INFO: task kworker/0:6:3845 blocked for more than 429 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:6 state:D stack:0 pid:3845 tgid:3845 ppid:2 task_flags:0x4208060 flags:0x00000000 Workqueue: events bpf_prog_free_deferred Call trace: [<81ab23ac>] (__schedule) from [<81ab3658>] (__schedule_loop kernel/sched/core.c:6945 [inline]) [<81ab23ac>] (__schedule) from [<81ab3658>] (schedule+0x2c/0x130 kernel/sched/core.c:6960) r10:dfbbdd84 r9:829174e8 r8:60000013 r7:829174e8 r6:dfbbdd8c r5:852b8c00 r4:852b8c00 [<81ab362c>] (schedule) from [<81ab37e0>] (schedule_preempt_disabled+0x18/0x24 kernel/sched/core.c:7017) r5:852b8c00 r4:829174e4 [<81ab37c8>] (schedule_preempt_disabled) from [<81ab6e64>] (__mutex_lock_common kernel/locking/mutex.c:692 [inline]) [<81ab37c8>] (schedule_preempt_disabled) from [<81ab6e64>] (__mutex_lock.constprop.0+0x658/0xf8c kernel/locking/mutex.c:776) [<81ab680c>] (__mutex_lock.constprop.0) from [<81ab786c>] (__mutex_lock_slowpath+0x14/0x18 kernel/locking/mutex.c:1065) r10:8280c9e4 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:dfbbde08 r4:00000000 [<81ab7858>] (__mutex_lock_slowpath) from [<81ab78ac>] (mutex_lock+0x3c/0x40 kernel/locking/mutex.c:290) [<81ab7870>] (mutex_lock) from [<804f4400>] (_vm_unmap_aliases+0x68/0x240 mm/vmalloc.c:2944) [<804f4398>] (_vm_unmap_aliases) from [<804f81e8>] (vm_reset_perms mm/vmalloc.c:3375 [inline]) [<804f4398>] (_vm_unmap_aliases) from [<804f81e8>] (vfree+0x16c/0x210 mm/vmalloc.c:3454) r10:83016170 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:861b7280 r4:00000000 [<804f807c>] (vfree) from [<80564020>] (execmem_free+0x30/0x50 mm/execmem.c:503) r9:83018405 r8:852b8c00 r7:00000000 r6:83018400 r5:00001000 r4:7f029000 [<80563ff0>] (execmem_free) from [<803cb2cc>] (bpf_jit_free_exec+0x10/0x14 kernel/bpf/core.c:1068) r5:00001000 r4:eb01b000 [<803cb2bc>] (bpf_jit_free_exec) from [<803cb6ac>] (bpf_jit_binary_free kernel/bpf/core.c:1114 [inline]) [<803cb2bc>] (bpf_jit_free_exec) from [<803cb6ac>] (bpf_jit_free+0x68/0xe4 kernel/bpf/core.c:1237) [<803cb644>] (bpf_jit_free) from [<803cc7d4>] (bpf_prog_free_deferred+0x140/0x158 kernel/bpf/core.c:2935) r5:85c0e394 r4:85c8f600 [<803cc694>] (bpf_prog_free_deferred) from [<80275db8>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3257) r7:dddcfb40 r6:83018400 r5:85c0e394 r4:85c8f600 [<80275c04>] (process_one_work) from [<802764f8>] (process_scheduled_works kernel/workqueue.c:3340 [inline]) [<80275c04>] (process_one_work) from [<802764f8>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3421) r10:61c88647 r9:852b8c00 r8:85c8f62c r7:82804d80 r6:dddcfb40 r5:dddcfb60 r4:85c8f600 [<802762fc>] (worker_thread) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:85c8f600 r8:802762fc r7:dfd4de60 r6:85c8f680 r5:852b8c00 r4:00000001 [<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdfbbdfb0 to 0xdfbbdff8) dfa0: 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0 r4:84ed9980 INFO: task kworker/0:6:3845 is blocked on a mutex likely owned by task kworker/1:1:45. task:kworker/1:1 state:R running task stack:0 pid:45 tgid:45 ppid:2 task_flags:0x4208060 flags:0x00000000 Workqueue: events bpf_prog_free_deferred Call trace: [<81ab23ac>] (__schedule) from [<81ab3a8c>] (preempt_schedule_irq+0x40/0xa8 kernel/sched/core.c:7190) r10:8280ca38 r9:83315400 r8:80200c04 r7:df919d54 r6:ffffffff r5:83315400 r4:00000000 [<81ab3a4c>] (preempt_schedule_irq) from [<80200c24>] (svc_preempt+0x8/0x18) Exception stack(0xdf919d20 to 0xdf919d68) 9d20: a85c9000 ebdd3000 00000001 80239018 7f00d000 