Extracting prog: 32m49.060966179s Minimizing prog: 4h30m51.643435942s Simplifying prog options: 54m51.000244248s Extracting C: 18m13.154255151s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 45s testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 5m0s testing program (duration=5m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 16m0s testing program (duration=16m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program crashed: INFO: task hung in rtnl_lock single: successfully extracted reproducer found reproducer with 4 syscalls minimizing guilty program testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) socket$kcm(0x2, 0x200000000000001, 0x106) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socket$kcm-sendmsg$inet detailed listing: executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r0, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB], 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, 0x0, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x30004001) program did not crash extracting C reproducer testing compiled C program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=23m45.409379038s, {Threaded:false Repeat:true RepeatTimes:0 Procs:2 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash testing program (duration=23m45.409379038s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:10 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-socket$kcm-sendmsg$inet detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) r1 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f00000001c0)={0x2, 0x4001, @local}, 0x10, 0x0}, 0x30004001) program did not crash reproducing took 6h16m44.85892592s repro crashed as (corrupted=false): INFO: task kworker/u8:2:2993 blocked for more than 435 seconds. Not tainted 6.12.0-rc6-syzkaller-g57f7c7dc78cd #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:2 state:D stack:0 pid:2993 tgid:2993 ppid:2 flags:0x00000000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: [] context_switch kernel/sched/core.c:5328 [inline] [] __schedule+0xd58/0x3848 kernel/sched/core.c:6690 [] __schedule_loop kernel/sched/core.c:6767 [inline] [] schedule+0xc4/0x324 kernel/sched/core.c:6782 [] schedule_preempt_disabled+0x16/0x28 kernel/sched/core.c:6839 [] __mutex_lock_common kernel/locking/mutex.c:684 [inline] [] __mutex_lock+0x86a/0x1022 kernel/locking/mutex.c:752 [] mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:804 [] rtnl_lock+0x22/0x2a net/core/rtnetlink.c:79 [] addrconf_dad_work+0xbc/0x1420 net/ipv6/addrconf.c:4196 [] process_one_work+0x956/0x1dae kernel/workqueue.c:3229 [] process_scheduled_works kernel/workqueue.c:3310 [inline] [] worker_thread+0x5be/0xdc6 kernel/workqueue.c:3391 [] kthread+0x28c/0x3a6 kernel/kthread.c:389 [] ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:326 Showing all locks held in the system: 2 locks held by kthreadd/2: 1 lock held by khungtaskd/36: #0: ffffffff881cc080 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x68/0x2d6 kernel/locking/lockdep.c:6716 1 lock held by syslogd/2967: 1 lock held by klogd/2971: 3 locks held by kworker/u8:2/2993: #0: ff6000001c3d5148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x848/0x1dae kernel/workqueue.c:3204 #1: ff200000071a7c90 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x870/0x1dae kernel/workqueue.c:3204 #2: ffffffff895ae468 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x22/0x2a net/core/rtnetlink.c:79 2 locks held by getty/3122: #0: ff6000001854e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3a/0x46 drivers/tty/tty_ldsem.c:340 #1: ff2000000008b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xd7c/0x129a drivers/tty/n_tty.c:2211 2 locks held by syz-executor/3822: 3 locks held by kworker/u10:6/3951: 1 lock held by syz.2.15/4595: #0: ffffffff895ae468 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x22/0x2a net/core/rtnetlink.c:79 2 locks held by rm/4597: 1 lock held by syz-executor/4600: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 36 Comm: khungtaskd Not tainted 6.12.0-rc6-syzkaller-g57f7c7dc78cd #0 Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:130 [] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:136 [] __dump_stack