bisecting fixing commit since 5b7a52cd2eef952cee8a72512ef370bcdef46636 building syzkaller on 94942294277bf7550b12322d282159551521258b testing commit 5b7a52cd2eef952cee8a72512ef370bcdef46636 with gcc (GCC) 8.1.0 kernel signature: 1f21316d2f22e828985fcd0c92174895e32e132baa4c51833dc6a9f9b8aee43e all runs: crashed: INFO: task hung in rtnl_lock testing current HEAD 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae testing commit 3f2ecb86cb909da0b9157fd2952ad79924cbe5ae with gcc (GCC) 8.1.0 kernel signature: 589e49049dcb92f0a50604987ff33c35a6dc2195c9f66de2681535f0f1758e65 all runs: crashed: INFO: task hung in rtnl_lock revisions tested: 2, total time: 30m53.154222422s (build: 16m28.619013877s, test: 13m36.192044939s) the crash still happens on HEAD commit msg: Linux 4.14.212 crash: INFO: task hung in rtnl_lock Bluetooth: hci2 command 0x0406 tx timeout Bluetooth: hci0 command 0x0406 tx timeout Bluetooth: hci4 command 0x0406 tx timeout Bluetooth: hci3 command 0x0406 tx timeout Bluetooth: hci5 command 0x0406 tx timeout INFO: task kworker/1:1:23 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/1:1 D26368 23 2 0x80000000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 addrconf_dad_work+0x8f/0xfa0 net/ipv6/addrconf.c:3917 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/0:1:24 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:1 D25360 24 2 0x80000000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 addrconf_dad_work+0x8f/0xfa0 net/ipv6/addrconf.c:3917 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/u4:2:34 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/u4:2 D26152 34 2 0x80000000 Workqueue: cfg80211 cfg80211_dfs_channels_update_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 cfg80211_dfs_channels_update_work+0x8d/0x52b net/wireless/mlme.c:777 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/0:2:4050 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:2 D26520 4050 2 0x80000000 Workqueue: events disconnect_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 disconnect_work+0x16/0x1b0 net/wireless/sme.c:664 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/0:3:7500 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:3 D27032 7500 2 0x80000000 Workqueue: events linkwatch_event Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 linkwatch_event+0x9/0x50 net/core/link_watch.c:236 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/0:4:7501 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:4 D29656 7501 2 0x80000000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 reg_check_chans_work+0x73/0xc60 net/wireless/reg.c:1655 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task syz-executor.4:7686 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D24808 7686 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:4328 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x657/0xc60 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1e4/0x2c0 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x4178c7 RSP: 002b:00007ffd414ed8a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00000000016a4300 RCX: 00000000004178c7 RDX: 0000000000000040 RSI: 00000000016a4350 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffd414ed8b0 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00000000016a4350 R15: 0000000000000003 INFO: task syz-executor.2:7688 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D24808 7688 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 genl_lock net/netlink/genetlink.c:33 [inline] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 genl_rcv+0x23/0x40 net/netlink/genetlink.c:636 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x657/0xc60 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1e4/0x2c0 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x4178c7 RSP: 002b:00007ffea77ef540 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00000000016a4300 RCX: 00000000004178c7 RDX: 0000000000000024 RSI: 00000000016a4350 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffea77ef550 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00000000016a4350 R15: 0000000000000003 INFO: task syz-executor.5:7691 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D24920 7691 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:4328 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x657/0xc60 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1e4/0x2c0 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x4178c7 RSP: 002b:00007ffe3225f3f0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00000000016a4300 RCX: 00000000004178c7 RDX: 0000000000000040 RSI: 00000000016a4350 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffe3225f400 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00000000016a4350 R15: 0000000000000003 INFO: task syz-executor.0:9168 blocked for more than 140 seconds. Not tainted 4.14.212-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.0 D27928 9168 7684 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 genl_lock net/netlink/genetlink.c:33 [inline] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 genl_rcv+0x23/0x40 net/netlink/genetlink.c:636 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x657/0xc60 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 ___sys_sendmsg+0x625/0x920 net/socket.c:2062 __sys_sendmsg+0xc1/0x140 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0xd/0x20 net/socket.c:2103 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45de49 RSP: 002b:00007fa42a11bc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000002c440 RCX: 000000000045de49 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 000000000118c008 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bfd4 R13: 00007fffb0b0da2f R14: 00007fa42a11c9c0 R15: 000000000118bfd4 Showing all locks held in the system: 3 locks held by kworker/1:1/23: #0: ("%s"("ipv6_addrconf")){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((&(&ifa->dad_work)->work)){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 3 locks held by kworker/0:1/24: #0: ("%s"("ipv6_addrconf")){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((&(&ifa->dad_work)->work)){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 3 locks held by kworker/u4:2/34: #0: ("cfg80211"){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((&(&rdev->dfs_update_channels_wk)->work)){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 1 lock held by khungtaskd/1515: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4548 3 locks held by kworker/0:2/4050: #0: ("events"){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: (cfg80211_disconnect_work){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 3 locks held by kworker/0:3/7500: #0: ("events"){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((linkwatch_work).work){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 3 locks held by kworker/0:4/7501: #0: ("events_power_efficient"){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((reg_check_chans).work){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 1 lock held by syz-executor.4/7686: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 2 locks held by syz-executor.2/7688: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 1 lock held by syz-executor.5/7691: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 2 locks held by syz-executor.0/9168: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.0/9191: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.0/9192: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.0/9193: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.0/9196: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.3/9167: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.3/9186: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.3/9195: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.3/9197: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.3/9198: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.3/9200: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.1/9181: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.1/9188: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.1/9190: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.1/9201: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 ============================================= NMI backtrace for cpu 0 CPU: 0 PID: 1515 Comm: khungtaskd Not tainted 4.14.212-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1f1 lib/dump_stack.c:58 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf6/0x11a lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x51b/0xa70 kernel/hung_task.c:274 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 5 Comm: kworker/u4:0 Not tainted 4.14.212-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker task: ffff8881f531c140 task.stack: ffff8881f5328000 RIP: 0010:__lock_acquire+0x78e/0x42d0 kernel/locking/lockdep.c:3472 RSP: 0018:ffff8881f532fac0 EFLAGS: 00000046 RAX: dffffc0000000000 RBX: 0000000000000012 RCX: 1ffff1103ea63947 RDX: 1ffff1103ea63937 RSI: ffff8881f531ca18 RDI: ffffffff8aabe000 RBP: ffff8881f532fc88 R08: ffff8881f531ca38 R09: 0000000000000000 R10: 0000000000000050 R11: ffff8881f531c140 R12: 0000000000000012 R13: 0000000000000000 R14: 0000000000000002 R15: ffff8881f531ca18 FS: 0000000000000000(0000) GS:ffff8881f6500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f42c9c72008 CR3: 0000000008e6a004 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 rcu_lock_acquire include/linux/rcupdate.h:242 [inline] rcu_read_lock include/linux/rcupdate.h:629 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:416 [inline] batadv_nc_worker+0xef/0x630 net/batman-adv/network-coding.c:726 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xed0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Code: 0e 0c 00 00 49 8d 83 78 08 00 00 48 89 c2 48 89 44 24 68 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 6b 2a 00 00 <45> 85 f6 4d 8b ab 78 08 00 00 75 14 c7 84 24 98 00 00 00 01 00