00000001 82ace204 82acd5e0 9d40: 7f00d000 ebdd3000 8280ca38 df919d9c df919da0 df919d70 8022fe10 80239030 9d60: 80000013 ffffffff r5:80000013 r4:80239030 [<8022fdac>] (flush_tlb_kernel_range) from [<804f41c4>] (__purge_vmap_area_lazy+0x284/0x458 mm/vmalloc.c:2369) r4:82ace224 [<804f3f40>] (__purge_vmap_area_lazy) from [<804f457c>] (_vm_unmap_aliases+0x1e4/0x240 mm/vmalloc.c:2983) r10:00000000 r9:00000000 r8:00000000 r7:ffffffff r6:df919dc0 r5:df919e08 r4:df919dc0 [<804f4398>] (_vm_unmap_aliases) from [<804f81e8>] (vm_reset_perms mm/vmalloc.c:3375 [inline]) [<804f4398>] (_vm_unmap_aliases) from [<804f81e8>] (vfree+0x16c/0x210 mm/vmalloc.c:3454) r10:83016170 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:862dee00 r4:00000000 [<804f807c>] (vfree) from [<80564020>] (execmem_free+0x30/0x50 mm/execmem.c:503) r9:83018605 r8:83315400 r7:00000000 r6:83018600 r5:00001000 r4:7f00d000 [<80563ff0>] (execmem_free) from [<803cb2cc>] (bpf_jit_free_exec+0x10/0x14 kernel/bpf/core.c:1068) r5:00001000 r4:eaf25000 [<803cb2bc>] (bpf_jit_free_exec) from [<803cb6ac>] (bpf_jit_binary_free kernel/bpf/core.c:1114 [inline]) [<803cb2bc>] (bpf_jit_free_exec) from [<803cb6ac>] (bpf_jit_free+0x68/0xe4 kernel/bpf/core.c:1237) [<803cb644>] (bpf_jit_free) from [<803cc7d4>] (bpf_prog_free_deferred+0x140/0x158 kernel/bpf/core.c:2935) r5:8513df94 r4:832ce200 [<803cc694>] (bpf_prog_free_deferred) from [<80275db8>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3257) r7:ddde3b40 r6:83018600 r5:8513df94 r4:832ce200 [<80275c04>] (process_one_work) from [<802764f8>] (process_scheduled_works kernel/workqueue.c:3340 [inline]) [<80275c04>] (process_one_work) from [<802764f8>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3421) r10:61c88647 r9:83315400 r8:832ce22c r7:82804d80 r6:ddde3b40 r5:ddde3b60 r4:832ce200 [<802762fc>] (worker_thread) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:832ce200 r8:802762fc r7:df879e60 r6:832ce280 r5:83315400 r4:00000001 [<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf919fb0 to 0xdf919ff8) 9fa0: 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0 r4:832d0940 NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Call trace: [<80201a74>] (dump_backtrace) from [<80201b70>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:00000000 r6:00000113 r5:60000193 r4:822958fc [<80201b58>] (show_stack) from [<8021ee34>] (__dump_stack lib/dump_stack.c:94 [inline]) [<80201b58>] (show_stack) from [<8021ee34>] (dump_stack_lvl+0x70/0x7c lib/dump_stack.c:120) [<8021edc4>] (dump_stack_lvl) from [<8021ee58>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r5:00000001 r4:00000001 [<8021ee40>] (dump_stack) from [<81a9be90>] (nmi_cpu_backtrace+0x160/0x17c lib/nmi_backtrace.c:113) [<81a9bd30>] (nmi_cpu_backtrace) from [<81a9bfdc>] (nmi_trigger_cpumask_backtrace+0x130/0x1d8 lib/nmi_backtrace.c:62) r7:00000001 r6:8280c710 r5:8281af5c r4:ffffffff [<81a9beac>] (nmi_trigger_cpumask_backtrace) from [<8022f818>] (arch_trigger_cpumask_backtrace+0x18/0x1c arch/arm/kernel/smp.c:852) r9:00007f30 r8:8280c890 r7:0000f3a1 r6:00007f30 r5:82ac27e4 r4:00000048 [<8022f800>] (arch_trigger_cpumask_backtrace) from [<81aa3aec>] (trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]) [<8022f800>] (arch_trigger_cpumask_backtrace) from [<81aa3aec>] (__sys_info lib/sys_info.c:157 [inline]) [<8022f800>] (arch_trigger_cpumask_backtrace) from [<81aa3aec>] (sys_info+0x68/0xa8 lib/sys_info.c:165) [<81aa3a84>] (sys_info) from [<803837fc>] (check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]) [<81aa3a84>] (sys_info) from [<803837fc>] (watchdog+0x464/0x8a0 kernel/hung_task.c:515) r5:82ac27e4 r4:8333ce0c [<80383398>] (watchdog) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:00000000 r8:80383398 r7:832a3b80 r6:832a3b80 r5:832e1800 r4:00000001 [<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf8d9fb0 to 0xdf8d9ff8) 9fa0: 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0 r4:833a1a80 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Workqueue: events_unbound nsim_dev_trap_report_work PC is at synproxy_send_client_synack+0x7c/0x1e8 net/netfilter/nf_synproxy_core.c:462 LR is at __finalize_skb_around net/core/skbuff.c:389 [inline] LR is at __build_skb_around+0x70/0x11c net/core/skbuff.c:447 pc : [<81729e30>] lr : [<815a4b3c>] psr: 60010013 sp : df801b50 ip : 86132820 fp : df801b9c r10: 00000100 r9 : 86132000 r8 : 86132114 r7 : df801bb0 r6 : 860f49c0 r5 : 00000000 r4 : 860f49c0 r3 : 83383000 r2 : 00000000 r1 : 00000000 r0 : 860f40c0 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 862de480 DAC: fffffffd Call trace: frame pointer underflow [<81729db4>] (synproxy_send_client_synack) from [<817651f0>] (nft_synproxy_eval_v4 net/netfilter/nft_synproxy.c:59 [inline]) [<81729db4>] (synproxy_send_client_synack) from [<817651f0>] (nft_synproxy_do_eval+0x25c/0x2b4 net/netfilter/nft_synproxy.c:141) r10:81e66128 r9:86132114 r8:84d90fc0 r7:85c7bbd8 r6:df801c7c r5:854b0000 r4:860f49c0 [<81764f94>] (nft_synproxy_do_eval) from [<81765274>] (nft_synproxy_eval+0x14/0x18 net/netfilter/nft_synproxy.c:247) r9:df801d14 r8:81e662b0 r7:81e66014 r6:81e65fd0 r5:85c7bbe0 r4:85c7bbd0 [<81765260>] (nft_synproxy_eval) from [<8172cf1c>] (expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]) [<81765260>] (nft_synproxy_eval) from [<8172cf1c>] (nft_do_chain+0x12c/0x570 net/netfilter/nf_tables_core.c:285) [<8172cdf0>] (nft_do_chain) from [<81747000>] (nft_do_chain_inet+0xac/0x120 net/netfilter/nft_chain_filter.c:161) r10:dddd1008 r9:8574cda0 r8:df801d6c r7:860f49c0 r6:8574cd80 r5:00000004 r4:85c714c0 [<81746f54>] (nft_do_chain_inet) from [<816f3774>] (nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]) [<81746f54>] (nft_do_chain_inet) from [<816f3774>] (nf_hook_slow+0x40/0x104 net/netfilter/core.c:623) r4:00000001 [<816f3734>] (nf_hook_slow) from [<817895cc>] (nf_hook include/linux/netfilter.h:273 [inline]) [<816f3734>] (nf_hook_slow) from [<817895cc>] (NF_HOOK include/linux/netfilter.h:316 [inline]) [<816f3734>] (nf_hook_slow) from [<817895cc>] (ip_local_deliver+0xf0/0x110 net/ipv4/ip_input.c:262) r9:00000040 r8:00000003 r7:00000000 r6:854b0000 r5:8458e000 r4:860f49c0 [<817894dc>] (ip_local_deliver) from [<81788664>] (dst_input include/net/dst.h:474 [inline]) [<817894dc>] (ip_local_deliver) from [<81788664>] (ip_rcv_finish+0x98/0xb0 net/ipv4/ip_input.c:453) r6:8458e000 r5:854b0000 r4:860f49c0 [<817885cc>] (ip_rcv_finish) from [<817896c0>] (NF_HOOK include/linux/netfilter.h:318 [inline]) [<817885cc>] (ip_rcv_finish) from [<817896c0>] (NF_HOOK include/linux/netfilter.h:312 [inline]) [<817885cc>] (ip_rcv_finish) from [<817896c0>] (ip_rcv+0xd4/0xe0 net/ipv4/ip_input.c:573) r7:00000000 r6:854b0000 r5:860f49c0 r4:00000001 [<817895ec>] (ip_rcv) from [<815d0390>] (__netif_receive_skb_one_core+0x5c/0x80 net/core/dev.c:6139) r6:00000000 r5:817895ec r4:8458e000 [<815d0334>] (__netif_receive_skb_one_core) from [<815d03fc>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6252) r5:dddd1120 r4:860f49c0 [<815d03e4>] (__netif_receive_skb) from [<815d0704>] (process_backlog+0xa0/0x17c