lib/dump_stack.c:94 [inline] [] dump_stack_lvl+0x122/0x196 lib/dump_stack.c:120 [] dump_stack+0x1c/0x24 lib/dump_stack.c:129 [] nmi_cpu_backtrace+0x39c/0x39e lib/nmi_backtrace.c:113 [] nmi_trigger_cpumask_backtrace+0x2b6/0x456 lib/nmi_backtrace.c:62 [] arch_trigger_cpumask_backtrace+0x2c/0x3c arch/riscv/kernel/smp.c:347 [] trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] [] watchdog+0xcfa/0x1178 kernel/hung_task.c:379 [] kthread+0x28c/0x3a6 kernel/kthread.c:389 [] ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:326 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.12.0-rc6-syzkaller-g57f7c7dc78cd #0 Hardware name: riscv-virtio,qemu (DT) epc : slab_update_freelist mm/slub.c:740 [inline] epc : __slab_free+0xf2/0x3f6 mm/slub.c:4431 ra : slab_update_freelist mm/slub.c:738 [inline] ra : __slab_free+0x220/0x3f6 mm/slub.c:4431 epc : ffffffff808d953e ra : ffffffff808d966c sp : ff20000000037550 gp : ffffffff899c0180 tp : ff60000012289a40 t0 : ff6000001228a560 t1 : ffebffff02200108 t2 : 000000000000001a s0 : ff20000000037620 s1 : 0000000000000002 a0 : 0000000000000001 a1 : 0000000000000000 a2 : 0000000000000000 a3 : ffffffff814a98a0 a4 : 0000000000000001 a5 : 0000000000000000 a6 : 0000000000000003 a7 : 1fec0000024514b0 s2 : 000000000000000f s3 : 0000000000000000 s4 : 0000000000000000 s5 : ff60000011001dc0 s6 : 0000000000000001 s7 : 0000000000000001 s8 : 0000000000000000 s9 : ff60000040e78000 s10: 0000000000100010 s11: ff1c000001039e00 t3 : 1fec0000024514ab t4 : ffebffff02200108 t5 : ffebffff02200109 t6 : 1fec0000024514b5 status: 0000000200000120 badaddr: 0000000000000000 cause: 8000000000000001 [] arch_local_irq_restore arch/riscv/include/asm/irqflags.h:51 [inline] [] slab_update_freelist mm/slub.c:738 [inline] [] __slab_free+0xf2/0x3f6 mm/slub.c:4431 [] do_slab_free mm/slub.c:4531 [inline] [] ___cache_free+0x1a6/0x1e0 mm/slub.c:4637 [] qlink_free mm/kasan/quarantine.c:163 [inline] [] qlist_free_all+0x76/0x16c mm/kasan/quarantine.c:179 [] kasan_quarantine_reduce+0x158/0x1ba mm/kasan/quarantine.c:286 [] __kasan_slab_alloc+0x5c/0x82 mm/kasan/common.c:329 [] kasan_slab_alloc include/linux/kasan.h:247 [inline] [] slab_post_alloc_hook mm/slub.c:4085 [inline] [] slab_alloc_node mm/slub.c:4134 [inline] [] __do_kmalloc_node mm/slub.c:4263 [inline] [] __kmalloc_noprof+0x24a/0x4e4 mm/slub.c:4276 [] kmalloc_noprof include/linux/slab.h:882 [inline] [] kzalloc_noprof include/linux/slab.h:1014 [inline] [] lsm_blob_alloc+0x74/0x8a security/security.c:685 [] lsm_task_alloc security/security.c:772 [inline] [] security_task_alloc+0x34/0x2bc security/security.c:3159 [] copy_process+0x2524/0x8e52 kernel/fork.c:2356 [] kernel_clone+0x11e/0x92c kernel/fork.c:2786 [] kernel_thread+0xf4/0x126 kernel/fork.c:2848 [] create_kthread kernel/kthread.c:412 [inline] [] kthreadd+0x46e/0x6e8 kernel/kthread.c:767 [] ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:326 final repro crashed as (corrupted=false): INFO: task kworker/u8:2:2993 blocked for more than 435 seconds. Not tainted 6.12.0-rc6-syzkaller-g57f7c7dc78cd #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:2 state:D stack:0 pid:2993 tgid:2993 ppid:2 flags:0x00000000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: [] context_switch kernel/sched/core.c:5328 [inline] [] __schedule+0xd58/0x3848 kernel/sched/core.c:6690 [] __schedule_loop kernel/sched/core.c:6767 [inline] [] schedule+0xc4/0x324 kernel/sched/core.c:6782 [] schedule_preempt_disabled+0x16/0x28 kernel/sched/core.c:6839 [] __mutex_lock_common kernel/locking/mutex.c:684 [inline] [] __mutex_lock+0x86a/0x1022 kernel/locking/mutex.c:752 [] mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:804 [] rtnl_lock+0x22/0x2a net/core/rtnetlink.c:79 [] addrconf_dad_work+0xbc/0x1420 net/ipv6/addrconf.c:4196 [] process_one_work+0x956/0x1dae kernel/workqueue.c:3229 [] process_scheduled_works kernel/workqueue.c:3310 [inline] [] worker_thread+0x5be/0xdc6 kernel/workqueue.c:3391 [] kthread+0x28c/0x3a6 kernel/kthread.c:389 [] ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:326 Showing all locks held in the system: 2 locks held by kthreadd/2: 1 lock held by khungtaskd/36: #0: ffffffff881cc080 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x68/0x2d6 