INFO: task syz.9.4181:21485 blocked for more than 143 seconds.
Not tainted 6.12.0-syzkaller-09734-g445d9f05fa14 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.4181 state:D stack:23136 pid:21485 tgid:21484 ppid:13700 flags:0x00004004
Call Trace:
context_switch kernel/sched/core.c:5369 [inline]
__schedule+0xe58/0x5ad0 kernel/sched/core.c:6756
__schedule_loop kernel/sched/core.c:6833 [inline]
schedule+0xe7/0x350 kernel/sched/core.c:6848
schedule_timeout+0x244/0x280 kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:95 [inline]
__wait_for_common+0x3e1/0x600 kernel/sched/completion.c:116
disable_device+0x170/0x280 drivers/infiniband/core/device.c:1296
__ib_unregister_device+0x2b4/0x480 drivers/infiniband/core/device.c:1519
ib_unregister_device_and_put+0x5a/0x80 drivers/infiniband/core/device.c:1584
nldev_dellink+0x211/0x300 drivers/infiniband/core/nldev.c:1825
rdma_nl_rcv_msg+0x388/0x6e0 drivers/infiniband/core/netlink.c:195
rdma_nl_rcv_skb.constprop.0.isra.0+0x2e6/0x450 drivers/infiniband/core/netlink.c:239
netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline]
netlink_unicast+0x53c/0x7f0 net/netlink/af_netlink.c:1347
netlink_sendmsg+0x8b8/0xd70 net/netlink/af_netlink.c:1891
sock_sendmsg_nosec net/socket.c:711 [inline]
__sock_sendmsg net/socket.c:726 [inline]
____sys_sendmsg+0xaaf/0xc90 net/socket.c:2583
___sys_sendmsg+0x135/0x1e0 net/socket.c:2637
__sys_sendmsg+0x16e/0x220 net/socket.c:2669
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f210f780809
RSP: 002b:00007f211055b058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f210f945fa0 RCX: 00007f210f780809
RDX: 0000000020000000 RSI: 00000000200002c0 RDI: 0000000000000003
RBP: 00007f210f7f393e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f210f945fa0 R15: 00007ffcfd52ff38
Showing all locks held in the system:
1 lock held by ksoftirqd/1/24:
#0: ffff8880b863ebd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested kernel/sched/core.c:606 [inline]
#0: ffff8880b863ebd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 kernel/sched/core.c:591
1 lock held by khungtaskd/30:
#0: ffffffff8e1bba80 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
#0: ffffffff8e1bba80 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
#0: ffffffff8e1bba80 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x7f/0x390 kernel/locking/lockdep.c:6744
4 locks held by kworker/u8:2/35:
#0: ffff88801beeb148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3204
#1: ffffc90000ab7d80 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
#2: ffffffff8fedc4d0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xbb/0xb40 net/core/net_namespace.c:586
#3: ffff88803140c6b8 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x30/0x320 drivers/infiniband/core/device.c:1667
3 locks held by kworker/u8:8/3472:
2 locks held by getty/5590:
#0: ffff88814d8490a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
#1: ffffc90002fde2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0xfba/0x1480 drivers/tty/n_tty.c:2211
2 locks held by kworker/0:8/5939:
#0: ffff88801b078948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3204
#1: ffffc90002fe7d80 (free_ipc_work){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
3 locks held by kworker/u8:12/6937:
#0: ffff88801b081148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3204
#1: ffffc90003967d80 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
#2: ffffffff8fef2348 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 net/core/link_watch.c:276
1 lock held by syz-executor/13304:
#0: ffffffff8fef2348 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8fef2348 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x38/0x230 drivers/net/tun.c:3517
5 locks held by kworker/1:8/20012:
#0: ffff88814468f948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x1293/0x1ba0 kernel/workqueue.c:3204
#1: ffffc9000ce4fd80 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x921/0x1ba0 kernel/workqueue.c:3205
#2: ffff888029320190 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1014 [inline]
#2: ffff888029320190 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c1/0x4e10 drivers/usb/core/hub.c:5849
#3: ffff888029323510 (&port_dev->status_lock){+.+.}-{4:4}, at: usb_lock_port drivers/usb/core/hub.c:3206 [inline]
#3: ffff888029323510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5418 [inline]
#3: ffff888029323510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
#3: ffff888029323510 (&port_dev->status_lock){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5821 [inline]
#3: ffff888029323510 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x27ec/0x4e10 drivers/usb/core/hub.c:5903
#4: ffff888028d6ea68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect drivers/usb/core/hub.c:5419 [inline]
#4: ffff888028d6ea68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_port_connect_change drivers/usb/core/hub.c:5661 [inline]
#4: ffff888028d6ea68 (hcd->address0_mutex){+.+.}-{4:4}, at: port_event drivers/usb/core/hub.c:5821 [inline]