net/core/dev.c:6604) r5:dddd1120 r4:860f49c0 [<815d0664>] (process_backlog) from [<815d0f64>] (__napi_poll+0x34/0x244 net/core/dev.c:7668) r10:df801ed8 r9:00000000 r8:0000012c r7:df801ed3 r6:00000040 r5:dddd1120 r4:00000001 [<815d0f30>] (__napi_poll) from [<815d14c8>] (napi_poll net/core/dev.c:7731 [inline]) [<815d0f30>] (__napi_poll) from [<815d14c8>] (net_rx_action+0x354/0x3e8 net/core/dev.c:7883) r9:00000000 r8:0000012c r7:dddd1124 r6:dddd1120 r5:0000012c r4:ffffffff [<815d1174>] (net_rx_action) from [<8025b65c>] (handle_softirqs+0x140/0x458 kernel/softirq.c:622) r10:83383000 r9:82804d80 r8:00000102 r7:00000003 r6:00000208 r5:00000004 r4:8280408c [<8025b51c>] (handle_softirqs) from [<802012f0>] (__do_softirq+0x14/0x18 kernel/softirq.c:656) r10:85140100 r9:84e50680 r8:85140208 r7:00000040 r6:81d98268 r5:00000002 r4:60010013 [<802012dc>] (__do_softirq) from [<8022786c>] (____do_softirq+0x10/0x14 arch/arm/kernel/irq.c:77) [<8022785c>] (____do_softirq) from [<81a7eb68>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40) [<81a7eb4c>] (call_with_stack) from [<802278a8>] (do_softirq_own_stack+0x38/0x3c arch/arm/kernel/irq.c:82) [<80227870>] (do_softirq_own_stack) from [<8025bc64>] (do_softirq kernel/softirq.c:523 [inline]) [<80227870>] (do_softirq_own_stack) from [<8025bc64>] (do_softirq+0x5c/0x64 kernel/softirq.c:510) [<8025bc08>] (do_softirq) from [<8025bd38>] (__local_bh_enable_ip+0xcc/0xd0 kernel/softirq.c:450) r5:00000002 r4:83383000 [<8025bc6c>] (__local_bh_enable_ip) from [<81abceb4>] (__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:167 [inline]) [<8025bc6c>] (__local_bh_enable_ip) from [<81abceb4>] (_raw_spin_unlock_bh+0x34/0x38 kernel/locking/spinlock.c:210) r5:84e50740 r4:860f4540 [<81abce80>] (_raw_spin_unlock_bh) from [<80e829b4>] (spin_unlock_bh include/linux/spinlock.h:396 [inline]) [<81abce80>] (_raw_spin_unlock_bh) from [<80e829b4>] (nsim_dev_trap_report drivers/net/netdevsim/dev.c:890 [inline]) [<81abce80>] (_raw_spin_unlock_bh) from [<80e829b4>] (nsim_dev_trap_report_work+0x2e4/0x410 drivers/net/netdevsim/dev.c:921) [<80e826d0>] (nsim_dev_trap_report_work) from [<80275db8>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3257) r10:8300e870 r9:83019805 r8:83383000 r7:8300e600 r6:83019800 r5:84e50680 r4:832ce380 [<80275c04>] (process_one_work) from [<802764f8>] (process_scheduled_works kernel/workqueue.c:3340 [inline]) [<80275c04>] (process_one_work) from [<802764f8>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3421) r10:61c88647 r9:83383000 r8:832ce3ac r7:82804d80 r6:8300e600 r5:8300e620 r4:832ce380 [<802762fc>] (worker_thread) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:832ce380 r8:802762fc r7:df8e1e60 r6:833eb980 r5:83383000 r4:00000001 [<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf935fb0 to 0xdf935ff8) 5fa0: 00000000 00000000 00000000 00000000 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0 r4:832d0940 INFO: task kworker/0:6:3845 blocked for more than 453 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/0:6 state:D stack:0 pid:3845 tgid:3845 ppid:2 task_flags:0x4208060 flags:0x00000000 Workqueue: events bpf_prog_free_deferred Call trace: [<81ab23ac>] (__schedule) from [<81ab3658>] (__schedule_loop kernel/sched/core.c:6945 [inline]) [<81ab23ac>] (__schedule) from [<81ab3658>] (schedule+0x2c/0x130 kernel/sched/core.c:6960) r10:dfbbdd84 r9:829174e8 r8:60000013 r7:829174e8 r6:dfbbdd8c r5:852b8c00 r4:852b8c00 [<81ab362c>] (schedule) from [<81ab37e0>] (schedule_preempt_disabled+0x18/0x24 kernel/sched/core.c:7017) r5:852b8c00 r4:829174e4 [<81ab37c8>] (schedule_preempt_disabled) from [<81ab6e64>] (__mutex_lock_common kernel/locking/mutex.c:692 [inline]) [<81ab37c8>] (schedule_preempt_disabled) from [<81ab6e64>] (__mutex_lock.constprop.0+0x658/0xf8c kernel/locking/mutex.c:776) [<81ab680c>] (__mutex_lock.constprop.0) from [<81ab786c>] (__mutex_lock_slowpath+0x14/0x18 kernel/locking/mutex.c:1065) r10:8280c9e4 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:dfbbde08 r4:00000000 [<81ab7858>] (__mutex_lock_slowpath) from [<81ab78ac>] (mutex_lock+0x3c/0x40 kernel/locking/mutex.c:290) [<81ab7870>] (mutex_lock) from [<804f4400>] (_vm_unmap_aliases+0x68/0x240 mm/vmalloc.c:2944) [<804f4398>] (_vm_unmap_aliases) from [<804f81e8>] (vm_reset_perms mm/vmalloc.c:3375 [inline]) [<804f4398>] (_vm_unmap_aliases) from [<804f81e8>] (vfree+0x16c/0x210 mm/vmalloc.c:3454) r10:83016170 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:861b7280 r4:00000000 [<804f807c>] (vfree) from [<80564020>] (execmem_free+0x30/0x50 mm/execmem.c:503) r9:83018405 r8:852b8c00 r7:00000000 r6:83018400 r5:00001000 r4:7f029000 [<80563ff0>] (execmem_free) from [<803cb2cc>] (bpf_jit_free_exec+0x10/0x14 kernel/bpf/core.c:1068) r5:00001000 r4:eb01b000 [<803cb2bc>] (bpf_jit_free_exec) from [<803cb6ac>] (bpf_jit_binary_free kernel/bpf/core.c:1114 [inline]) [<803cb2bc>] (bpf_jit_free_exec) from [<803cb6ac>] (bpf_jit_free+0x68/0xe4 kernel/bpf/core.c:1237) [<803cb644>] (bpf_jit_free) from [<803cc7d4>] (bpf_prog_free_deferred+0x140/0x158 kernel/bpf/core.c:2935) r5:85c0e394 r4:85c8f600 [<803cc694>] (bpf_prog_free_deferred) from [<80275db8>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3257) r7:dddcfb40 r6:83018400 r5:85c0e394 r4:85c8f600 [<80275c04>] (process_one_work) from [<802764f8>] (process_scheduled_works kernel/workqueue.c:3340 [inline]) [<80275c04>] (process_one_work) from [<802764f8>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3421) r10:61c88647 r9:852b8c00 r8:85c8f62c r7:82804d80 r6:dddcfb40 r5:dddcfb60 r4:85c8f600 [<802762fc>] (worker_thread) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:85c8f600 r8:802762fc r7:dfd4de60 r6:85c8f680 r5:852b8c00 r4:00000001 [<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdfbbdfb0 to 0xdfbbdff8) dfa0: 00000000 00000000 00000000 00000000 dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 dfe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0 r4:84ed9980 INFO: task kworker/0:6:3845 is blocked on a mutex likely owned by task kworker/1:1:45. task:kworker/1:1 state:R running task stack:0 pid:45 tgid:45 ppid:2 task_flags:0x4208060 flags:0x00000000 Workqueue: events bpf_prog_free_deferred Call trace: [<81ab23ac>] (__schedule) from [<81ab3a8c>] (preempt_schedule_irq+0x40/0xa8 kernel/sched/core.c:7190) r10:8280ca38 r9:83315400 r8:80200c04 r7:df919d54 r6:ffffffff r5:83315400 r4:00000000 [<81ab3a4c>] (preempt_schedule_irq) from [<80200c24>] (svc_preempt+0x8/0x18) Exception stack(0xdf919d20 to 0xdf919d68) 9d20: ae8d3000 ebdd3000 00000001 80239018 7f00d000 00000001 82ace204 82acd5e0 9d40: 7f00d000 ebdd3000 8280ca38 df919d9c df919da0 df919d70 8022fe10 80239030 9d60: 80000013 ffffffff r5:80000013 r4:80239030 [<8022fdac>] (flush_tlb_kernel_range) from [<804f41c4>] (__purge_vmap_area_lazy+0x284/0x458 mm/vmalloc.c:2369) r4:82ace224 [<804f3f40>] (__purge_vmap_area_lazy) from [<804f457c>] (_vm_unmap_aliases+0x1e4/0x240 mm/vmalloc.c:2983) r10:00000000 r9:00000000 r8:00000000 r7:ffffffff r6:df919dc0 r5:df919e08 r4:df919dc0 [<804f4398>] (_vm_unmap_aliases) from [<804f81e8>] (vm_reset_perms mm/vmalloc.c:3375 [inline]) [<804f4398>] (_vm_unmap_aliases) from [<804f81e8>] (vfree+0x16c/0x210 mm/vmalloc.c:3454) r10:83016170 r9:00000001 r8:00000000 r7:ffffffff r6:00000000 r5:862dee00 r4:00000000 [<804f807c>] (vfree) from [<80564020>] (execmem_free+0x30/0x50 mm/execmem.c:503) r9:83018605 r8:83315400 r7:00000000 r6:83018600 r5:00001000 r4:7f00d000 [<80563ff0>] (execmem_free) from [<803cb2cc>] (bpf_jit_free_exec+0x10/0x14 kernel/bpf/core.c:1068) r5:00001000 r4:eaf25000 [<803cb2bc>] (bpf_jit_free_exec) from [<803cb6ac>] (bpf_jit_binary_free kernel/bpf/core.c:1114 [inline]) [<803cb2bc>] (bpf_jit_free_exec) from [<803cb6ac>] (bpf_jit_free+0x68/0xe4 kernel/bpf/core.c:1237) [<803cb644>] (bpf_jit_free) from [<803cc7d4>] (bpf_prog_free_deferred+0x140/0x158 kernel/bpf/core.c:2935) r5:8513df94 r4:832ce200 [<803cc694>] (bpf_prog_free_deferred) from [<80275db8>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3257) r7:ddde3b40 r6:83018600 r5:8513df94 r4:832ce200 [<80275c04>] (process_one_work) from [<802764f8>] (process_scheduled_works kernel/workqueue.c:3340 [inline]) [<80275c04>] (process_one_work) from [<802764f8>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3421) r10:61c88647 r9:83315400 r8:832ce22c r7:82804d80 r6:ddde3b40 r5:ddde3b60 r4:832ce200 [<802762fc>] (worker_thread) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:832ce200 r8:802762fc r7:df879e60 r6:832ce280 r5:83315400 r4:00000001 [<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf919fb0 to 0xdf919ff8) 9fa0: 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0 r4:832d0940 NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 30 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express Call trace: [<80201a74>] (dump_backtrace) from [<80201b70>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:257) r7:00000000 r6:00000113 r5:60000193 r4:822958fc [<80201b58>] (show_stack) from [<8021ee34>] (__dump_stack lib/dump_stack.c:94 [inline]) [<80201b58>] (show_stack) from [<8021ee34>] (dump_stack_lvl+0x70/0x7c lib/dump_stack.c:120) [<8021edc4>] (dump_stack_lvl) from [<8021ee58>] (dump_stack+0x18/0x1c lib/dump_stack.c:129) r5:00000001 r4:00000001 [<8021ee40>] (dump_stack) from [<81a9be90>] (nmi_cpu_backtrace+0x160/0x17c lib/nmi_backtrace.c:113) [<81a9bd30>] (nmi_cpu_backtrace) from [<81a9bfdc>] (nmi_trigger_cpumask_backtrace+0x130/0x1d8 lib/nmi_backtrace.c:62) r7:00000001 r6:8280c710 r5:8281af5c r4:ffffffff [<81a9beac>] (nmi_trigger_cpumask_backtrace) from [<8022f818>] (arch_trigger_cpumask_backtrace+0x18/0x1c arch/arm/kernel/smp.c:852) r9:00007f39 r8:8280c890 r7:0000fca3 r6:00007f39 r5:82ac27e4 r4:00000048 [<8022f800>] (arch_trigger_cpumask_backtrace) from [<81aa3aec>] (trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]) [<8022f800>] (arch_trigger_cpumask_backtrace) from [<81aa3aec>] (__sys_info lib/sys_info.c:157 [inline]) [<8022f800>] (arch_trigger_cpumask_backtrace) from [<81aa3aec>] (sys_info+0x68/0xa8 lib/sys_info.c:165) [<81aa3a84>] (sys_info) from [<803837fc>] (check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]) [<81aa3a84>] (sys_info) from [<803837fc>] (watchdog+0x464/0x8a0 kernel/hung_task.c:515) r5:82ac27e4 r4:8333cb0c [<80383398>] (watchdog) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:00000000 r8:80383398 r7:832a3b80 r6:832a3b80 r5:832e1800 r4:00000001 [<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xdf8d9fb0 to 0xdf8d9ff8) 9fa0: 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0 r4:833a1a80 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 2819 Comm: pr/ttyAMA-1 Not