kernel/locking/lockdep.c:6716 1 lock held by syslogd/2967: 1 lock held by klogd/2971: 3 locks held by kworker/u8:2/2993: #0: ff6000001c3d5148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x848/0x1dae kernel/workqueue.c:3204 #1: ff200000071a7c90 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x870/0x1dae kernel/workqueue.c:3204 #2: ffffffff895ae468 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x22/0x2a net/core/rtnetlink.c:79 2 locks held by getty/3122: #0: ff6000001854e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3a/0x46 drivers/tty/tty_ldsem.c:340 #1: ff2000000008b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0xd7c/0x129a drivers/tty/n_tty.c:2211 2 locks held by syz-executor/3822: 3 locks held by kworker/u10:6/3951: 1 lock held by syz.2.15/4595: #0: ffffffff895ae468 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x22/0x2a net/core/rtnetlink.c:79 2 locks held by rm/4597: 1 lock held by syz-executor/4600: ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 36 Comm: khungtaskd Not tainted 6.12.0-rc6-syzkaller-g57f7c7dc78cd #0 Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:130 [] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:136 [] __dump_stack lib/dump_stack.c:94 [inline] [] dump_stack_lvl+0x122/0x196 lib/dump_stack.c:120 [] dump_stack+0x1c/0x24 lib/dump_stack.c:129 [] nmi_cpu_backtrace+0x39c/0x39e lib/nmi_backtrace.c:113 [] nmi_trigger_cpumask_backtrace+0x2b6/0x456 lib/nmi_backtrace.c:62 [] arch_trigger_cpumask_backtrace+0x2c/0x3c arch/riscv/kernel/smp.c:347 [] trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline] [] check_hung_uninterruptible_tasks kernel/hung_task.c:223 [inline] [] watchdog+0xcfa/0x1178 kernel/hung_task.c:379 [] kthread+0x28c/0x3a6 kernel/kthread.c:389 [] ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:326 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 2 Comm: kthreadd Not tainted 6.12.0-rc6-syzkaller-g57f7c7dc78cd #0 Hardware name: riscv-virtio,qemu (DT) epc : slab_update_freelist mm/slub.c:740 [inline] epc : __slab_free+0xf2/0x3f6 mm/slub.c:4431 ra : slab_update_freelist mm/slub.c:738 [inline] ra : __slab_free+0x220/0x3f6 mm/slub.c:4431 epc : ffffffff808d953e ra : ffffffff808d966c sp : ff20000000037550 gp : ffffffff899c0180 tp : ff60000012289a40 t0 : ff6000001228a560 t1 : ffebffff02200108 t2 : 000000000000001a s0 : ff20000000037620 s1 : 0000000000000002 a0 : 0000000000000001 a1 : 0000000000000000 a2 : 0000000000000000 a3 : ffffffff814a98a0 a4 : 0000000000000001 a5 : 0000000000000000 a6 : 0000000000000003 a7 : 1fec0000024514b0 s2 : 000000000000000f s3 : 0000000000000000 s4 : 0000000000000000 s5 : ff60000011001dc0 s6 : 0000000000000001 s7 : 0000000000000001 s8 : 0000000000000000 s9 : ff60000040e78000 s10: 0000000000100010 s11: ff1c000001039e00 t3 : 1fec0000024514ab t4 : ffebffff02200108 t5 : ffebffff02200109 t6 : 1fec0000024514b5 status: 0000000200000120 badaddr: 0000000000000000 cause: 8000000000000001 [] arch_local_irq_restore arch/riscv/include/asm/irqflags.h:51 [inline] [] slab_update_freelist mm/slub.c:738 [inline] [] __slab_free+0xf2/0x3f6 mm/slub.c:4431 [] do_slab_free mm/slub.c:4531 [inline] [] ___cache_free+0x1a6/0x1e0 mm/slub.c:4637 [] qlink_free mm/kasan/quarantine.c:163 [inline] [] qlist_free_all+0x76/0x16c mm/kasan/quarantine.c:179 [] kasan_quarantine_reduce+0x158/0x1ba mm/kasan/quarantine.c:286 [] __kasan_slab_alloc+0x5c/0x82 mm/kasan/common.c:329 [] kasan_slab_alloc include/linux/kasan.h:247 [inline] [] slab_post_alloc_hook mm/slub.c:4085 [inline] [] slab_alloc_node mm/slub.c:4134 [inline] [] __do_kmalloc_node mm/slub.c:4263 [inline] [] __kmalloc_noprof+0x24a/0x4e4 mm/slub.c:4276 [] kmalloc_noprof include/linux/slab.h:882 [inline] [] kzalloc_noprof include/linux/slab.h:1014 [inline] [] lsm_blob_alloc+0x74/0x8a security/security.c:685 [] lsm_task_alloc security/security.c:772 [inline] [] security_task_alloc+0x34/0x2bc security/security.c:3159 [] copy_process+0x2524/0x8e52 kernel/fork.c:2356 [] kernel_clone+0x11e/0x92c kernel/fork.c:2786 [] kernel_thread+0xf4/0x126 kernel/fork.c:2848 [] create_kthread kernel/kthread.c:412 [inline] [] kthreadd+0x46e/0x6e8 kernel/kthread.c:767 [] ret_from_fork+0xe/0x18 arch/riscv/kernel/entry.S:326