#4: ffff888028d6ea68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2815/0x4e10 drivers/usb/core/hub.c:5903
2 locks held by syz.9.4181/21485:
#0: ffffffff9abcd778 (&rdma_nl_types[idx].sem){.+.+}-{4:4}, at: rdma_nl_rcv_msg+0x16a/0x6e0 drivers/infiniband/core/netlink.c:164
#1: ffff88803140c6b8 (&device->unregistration_lock){+.+.}-{4:4}, at: __ib_unregister_device+0x23b/0x480 drivers/infiniband/core/device.c:1515
2 locks held by syz.0.4259/21753:
#0: ffffffff8fedc4d0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x292/0x6b0 net/core/net_namespace.c:496
#1: ffff88803140c6b8 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x30/0x320 drivers/infiniband/core/device.c:1667
2 locks held by syz.5.4263/21773:
#0: ffffffff8fedc4d0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x292/0x6b0 net/core/net_namespace.c:496
#1: ffff88803140c6b8 (&device->unregistration_lock){+.+.}-{4:4}, at: rdma_dev_change_netns+0x30/0x320 drivers/infiniband/core/device.c:1667
2 locks held by kworker/u8:5/21824:
8 locks held by syz-executor/23270:
#0: ffff888034ca6420 (sb_writers#9){.+.+}-{0:0}, at: ksys_write+0x12b/0x250 fs/read_write.c:731
#1: ffff88806d95b888 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x27b/0x500 fs/kernfs/file.c:325
#2: ffff888143be5878 (kn->active#49){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x29e/0x500 fs/kernfs/file.c:326
#3: ffffffff8f487628 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd2/0x4b0 drivers/net/netdevsim/bus.c:216
#4: ffff88803d13a0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1014 [inline]
#4: ffff88803d13a0e8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1095 [inline]
#4: ffff88803d13a0e8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xa4/0x610 drivers/base/dd.c:1293
#5: ffff88803d13f250 (&devlink->lock_key#17){+.+.}-{4:4}, at: nsim_drv_remove+0x4a/0x1d0 drivers/net/netdevsim/dev.c:1675
#6: ffffffff8fef2348 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x6f/0x6b0 drivers/net/netdevsim/netdev.c:816
#7: ffffffff8e1c73b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a4/0x3b0 kernel/rcu/tree_exp.h:329
1 lock held by syz.3.4692/23340:
#0: ffffffff8e1c73b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a4/0x3b0 kernel/rcu/tree_exp.h:329
1 lock held by syz.6.4698/23371:
1 lock held by syz.2.4700/23374:
#0: ffffffff8fef2348 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
#0: ffffffff8fef2348 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x372/0xea0 net/core/rtnetlink.c:6917
=============================================
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Not tainted 6.12.0-syzkaller-09734-g445d9f05fa14 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:234 [inline]
watchdog+0xf14/0x1240 kernel/hung_task.c:397
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 23340 Comm: syz.3.4692 Not tainted 6.12.0-syzkaller-09734-g445d9f05fa14 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:preempt_count_sub+0x63/0x160 kernel/sched/core.c:5887
Code: 2b 19 85 c9 75 1b 65 8b 05 f2 fa a6 7e 89 c2 81 e2 ff ff ff 7f 39 d3 7f 17 81 fb fe 00 00 00 76 71 f7 db 65 01 1d d5 fa a6 7e <5b> c3 cc cc cc cc 90 e8 c1 7b 35 03 85 c0 74 51 48 c7 c0 b0 e1 60
RSP: 0018:ffffc9001b7d76b0 EFLAGS: 00000297
RAX: 0000000080000001 RBX: 00000000ffffffff RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffffc9001b7d7a88 RDI: 0000000000000001
RBP: ffffc9001b7d0000 R08: ffffc9001b7d7764 R09: ffffffff90ffed2e
R10: ffffc9001b7d7730 R11: 000000000000e1d6 R12: ffffc9001b7d7780
R13: ffffc9001b7d7730 R14: ffffc9001b7d7ab8 R15: ffffc9001b7d7ab0
FS: 0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e51dff8 CR3: 000000007c96e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
unwind_next_frame+0xe5d/0x20c0 arch/x86/kernel/unwind_orc.c:672
arch_stack_walk+0x95/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
save_stack+0x162/0x1f0 mm/page_owner.c:156
__reset_page_owner+0x8d/0x400 mm/page_owner.c:297
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1127 [inline]
free_unref_page+0x661/0x1080 mm/page_alloc.c:2657
vfree+0x17a/0x890 mm/vmalloc.c:3382
kcov_put kernel/kcov.c:439 [inline]
kcov_put+0x2a/0x40 kernel/kcov.c:435
kcov_close+0xd/0x20 kernel/kcov.c:535
__fput+0x3f8/0xb60 fs/file_table.c:450
task_work_run+0x14e/0x250 kernel/task_work.c:239
exit_task_work include/linux/task_work.h:43 [inline]
do_exit+0xadd/0x2d70 kernel/exit.c:938
do_group_exit+0xd3/0x2a0 kernel/exit.c:1087
get_signal+0x24ed/0x26c0 kernel/signal.c:3016
arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe2d9980809
Code: Unable to access opcode bytes at 0x7fe2d99807df.
RSP: 002b:00007ffd521d96e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fe2d9b47ba0 RCX: 00007fe2d9980809
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fe2d9b47ba0 R08: 0000000000000000 R09: 00007ffd521d99cf
R10: 00007fe2d9b47ac0 R11: 0000000000000246 R12: 000000000016de63
R13: 00007fe2d9b46240 R14: 0000000000000032 R15: ffffffffffffffff