IPVS: ftp: loaded support on port[0] = 21 INFO: task syz-executor.4:20210 blocked for more than 140 seconds. Not tainted 4.19.211-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D28688 20210 11206 0x00000004 Call Trace: context_switch kernel/sched/core.c:2828 [inline] __schedule+0x887/0x2040 kernel/sched/core.c:3517 IPVS: ftp: loaded support on port[0] = 21 schedule+0x8d/0x1b0 kernel/sched/core.c:3561 schedule_timeout+0x92d/0xfe0 kernel/time/timer.c:1794 net_ratelimit: 11358 callbacks suppressed bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0) do_wait_for_common kernel/sched/completion.c:83 [inline] __wait_for_common kernel/sched/completion.c:104 [inline] wait_for_common+0x29c/0x470 kernel/sched/completion.c:115 usb_start_wait_urb+0x14b/0x4c0 drivers/usb/core/message.c:62 usb_bulk_msg+0x226/0x550 drivers/usb/core/message.c:253 proc_bulk+0x3de/0x860 drivers/usb/core/devio.c:1211 usbdev_do_ioctl+0x696/0x3030 drivers/usb/core/devio.c:2435 usbdev_ioctl+0x21/0x30 drivers/usb/core/devio.c:2585 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fbd726f7279 Code: Bad RIP value. RSP: 002b:00007fbd7106c168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fbd72809f80 RCX: 00007fbd726f7279 RDX: 0000000020000180 RSI: 00000000c0185502 RDI: 0000000000000003 RBP: 00007fbd727512e9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe28796fef R14: 00007fbd7106c300 R15: 0000000000022000 Showing all locks held in the system: 1 lock held by khungtaskd/1570: #0: 00000000789b26ed (rcu_read_lock){....}, at: debug_show_all_locks+0x53/0x265 kernel/locking/lockdep.c:4441 1 lock held by in:imklog/7754: #0: 000000003c6603ad (&f->f_pos_lock){+.+.}, at: __fdget_pos+0x26f/0x310 fs/file.c:767 2 locks held by agetty/7833: #0: 00000000d9301d77 (&tty->ldisc_sem){++++}, at: tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:272 #1: 000000008833b113 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x217/0x1950 drivers/tty/n_tty.c:2154 5 locks held by kworker/u4:8/9525: #0: 000000002677c1cd ((wq_completion)"%s""netns"){+.+.}, at: process_one_work+0x767/0x1570 kernel/workqueue.c:2124 #1: 00000000c79eac8f (net_cleanup_work){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2128 #2: 0000000096bff716 (pernet_ops_rwsem){++++}, at: cleanup_net+0xa8/0x8b0 net/core/net_namespace.c:521 #3: 0000000076695e8d (rtnl_mutex){+.+.}, at: ip_tunnel_delete_nets+0x8e/0x580 net/ipv4/ip_tunnel.c:1083 #4: 00000000505f03d9 (rcu_preempt_state.exp_mutex){+.+.}, at: exp_funnel_lock kernel/rcu/tree_exp.h:297 [inline] #4: 00000000505f03d9 (rcu_preempt_state.exp_mutex){+.+.}, at: _synchronize_rcu_expedited+0x4dc/0x6f0 kernel/rcu/tree_exp.h:667 2 locks held by kworker/0:2/26210: #0: 000000009c16090b ((wq_completion)"rcu_gp"){+.+.}, at: process_one_work+0x767/0x1570 kernel/workqueue.c:2124 #1: 000000003f414d81 ((work_completion)(&rew.rew_work)){+.+.}, at: process_one_work+0x79c/0x1570 kernel/workqueue.c:2128 2 locks held by syz-executor.2/26208: #0: 0000000064ccf21a (br_ioctl_mutex){+.+.}, at: sock_ioctl+0x29e/0x5d0 net/socket.c:1100 #1: 0000000076695e8d (rtnl_mutex){+.+.}, at: netdev_run_todo+0x719/0xab0 net/core/dev.c:9005 2 locks held by syz-executor.3/26213: #0: 0000000096bff716 (pernet_ops_rwsem){++++}, at: copy_net_ns+0x1d8/0x340 net/core/net_namespace.c:435 #1: 0000000076695e8d (rtnl_mutex){+.+.}, at: gtp_net_exit+0x1ba/0x380 drivers/net/gtp.c:1360 2 locks held by syz-executor.0/26235: #0: 0000000096bff716 (pernet_ops_rwsem){++++}, at: copy_net_ns+0x1d8/0x340 net/core/net_namespace.c:435 #1: 0000000076695e8d (rtnl_mutex){+.+.