Extracting prog: 3m28.251110149s Minimizing prog: 30m13.971747074s Simplifying prog options: 0s Extracting C: 1m47.085826463s Simplifying C: 53m7.908434985s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000400)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0x1d, "dea1d8981aa3a9c188aaf2269615123ca0a2894d756ec481f02e868817"}}) program did not crash single: failed to extract reproducer single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000400)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0x1d, "dea1d8981aa3a9c188aaf2269615123ca0a2894d756ec481f02e868817"}}) program crashed: BUG: workqueue lockup single: successfully extracted reproducer found reproducer with 2 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix detailed listing: executing program 0: socket$unix(0x1, 0x5, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x89f0, &(0x7f0000000400)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0x1d, "dea1d8981aa3a9c188aaf2269615123ca0a2894d756ec481f02e868817"}}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000400)={'bridge0\x00', 0x0}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000400)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs}) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: BUG: workqueue lockup simplifying C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: INFO: task hung in rtnl_lock a never seen crash title: INFO: task hung in rtnl_lock, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: BUG: workqueue lockup testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: INFO: task hung in rtnl_lock a never seen crash title: INFO: task hung in rtnl_lock, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: INFO: task hung in rtnl_lock a never seen crash title: INFO: task hung in rtnl_lock, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: BUG: workqueue lockup testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: no output from test machine a never seen crash title: no output from test machine, ignore testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: BUG: workqueue lockup testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: BUG: workqueue lockup testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: BUG: workqueue lockup testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL program crashed: BUG: workqueue lockup testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000400)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0x1d, "dea1d8981aa3a9c188aaf2269615123ca0a2894d756ec481f02e868817"}}) program crashed: INFO: task hung in nsim_bus_dev_del validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000400)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0x1d, "dea1d8981aa3a9c188aaf2269615123ca0a2894d756ec481f02e868817"}}) program crashed: BUG: workqueue lockup validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-ioctl$sock_SIOCETHTOOL detailed listing: executing program 0: r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000400)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0x1d, "dea1d8981aa3a9c188aaf2269615123ca0a2894d756ec481f02e868817"}}) program crashed: INFO: task hung in rtnl_lock validation run: crashed=true reproducing took 1h36m51.137757192s repro crashed as (corrupted=false): INFO: task kworker/u8:0:12 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:0 state:D stack:0 pid:12 tgid:12 ppid:2 task_flags:0x4208160 flags:0x00000010 Workqueue: netns cleanup_net Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 register_nexthop_notifier+0x28/0x88 net/ipv4/nexthop.c:4026 nsim_fib_create+0x54c/0x888 drivers/net/netdevsim/fib.c:1585 nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline] nsim_dev_reload_up+0x310/0x5b4 drivers/net/netdevsim/dev.c:1058 devlink_reload+0x3b0/0x64c net/devlink/dev.c:475 devlink_pernet_pre_exit+0x1ac/0x30c net/devlink/core.c:560 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x158/0x81c net/core/net_namespace.c:234 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:702 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 INFO: task kworker/u8:2:39 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:2 state:D stack:0 pid:39 tgid:39 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: events_power_efficient crda_timeout_work Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 crda_timeout_work+0x20/0x90 net/wireless/reg.c:529 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 INFO: task kworker/u8:4:1103 blocked for more than 150 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:4 state:D stack:0 pid:1103 tgid:1103 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: events_unbound linkwatch_event Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 linkwatch_event+0x14/0x68 net/core/link_watch.c:313 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 INFO: task kworker/R-ipv6_:2819 blocked for more than 150 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/R-ipv6_ state:D stack:0 pid:2819 tgid:2819 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: ipv6_addrconf addrconf_dad_work Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 rtnl_net_lock include/linux/rtnetlink.h:130 [inline] addrconf_dad_work+0x100/0xfe8 net/ipv6/addrconf.c:4229 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 rescuer_thread+0x68c/0xd90 kernel/workqueue.c:3629 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 INFO: task syz-executor:4850 blocked for more than 150 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:4850 tgid:4850 ppid:4839 task_flags:0x400140 flags:0x00800000 Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 del_device_store+0xd8/0x2d4 drivers/net/netdevsim/bus.c:234 bus_attr_store+0x80/0xa4 drivers/base/bus.c:172 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x84/0x98 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 INFO: task syz-executor:4854 