 155 ppid: 2 flags:0x00004000 Workqueue: events_unbound fsnotify_mark_destroy_workfn Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2b5/0x350 kernel/rcu/srcutree.c:930 fsnotify_mark_destroy_workfn+0x106/0x2e0 fs/notify/mark.c:928 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task kworker/0:2:1110 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:2 state:D stack:24720 pid: 1110 ppid: 2 flags:0x00004000 Workqueue: events bpf_map_free_deferred Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline] synchronize_rcu_expedited+0x680/0x750 kernel/rcu/tree_exp.h:845 synchronize_rcu+0x119/0x1e0 kernel/rcu/tree.c:3802 dev_map_free+0x11e/0x670 kernel/bpf/devmap.c:203 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz-executor:4190 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:21872 pid: 4190 ppid: 1 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845 namespace_unlock+0x23f/0x440 fs/namespace.c:1459 do_umount fs/namespace.c:1683 [inline] path_umount+0xf38/0xfe0 fs/namespace.c:1766 ksys_umount fs/namespace.c:1789 [inline] __do_sys_umount fs/namespace.c:1794 [inline] __se_sys_umount fs/namespace.c:1792 [inline] __x64_sys_umount+0x12d/0x170 fs/namespace.c:1792 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7fc225462097 RSP: 002b:00007ffc358ca728 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: ffffffffffffffda RBX: 00007fc2254f62ca RCX: 00007fc225462097 RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffc358ca7e0 RBP: 00007ffc358ca7e0 R08: 00007ffc358cb7e0 R09: 00000000ffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffc358cb870 R13: 00007fc2254f62ca R14: 0000000000017432 R15: 00007ffc358cb8b0 INFO: task kworker/u4:4:4210 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u4:4 state:D stack:25968 pid: 4210 ppid: 2 flags:0x00004000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 synchronize_rcu_expedited+0x5c1/0x750 kernel/rcu/tree_exp.h:861 synchronize_rcu+0x119/0x1e0 kernel/rcu/tree.c:3802 cfcnfg_remove+0x3c/0x90 net/caif/cfcnfg.c:121 caif_exit_net+0x460/0x480 net/caif/caif_dev.c:548 ops_exit_list net/core/net_namespace.c:172 [inline] cleanup_net+0x703/0xba0 net/core/net_namespace.c:635 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 INFO: task syz.3.126:4664 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.126 state:D stack:25856 pid: 4664 ppid: 4185 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2512 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1923 sock_sendmsg_nosec net/socket.c:706 [inline] __sock_sendmsg net/socket.c:718 [inline] ____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2500 __sys_sendmsg net/socket.c:2529 [inline] __do_sys_sendmsg net/socket.c:2538 [inline] __se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7ff1aad53e59 RSP: 002b:00007ff1a8fac028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ff1aafdbfa0 RCX: 00007ff1aad53e59 RDX: 0000000004008014 RSI: 0000200000000140 RDI: 0000000000000004 RBP: 00007ff1aade9e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff1aafdc038 R14: 00007ff1aafdbfa0 R15: 00007ffcf36a98e8 INFO: task syz.3.126:4671 blocked for more than 147 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.126 state:D stack:27184 pid: 4671 ppid: 4185 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669 __mutex_lock kernel/locking/mutex.c:729 [inline] mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2512 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1923 sock_sendmsg_nosec net/socket.c:706 [inline] __sock_sendmsg net/socket.c:718 [inline] ____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2500 __sys_sendmsg net/socket.c:2529 [inline] __do_sys_sendmsg net/socket.c:2538 [inline] __se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7ff1aad53e59 RSP: 002b:00007ff1a8f8b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007ff1aafdc090 RCX: 00007ff1aad53e59 RDX: 0000000000044080 RSI: 0000200000000040 RDI: 0000000000000004 RBP: 00007ff1aade9e6f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ff1aafdc128 R14: 00007ff1aafdc090 R15: 00007ffcf36a98e8 INFO: task syz.2.131:4676 blocked for more than 148 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.131 state:D stack:27696 pid: 4676 ppid: 4197 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2b5/0x350 kernel/rcu/srcutree.c:930 mmu_notifier_unregister+0x286/0x380 mm/mmu_notifier.c:854 kvm_destroy_vm virt/kvm/kvm_main.c:1237 [inline] kvm_put_kvm+0xc51/0x16b0 virt/kvm/kvm_main.c:1283 kvm_vm_release+0x42/0x50 virt/kvm/kvm_main.c:1306 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f68ba41fe59 RSP: 002b:00007fff94df4428 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007f68ba6a9da0 RCX: 00007f68ba41fe59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f68ba6a9da0 R08: 00007f68ba6a8038 R09: 