tainted syzkaller #0 PREEMPT Hardware name: ARM-Versatile Express PC is at nf_nat_ipv4_local_fn+0x58/0x130 net/netfilter/nf_nat_proto.c:758 LR is at nf_nat_ipv4_fn net/netfilter/nf_nat_proto.c:602 [inline] LR is at nf_nat_ipv4_local_fn+0x58/0x130 net/netfilter/nf_nat_proto.c:757 pc : [<81725200>] lr : [<81725200>] psr: 600f0113 sp : df801a58 ip : df801a58 fp : df801a6c r10: 85c4e7d4 r9 : 8574cba8 r8 : df801a9c r7 : 863e5300 r6 : 8574cb80 r5 : df801a9c r4 : 863e5300 r3 : 00000001 r2 : 00000010 r1 : 00000388 r0 : 00000001 Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment user Control: 30c5387d Table: 850bd2c0 DAC: fffffffd Call trace: frame pointer underflow [<817251a8>] (nf_nat_ipv4_local_fn) from [<816f3774>] (nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]) [<817251a8>] (nf_nat_ipv4_local_fn) from [<816f3774>] (nf_hook_slow+0x40/0x104 net/netfilter/core.c:623) r5:00000005 r4:00000001 [<816f3734>] (nf_hook_slow) from [<8178f98c>] (nf_hook include/linux/netfilter.h:273 [inline]) [<816f3734>] (nf_hook_slow) from [<8178f98c>] (__ip_local_out+0x13c/0x1b0 net/ipv4/ip_output.c:120) r9:85c4e100 r8:86276d01 r7:8458e000 r6:00000000 r5:854b0000 r4:863e5300 [<8178f850>] (__ip_local_out) from [<8178fa1c>] (ip_local_out+0x1c/0x44 net/ipv4/ip_output.c:129) r7:86276d00 r6:00000000 r5:854b0000 r4:863e5300 [<8178fa00>] (ip_local_out) from [<81729b60>] (synproxy_send_tcp+0x124/0x190 net/netfilter/nf_synproxy_core.c:439) r7:86276d00 r6:854b0000 r5:85d1c300 r4:863e5300 [<81729a3c>] (synproxy_send_tcp) from [<81729f44>] (synproxy_send_client_synack+0x190/0x1e8 net/netfilter/nf_synproxy_core.c:484) r9:85c4e100 r8:85c4e114 r7:df801b80 r6:863e5840 r5:00000014 r4:863e5300 [<81729db4>] (synproxy_send_client_synack) from [<817651f0>] (nft_synproxy_eval_v4 net/netfilter/nft_synproxy.c:59 [inline]) [<81729db4>] (synproxy_send_client_synack) from [<817651f0>] (nft_synproxy_do_eval+0x25c/0x2b4 net/netfilter/nft_synproxy.c:141) r10:81e66128 r9:85c4e114 r8:84d90fc0 r7:85c7bbd8 r6:df801c4c r5:854b0000 r4:863e5840 [<81764f94>] (nft_synproxy_do_eval) from [<81765274>] (nft_synproxy_eval+0x14/0x18 net/netfilter/nft_synproxy.c:247) r9:df801ce4 r8:81e662b0 r7:81e66014 r6:81e65fd0 r5:85c7bbe0 r4:85c7bbd0 [<81765260>] (nft_synproxy_eval) from [<8172cf1c>] (expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]) [<81765260>] (nft_synproxy_eval) from [<8172cf1c>] (nft_do_chain+0x12c/0x570 net/netfilter/nf_tables_core.c:285) [<8172cdf0>] (nft_do_chain) from [<81747000>] (nft_do_chain_inet+0xac/0x120 net/netfilter/nft_chain_filter.c:161) r10:dddd1008 r9:8574cda0 r8:df801d3c r7:863e5840 r6:8574cd80 r5:00000004 r4:85c714c0 [<81746f54>] (nft_do_chain_inet) from [<816f3774>] (nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]) [<81746f54>] (nft_do_chain_inet) from [<816f3774>] (nf_hook_slow+0x40/0x104 net/netfilter/core.c:623) r4:00000001 [<816f3734>] (nf_hook_slow) from [<817895cc>] (nf_hook include/linux/netfilter.h:273 [inline]) [<816f3734>] (nf_hook_slow) from [<817895cc>] (NF_HOOK include/linux/netfilter.h:316 [inline]) [<816f3734>] (nf_hook_slow) from [<817895cc>] (ip_local_deliver+0xf0/0x110 net/ipv4/ip_input.c:262) r9:00000040 r8:00000021 r7:00000000 r6:854b0000 r5:8458e000 r4:863e5840 [<817894dc>] (ip_local_deliver) from [<81788664>] (dst_input include/net/dst.h:474 [inline]) [<817894dc>] (ip_local_deliver) from [<81788664>] (ip_rcv_finish+0x98/0xb0 net/ipv4/ip_input.c:453) r6:8458e000 r5:854b0000 r4:863e5840 [<817885cc>] (ip_rcv_finish) from [<817896c0>] (NF_HOOK include/linux/netfilter.h:318 [inline]) [<817885cc>] (ip_rcv_finish) from [<817896c0>] (NF_HOOK include/linux/netfilter.h:312 [inline]) [<817885cc>] (ip_rcv_finish) from [<817896c0>] (ip_rcv+0xd4/0xe0 net/ipv4/ip_input.c:573) r7:00000000 r6:854b0000 r5:863e5840 r4:00000001 [<817895ec>] (ip_rcv) from [<815d0390>] (__netif_receive_skb_one_core+0x5c/0x80 net/core/dev.c:6139) r6:00000000 r5:817895ec r4:8458e000 [<815d0334>] (__netif_receive_skb_one_core) from [<815d03fc>] (__netif_receive_skb+0x18/0x5c net/core/dev.c:6252) r5:dddd1120 r4:863e5840 [<815d03e4>] (__netif_receive_skb) from [<815d0704>] (process_backlog+0xa0/0x17c net/core/dev.c:6604) r5:dddd1120 r4:863e5840 [<815d0664>] (process_backlog) from [<815d0f64>] (__napi_poll+0x34/0x244 net/core/dev.c:7668) r10:df801ea8 r9:00000000 r8:0000012c r7:df801ea3 r6:00000040 r5:dddd1120 r4:00000001 [<815d0f30>] (__napi_poll) from [<815d14c8>] (napi_poll net/core/dev.c:7731 [inline]) [<815d0f30>] (__napi_poll) from [<815d14c8>] (net_rx_action+0x354/0x3e8 net/core/dev.c:7883) r9:00000000 r8:0000012c r7:dddd1124 r6:dddd1120 r5:0000012c r4:ffffffff [<815d1174>] (net_rx_action) from [<8025b65c>] (handle_softirqs+0x140/0x458 kernel/softirq.c:622) r10:845a0c00 r9:82804d80 r8:00000101 r7:00000003 r6:00000088 r5:00000004 r4:8280408c [<8025b51c>] (handle_softirqs) from [<8025bad0>] (__do_softirq kernel/softirq.c:656 [inline]) [<8025b51c>] (handle_softirqs) from [<8025bad0>] (invoke_softirq kernel/softirq.c:496 [inline]) [<8025b51c>] (handle_softirqs) from [<8025bad0>] (__irq_exit_rcu+0x110/0x1d0 kernel/softirq.c:723) r10:82959c04 r9:845a0c00 r8:00000000 r7:eb049e60 r6:824441e0 r5:8247f34c r4:845a0c00 [<8025b9c0>] (__irq_exit_rcu) from [<8025be48>] (irq_exit+0x10/0x18 kernel/softirq.c:751) r5:8247f34c r4:826c3a9c [<8025be38>] (irq_exit) from [<81aaebd4>] (generic_handle_arch_irq+0x7c/0x80 kernel/irq/handle.c:295) [<81aaeb58>] (generic_handle_arch_irq) from [<81a7eb68>] (call_with_stack+0x1c/0x20 arch/arm/lib/call_with_stack.S:40) r9:845a0c00 r8:00000000 r7:eb049e94 r6:ffffffff r5:600f0013 r4:81abd000 [<81a7eb4c>] (call_with_stack) from [<80200bec>] (__irq_svc+0x8c/0xbc arch/arm/kernel/entry-armv.S:228) Exception stack(0xeb049e60 to 0xeb049ea8) 9e60: 84468040 600f0013 00000000 000009c6 00000001 00000000 82959b68 00000117 9e80: 00000000 00000000 82959c04 eb049ebc eb049ec0 eb049eb0 80aa3bdc 81abd000 9ea0: 600f0013 ffffffff [<81abcfd8>] (_raw_spin_unlock_irqrestore) from [<80aa3bdc>] (spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]) [<81abcfd8>] (_raw_spin_unlock_irqrestore) from [<80aa3bdc>] (__uart_port_unlock_irqrestore include/linux/serial_core.h:616 [inline]) [<81abcfd8>] (_raw_spin_unlock_irqrestore) from [<80aa3bdc>] (pl011_console_device_unlock+0x20/0x24 drivers/tty/serial/amba-pl011.c:2603) [<80aa3bbc>] (pl011_console_device_unlock) from [<802e5768>] (nbcon_emit_one+0x88/0x100 kernel/printk/nbcon.c:1149) [<802e56e0>] (nbcon_emit_one) from [<802e59e8>] (nbcon_kthread_func+0x208/0x2e4 kernel/printk/nbcon.c:1255) r6:82abf0fc r5:82959b68 r4:845a0c00 [<802e57e0>] (nbcon_kthread_func) from [<8027f6fc>] (kthread+0x12c/0x280 kernel/kthread.c:463) r10:00000000 r9:82959b68 r8:802e57e0 r7:84b72d00 r6:84b72d00 r5:845a0c00 r4:00000001 [<8027f5d0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137) Exception stack(0xeb049fb0 to 0xeb049ff8) 9fa0: 00000000 00000000 00000000 00000000 9fc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000 9fe0: 00000000 00000000 00000000 00000000 00000013 00000000 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:8027f5d0 r4:84f7d280