blocked for more than 150 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:4854 tgid:4854 ppid:4844 task_flags:0x400140 flags:0x00800010 Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 device_lock include/linux/device.h:1104 [inline] device_del+0xa4/0x71c drivers/base/core.c:3923 device_unregister+0x2c/0xf0 drivers/base/core.c:4002 nsim_bus_dev_del+0x60/0x8c drivers/net/netdevsim/bus.c:491 del_device_store+0x24c/0x2d4 drivers/net/netdevsim/bus.c:244 bus_attr_store+0x80/0xa4 drivers/base/bus.c:172 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x84/0x98 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Showing all locks held in the system: 2 locks held by kthreadd/2: 2 locks held by kworker/0:0/9: 3 locks held by kworker/0:1/10: 6 locks held by kworker/u8:0/12: #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff80008ec87c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff80008ec87c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089df6e08 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x104/0x6c4 net/core/net_namespace.c:673 #3: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x108/0x30c net/devlink/core.c:557 #4: ffff0000dc2e9258 (&devlink->lock_key){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:292 [inline] #4: ffff0000dc2e9258 (&devlink->lock_key){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff0000dc2e9258 (&devlink->lock_key){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x11c/0x30c net/devlink/core.c:557 #5: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 1 lock held by kworker/R-mm_pe/13: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 3 locks held by kworker/u8:1/15: 2 locks held by kworker/1:1/26: 1 lock held by khungtaskd/31: #0: ffff800088d171a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffff800088d171a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffff800088d171a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x4c/0x188 kernel/locking/lockdep.c:6775 1 lock held by kworker/R-write/33: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 3 locks held by kworker/u8:2/39: #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff8000901c7c40 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff8000901c7c40 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 3 locks held by kworker/u8:3/40: 1 lock held by pr/ttyAMA-1/41: 2 locks held by kworker/0:2/866: 2 locks held by kworker/1:2/1066: 3 locks held by kworker/u8:4/1103: #0: ffff0000c004c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c004c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff800094b07c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff800094b07c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 3 locks held by kworker/0:3/1512: #0: ffff0000c002b540 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c002b540 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff800096427c40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff800096427c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 3 locks held by kworker/R-ipv6_/2819: #0: ffff0000ce1db140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000ce1db140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff8000994c7c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff8000994c7c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 4 locks held by kworker/R-bat_e/2851: 3 locks held by kworker/u8:5/3622: 3 locks held by kworker/u8:6/3789: #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff800099957c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff800099957c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 1 lock held by kworker/R-ext4-/4310: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 1 lock held by klogd/4333: 1 lock held by udevd/4344: 1 lock held by dhcpcd/4400: 2 locks held by getty/4492: #0: ffff0000ce1fc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff8000924fb2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x348/0xf78 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/4728: 3 locks held by kworker/1:3/4774: 1 lock held by kworker/R-wg-cr/4775: 1 lock held by kworker/R-wg-cr/4776: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 2 locks held by udevd/4803: 1 lock held by syz-executor/4838: 2 locks held by syz-executor/4849: 4 locks held by syz-executor/4850: #0: ffff0000d1536450 (sb_writers#6){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d1536450 (sb_writers#6){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d1040480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 #2: ffff0000c9e23968 (kn->active#55){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff0000c9e23968 (kn->active#55){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1f0/0x3b8 fs/kernfs/file.c:337 #3: ffff8000895e4920 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd8/0x2d4 drivers/net/netdevsim/bus.c:234 5 locks held by syz-executor/4854: #0: ffff0000d1536450 (sb_writers#6){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d1536450 (sb_writers#6){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000ec598480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 #2: ffff0000c9e23968 (kn->active#55){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff0000c9e23968 (kn->active#55){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1f0/0x3b8 fs/kernfs/file.c:337 #3: ffff8000895e4920 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd8/0x2d4 drivers/net/netdevsim/bus.c:234 #4: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: device_del+0xa4/0x71c drivers/base/core.c:3923 3 locks held by kworker/u8:7/4868: 3 locks held by kworker/u8:8/4881: 1 lock held by kworker/R-wg-cr/4901: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 1 lock held by kworker/R-wg-cr/4903: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 1 lock held by kworker/R-wg-cr/4913: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 