0000000000000000 R10: 00000000003ffd48 R11: 0000000000000246 R12: 000000000001783c R13: 00007f68ba6a809c R14: 00000000000175a9 R15: 00007f68ba6a8090 INFO: task syz.0.133:4682 blocked for more than 149 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.133 state:D stack:27696 pid: 4682 ppid: 4186 flags:0x00004004 Call Trace: context_switch kernel/sched/core.c:5049 [inline] __schedule+0x11c3/0x4350 kernel/sched/core.c:6395 schedule+0x11b/0x1e0 kernel/sched/core.c:6478 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093 do_wait_for_common+0x295/0x460 kernel/sched/completion.c:85 __wait_for_common kernel/sched/completion.c:106 [inline] wait_for_common kernel/sched/completion.c:117 [inline] wait_for_completion+0x48/0x60 kernel/sched/completion.c:138 __synchronize_srcu+0x2b5/0x350 kernel/rcu/srcutree.c:930 mmu_notifier_unregister+0x286/0x380 mm/mmu_notifier.c:854 kvm_destroy_vm virt/kvm/kvm_main.c:1237 [inline] kvm_put_kvm+0xc51/0x16b0 virt/kvm/kvm_main.c:1283 kvm_vm_release+0x42/0x50 virt/kvm/kvm_main.c:1306 __fput+0x212/0x8c0 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f43b409fe59 RSP: 002b:00007ffef83af178 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffef83af260 RCX: 00007f43b409fe59 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00000000000175ae R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b31420000 R11: 0000000000000246 R12: 00007ffef83af2a0 R13: 00007f43b4327fac R14: 0000000000017625 R15: 00007f43b4327fa0 Showing all locks held in the system: 1 lock held by khungtaskd/27: #0: ffffffff8c31ef20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30 2 locks held by kworker/u4:1/144: #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc900016afd00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 2 locks held by kworker/u4:3/155: #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90001fe7d00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 2 locks held by kworker/1:2/1108: 2 locks held by kworker/0:2/1110: #0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc90004617d00 ((work_completion)(&map->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 2 locks held by getty/3946: #0: ffff88802cbf4098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252 #1: ffffc900026562e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158 1 lock held by syz-executor/4190: #0: ffffffff8c3239a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline] #0: ffffffff8c3239a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845 6 locks held by kworker/u4:4/4210: #0: ffff888016dcd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1 #1: ffffc9000308fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285 #2: ffffffff8d43f210 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589 #3: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: caif_exit_net+0x66/0x480 net/caif/caif_dev.c:527 #4: ffff8880247a8180 (&caifn->caifdevs.lock){+.+.}-{3:3}, at: caif_exit_net+0x79/0x480 net/caif/caif_dev.c:528 #5: ffffffff8c3239a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline] #5: ffffffff8c3239a8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845 1 lock held by syz.3.126/4664: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz.3.126/4671: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by dhcpcd/4685: #0: ffff888061f32120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888061f32120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3218 1 lock held by dhcpcd/4686: #0: ffff888020454120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888020454120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3218 1 lock held by dhcpcd/4687: #0: ffff888061f30120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888061f30120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3218 1 lock held by dhcpcd/4688: #0: ffff88801ef22120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88801ef22120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3218 1 lock held by dhcpcd/4689: #0: ffff888057790120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff888057790120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3218 1 lock held by dhcpcd/4690: #0: ffff88805778c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline] #0: ffff88805778c120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3218 1 lock held by syz-executor/4692: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4696: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4700: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4704: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4706: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4709: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4715: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4718: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4722: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4724: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4727: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4731: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4735: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4739: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 