}, at: gtp_net_exit+0x1ba/0x380 drivers/net/gtp.c:1360 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1570 Comm: khungtaskd Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 nmi_cpu_backtrace.cold+0x63/0xa2 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x1a6/0x1f0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:203 [inline] watchdog+0x991/0xe60 kernel/hung_task.c:287 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 RIP: 0010:debug_lockdep_rcu_enabled kernel/rcu/update.c:254 [inline] RIP: 0010:debug_lockdep_rcu_enabled kernel/rcu/update.c:251 [inline] RIP: 0010:rcu_read_lock_held+0x9a/0x110 kernel/rcu/update.c:281 Code: 08 85 d2 74 56 65 48 8b 1c 25 c0 df 01 00 48 8d bb 84 08 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 <48> 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 5b 8b 83 84 08 00 RSP: 0018:ffff8880b5a5eb00 EFLAGS: 00000a03 RAX: dffffc0000000000 RBX: ffff8880b5a4c240 RCX: 1ffffffff148be2c RDX: 0000000000000000 RSI: ffffffff87079181 RDI: ffff8880b5a4cac4 RBP: ffff8880b5a5ebb8 R08: ffff8880a017ee40 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003 R13: 000000000000000d R14: ffff8880974356c0 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd112cf9068 CR3: 00000000b0377000 CR4: 00000000003406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __in6_dev_get include/net/addrconf.h:340 [inline] fib6_ignore_linkdown net/ipv6/route.c:655 [inline] find_match.part.0+0xb66/0x1530 net/ipv6/route.c:673 find_match net/ipv6/route.c:670 [inline] find_rr_leaf net/ipv6/route.c:719 [inline] rt6_select net/ipv6/route.c:769 [inline] fib6_table_lookup+0x4c2/0xf40 net/ipv6/route.c:1876 ip6_pol_route+0x180/0x1270 net/ipv6/route.c:1909 fib6_rule_lookup+0x10b/0x4e0 net/ipv6/fib6_rules.c:118 ip6_route_input_lookup net/ipv6/route.c:1990 [inline] ip6_route_input+0x6c0/0xaa0 net/ipv6/route.c:2125 ip6_rcv_finish_core.constprop.0.isra.0+0xd7/0x550 net/ipv6/ip6_input.c:63 ip6_rcv_finish+0x176/0x2f0 net/ipv6/ip6_input.c:74 ip_sabotage_in net/bridge/br_netfilter_hooks.c:847 [inline] ip_sabotage_in+0x17d/0x1d0 net/bridge/br_netfilter_hooks.c:841 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline] nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:511 nf_hook include/linux/netfilter.h:244 [inline] NF_HOOK include/linux/netfilter.h:287 [inline] ipv6_rcv+0x26a/0x3f0 net/ipv6/ip6_input.c:273 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:4954 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066 netif_receive_skb_internal+0xf0/0x3f0 net/core/dev.c:5156 NF_HOOK include/linux/netfilter.h:289 [inline] br_pass_frame_up+0x309/0x6c0 net/bridge/br_input.c:69 br_handle_frame_finish+0x6f2/0x1410 net/bridge/br_input.c:173 br_nf_hook_thresh+0x2a3/0x330 net/bridge/br_netfilter_hooks.c:1014 br_nf_pre_routing_finish_ipv6+0x6e3/0xd40 net/bridge/br_netfilter_ipv6.c:210 NF_HOOK include/linux/netfilter.h:289 [inline] br_nf_pre_routing_ipv6+0x3f4/0x860 net/bridge/br_netfilter_ipv6.c:240 br_nf_pre_routing+0xf05/0x1500 net/bridge/br_netfilter_hooks.c:494 nf_hook_entry_hookfn include/linux/netfilter.h:119 [inline] nf_hook_slow+0xc5/0x1e0 net/netfilter/core.c:511 nf_hook include/linux/netfilter.h:244 [inline] NF_HOOK include/linux/netfilter.h:287 [inline] br_handle_frame+0xa60/0x13b0 net/bridge/br_input.c:306 __netif_receive_skb_core+0x929/0x3270 net/core/dev.c:4876 __netif_receive_skb_one_core+0xae/0x180 net/core/dev.c:4952 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5066 process_backlog+0x241/0x700 net/core/dev.c:5849 napi_poll net/core/dev.c:6280 [inline] net_rx_action+0x4ac/0xfb0 net/core/dev.c:6346 __do_softirq+0x265/0x980 kernel/softirq.c:292 run_ksoftirqd+0x57/0x110 kernel/softirq.c:653 smpboot_thread_fn+0x655/0x9e0 kernel/smpboot.c:164 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415