1 lock held by kworker/R-wg-cr/4916: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 1 lock held by kworker/R-wg-cr/4920: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 2 locks held by kworker/0:4/4934: 3 locks held by kworker/0:5/4979: 1 lock held by syz.3.25/4986: #0: ffff0000dba18ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x2c/0xbc net/bluetooth/hci_core.c:497 2 locks held by kworker/u8:9/4989: 4 locks held by kworker/u8:10/4990: 3 locks held by kworker/u8:11/4991: 3 locks held by kworker/u8:12/4992: 7 locks held by kworker/u8:13/4993: 2 locks held by kworker/u8:14/4994: 1 lock held by kworker/u8:15/4995: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 ============================================= final repro crashed as (corrupted=false): INFO: task kworker/u8:0:12 blocked for more than 145 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:0 state:D stack:0 pid:12 tgid:12 ppid:2 task_flags:0x4208160 flags:0x00000010 Workqueue: netns cleanup_net Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 register_nexthop_notifier+0x28/0x88 net/ipv4/nexthop.c:4026 nsim_fib_create+0x54c/0x888 drivers/net/netdevsim/fib.c:1585 nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline] nsim_dev_reload_up+0x310/0x5b4 drivers/net/netdevsim/dev.c:1058 devlink_reload+0x3b0/0x64c net/devlink/dev.c:475 devlink_pernet_pre_exit+0x1ac/0x30c net/devlink/core.c:560 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x158/0x81c net/core/net_namespace.c:234 cleanup_net+0x474/0x6c4 net/core/net_namespace.c:702 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 INFO: task kworker/u8:2:39 blocked for more than 146 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:2 state:D stack:0 pid:39 tgid:39 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: events_power_efficient crda_timeout_work Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 crda_timeout_work+0x20/0x90 net/wireless/reg.c:529 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 INFO: task kworker/u8:4:1103 blocked for more than 150 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:4 state:D stack:0 pid:1103 tgid:1103 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: events_unbound linkwatch_event Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 linkwatch_event+0x14/0x68 net/core/link_watch.c:313 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 worker_thread+0x798/0xbd0 kernel/workqueue.c:3486 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 INFO: task kworker/R-ipv6_:2819 blocked for more than 150 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/R-ipv6_ state:D stack:0 pid:2819 tgid:2819 ppid:2 task_flags:0x4208060 flags:0x00000010 Workqueue: ipv6_addrconf addrconf_dad_work Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 rtnl_net_lock include/linux/rtnetlink.h:130 [inline] addrconf_dad_work+0x100/0xfe8 net/ipv6/addrconf.c:4229 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0x788/0x10b8 kernel/workqueue.c:3405 rescuer_thread+0x68c/0xd90 kernel/workqueue.c:3629 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 INFO: task syz-executor:4850 blocked for more than 150 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:4850 tgid:4850 ppid:4839 task_flags:0x400140 flags:0x00800000 Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 del_device_store+0xd8/0x2d4 drivers/net/netdevsim/bus.c:234 bus_attr_store+0x80/0xa4 drivers/base/bus.c:172 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x84/0x98 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 INFO: task syz-executor:4854 blocked for more than 150 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:0 pid:4854 tgid:4854 ppid:4844 task_flags:0x400140 flags:0x00800010 Call trace: __switch_to+0x2b0/0x6e0 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5510 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7234 __schedule_loop kernel/sched/core.c:7311 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7326 schedule_preempt_disabled+0x18/0x2c kernel/sched/core.c:7383 __mutex_lock_common kernel/locking/mutex.c:726 [inline] __mutex_lock+0x4ec/0xf14 kernel/locking/mutex.c:821 mutex_lock_nested+0x24/0x30 kernel/locking/mutex.c:874 device_lock include/linux/device.h:1104 [inline] device_del+0xa4/0x71c drivers/base/core.c:3923 device_unregister+0x2c/0xf0 drivers/base/core.c:4002 nsim_bus_dev_del+0x60/0x8c drivers/net/netdevsim/bus.c:491 del_device_store+0x24c/0x2d4 drivers/net/netdevsim/bus.c:244 bus_attr_store+0x80/0xa4 drivers/base/bus.c:172 sysfs_kf_write+0xe0/0x108 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x260/0x3b8 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x51c/0xa0c fs/read_write.c:687 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x84/0x98 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Showing all locks held in the system: 2 locks held by kthreadd/2: 2 locks held by kworker/0:0/9: 3 locks held by kworker/0:1/10: 6 locks held by kworker/u8:0/12: #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c004e140 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff80008ec87c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff80008ec87c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089df6e08 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0x104/0x6c4 net/core/net_namespace.c:673 #3: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #3: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:124 [inline] #3: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x108/0x30c net/devlink/core.c:557 #4: ffff0000dc2e9258 (&devlink->lock_key){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:292 [inline] #4: ffff0000dc2e9258 (&devlink->lock_key){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:125 [inline] #4: ffff0000dc2e9258 (&devlink->lock_key){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x11c/0x30c net/devlink/core.c:557 #5: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 1 lock held by kworker/R-mm_pe/13: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 3 locks held by kworker/u8:1/15: 2 locks held by kworker/1:1/26: 1 lock held by khungtaskd/31: #0: ffff800088d171a0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline] #0: ffff800088d171a0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:840 [inline] #0: ffff800088d171a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x4c/0x188 kernel/locking/lockdep.c:6775 1 lock held by kworker/R-write/33: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 3 locks held by kworker/u8:2/39: #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff8000901c7c40 ((crda_timeout).