1 lock held by syz-executor/4741: #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline] #0: ffffffff8d44b148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7d6/0xf00 net/core/rtnetlink.c:5685 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline] watchdog+0xe1b/0xe60 kernel/hung_task.c:369 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 1108 Comm: kworker/1:2 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Workqueue: events p9_poll_workfn RIP: 0010:check_wait_context kernel/locking/lockdep.c:4702 [inline] RIP: 0010:__lock_acquire+0x6f9/0x7b50 kernel/locking/lockdep.c:4962 Code: 70 01 00 00 44 89 fb 81 e3 ff ff ff 7f 83 f8 31 73 45 48 8d 04 9b 49 8d 9c c5 10 0b 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 00 <84> c0 75 44 8b 1b 48 8b 44 24 30 42 0f b6 04 00 84 c0 75 54 48 8b RSP: 0018:ffffc90000dcf860 EFLAGS: 00000806 RAX: 0000000000000000 RBX: ffff88802189c758 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff901e90c0 RBP: ffffc90000dcfa90 R08: dffffc0000000000 R09: 1ffffffff203d218 R10: dffffc0000000000 R11: fffffbfff203d219 R12: 0000000000000000 R13: ffff88802189bb80 R14: 0000000000000007 R15: 0000000000000005 FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055ad0549c000 CR3: 000000002af0d000 CR4: 00000000003526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x19e/0x400 kernel/locking/lockdep.c:5623 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:313 rcu_read_lock include/linux/rcupdate.h:740 [inline] net_generic+0x1a/0x200 include/net/netns/generic.h:44 is_pppoe_ip net/bridge/br_netfilter_hooks.c:121 [inline] br_nf_post_routing+0x495/0xcd0 net/bridge/br_netfilter_hooks.c:936 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0xb9/0x200 net/netfilter/core.c:584 nf_hook include/linux/netfilter.h:257 [inline] NF_HOOK+0x1f3/0x380 include/linux/netfilter.h:300 br_forward_finish+0x74/0x80 net/bridge/br_forward.c:66 br_nf_hook_thresh net/bridge/br_netfilter_hooks.c:-1 [inline] br_nf_forward_finish+0x981/0xd00 net/bridge/br_netfilter_hooks.c:662 NF_HOOK+0x5c7/0x640 include/linux/netfilter.h:302 br_nf_forward_ip+0xc5b/0x10c0 net/bridge/br_netfilter_hooks.c:732 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0xb9/0x200 net/netfilter/core.c:584 nf_hook include/linux/netfilter.h:257 [inline] NF_HOOK+0x1f3/0x380 include/linux/netfilter.h:300 __br_forward+0x433/0x610 net/bridge/br_forward.c:115 br_handle_frame_finish+0x102b/0x1310 net/bridge/br_input.c:180 br_nf_hook_thresh+0x3c9/0x4a0 net/bridge/br_netfilter_hooks.c:1155 br_nf_pre_routing_finish_ipv6+0x958/0xc40 net/bridge/br_netfilter_ipv6.c:-1 NF_HOOK include/linux/netfilter.h:302 [inline] br_nf_pre_routing_ipv6+0x353/0x670 net/bridge/br_netfilter_ipv6.c:237 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_bridge_pre net/bridge/br_input.c:242 [inline] br_handle_frame+0xec1/0x10d0 net/bridge/br_input.c:384 __netif_receive_skb_core+0xfd5/0x3670 net/core/dev.c:5445 __netif_receive_skb_one_core net/core/dev.c:5549 [inline] __netif_receive_skb+0x74/0x290 net/core/dev.c:5665 process_backlog+0x366/0x770 net/core/dev.c:6542 __napi_poll+0xbb/0x430 net/core/dev.c:7101 napi_poll net/core/dev.c:7168 [inline] net_rx_action+0x522/0xa80 net/core/dev.c:7258 handle_softirqs+0x336/0x830 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] invoke_softirq kernel/softirq.c:450 [inline] __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194 Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 ef bf 89 f7 65 8b 05 00 e7 39 76 85 c0 74 3c 48 c7 04 24 0e 36 RSP: 0018:ffffc900045e7aa0 EFLAGS: 00000206 RAX: dffffc0000000004 RBX: 0000000000000a02 RCX: faf6db5b630f3c00 RDX: dffffc0000000000 RSI: ffffffff8a2b2be0 RDI: 0000000000000001 RBP: ffffc900045e7b30 R08: ffffffff901e90f7 R09: 1ffffffff203d21e R10: dffffc0000000000 R11: fffffbfff203d21f R12: dffffc0000000000 R13: ffff888076b2e9e0 R14: ffff888076b2e948 R15: 1ffff920008bcf54 spin_unlock_irqrestore include/linux/spinlock.h:419 [inline] dma_buf_poll_cb+0xce/0x1c0 drivers/dma-buf/dma-buf.c:206 dma_buf_poll+0x60e/0x990 drivers/dma-buf/dma-buf.c:292 vfs_poll include/linux/poll.h:94 [inline] p9_fd_poll net/9p/trans_fd.c:240 [inline] p9_poll_mux net/9p/trans_fd.c:632 [inline] p9_poll_workfn+0x35b/0x5a0 net/9p/trans_fd.c:1170 process_one_work+0x867/0xff0 kernel/workqueue.c:2310 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457 kthread+0x42e/0x520 kernel/kthread.c:334 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287