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff8000901c7c40 ((crda_timeout).work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 3 locks held by kworker/u8:3/40: 1 lock held by pr/ttyAMA-1/41: 2 locks held by kworker/0:2/866: 2 locks held by kworker/1:2/1066: 3 locks held by kworker/u8:4/1103: #0: ffff0000c004c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c004c140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff800094b07c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff800094b07c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 3 locks held by kworker/0:3/1512: #0: ffff0000c002b540 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c002b540 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff800096427c40 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff800096427c40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 3 locks held by kworker/R-ipv6_/2819: #0: ffff0000ce1db140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000ce1db140 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff8000994c7c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff8000994c7c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 4 locks held by kworker/R-bat_e/2851: 3 locks held by kworker/u8:5/3622: 3 locks held by kworker/u8:6/3789: #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #0: ffff0000c004b940 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x734/0x10b8 kernel/workqueue.c:3405 #1: ffff800099957c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3297 [inline] #1: ffff800099957c40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x73c/0x10b8 kernel/workqueue.c:3405 #2: ffff800089e04180 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock+0x20/0x2c net/core/rtnetlink.c:80 1 lock held by kworker/R-ext4-/4310: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 1 lock held by klogd/4333: 1 lock held by udevd/4344: 1 lock held by dhcpcd/4400: 2 locks held by getty/4492: #0: ffff0000ce1fc0a0 (&tty->ldisc_sem){++++}-{0:0}, at: ldsem_down_read+0x3c/0x4c drivers/tty/tty_ldsem.c:340 #1: ffff8000924fb2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x348/0xf78 drivers/tty/n_tty.c:2211 1 lock held by syz-executor/4728: 3 locks held by kworker/1:3/4774: 1 lock held by kworker/R-wg-cr/4775: 1 lock held by kworker/R-wg-cr/4776: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 2 locks held by udevd/4803: 1 lock held by syz-executor/4838: 2 locks held by syz-executor/4849: 4 locks held by syz-executor/4850: #0: ffff0000d1536450 (sb_writers#6){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d1536450 (sb_writers#6){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000d1040480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 #2: ffff0000c9e23968 (kn->active#55){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff0000c9e23968 (kn->active#55){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1f0/0x3b8 fs/kernfs/file.c:337 #3: ffff8000895e4920 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd8/0x2d4 drivers/net/netdevsim/bus.c:234 5 locks held by syz-executor/4854: #0: ffff0000d1536450 (sb_writers#6){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2733 [inline] #0: ffff0000d1536450 (sb_writers#6){.+.+}-{0:0}, at: vfs_write+0x248/0xa0c fs/read_write.c:683 #1: ffff0000ec598480 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1b0/0x3b8 fs/kernfs/file.c:336 #2: ffff0000c9e23968 (kn->active#55){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline] #2: ffff0000c9e23968 (kn->active#55){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x1f0/0x3b8 fs/kernfs/file.c:337 #3: ffff8000895e4920 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd8/0x2d4 drivers/net/netdevsim/bus.c:234 #4: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline] #4: ffff0000c2f52128 (&dev->mutex){....}-{4:4}, at: device_del+0xa4/0x71c drivers/base/core.c:3923 3 locks held by kworker/u8:7/4868: 3 locks held by kworker/u8:8/4881: 1 lock held by kworker/R-wg-cr/4901: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 1 lock held by kworker/R-wg-cr/4903: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 1 lock held by kworker/R-wg-cr/4913: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 1 lock held by kworker/R-wg-cr/4916: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 1 lock held by kworker/R-wg-cr/4920: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2795 [inline] #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xa58/0xd90 kernel/workqueue.c:3657 2 locks held by kworker/0:4/4934: 3 locks held by kworker/0:5/4979: 1 lock held by syz.3.25/4986: #0: ffff0000dba18ea0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x2c/0xbc net/bluetooth/hci_core.c:497 2 locks held by kworker/u8:9/4989: 4 locks held by kworker/u8:10/4990: 3 locks held by kworker/u8:11/4991: 3 locks held by kworker/u8:12/4992: 7 locks held by kworker/u8:13/4993: 2 locks held by kworker/u8:14/4994: 1 lock held by kworker/u8:15/4995: #0: ffff800088bbd0c0 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x40/0x344 kernel/workqueue.c:2737 =============================================