bisecting fixing commit since 5b7a52cd2eef952cee8a72512ef370bcdef46636 building syzkaller on 94942294277bf7550b12322d282159551521258b testing commit 5b7a52cd2eef952cee8a72512ef370bcdef46636 with gcc (GCC) 8.4.1 20210217 kernel signature: 200e65048009c083c9eb774d81072dac16b72b3ae6731f00af505554fb458eba all runs: crashed: INFO: task hung in rtnl_lock testing current HEAD 670d6552eda8ff0c5f396d3d6f0174237917c66c testing commit 670d6552eda8ff0c5f396d3d6f0174237917c66c with gcc (GCC) 8.4.1 20210217 kernel signature: d8dea56b8a960d57804788869e194e1c90460f2e58de4e215b94b70d1d620bf2 all runs: crashed: INFO: task hung in rtnl_lock revisions tested: 2, total time: 28m10.789945225s (build: 14m9.654439079s, test: 13m38.947288018s) the crash still happens on HEAD commit msg: Linux 4.14.227 crash: INFO: task hung in rtnl_lock Bluetooth: hci5 command 0x0406 tx timeout Bluetooth: hci4 command 0x0406 tx timeout Bluetooth: hci2 command 0x0406 tx timeout Bluetooth: hci1 command 0x0406 tx timeout Bluetooth: hci3 command 0x0406 tx timeout INFO: task kworker/0:0:3 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:0 D26368 3 2 0x80000000 Workqueue: events disconnect_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 disconnect_work+0x16/0x1b0 net/wireless/sme.c:664 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xee0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/1:2:3545 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/1:2 D26872 3545 2 0x80000000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 addrconf_dad_work+0x8f/0xfa0 net/ipv6/addrconf.c:3918 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xee0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/0:2:4056 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:2 D24832 4056 2 0x80000000 Workqueue: events linkwatch_event Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 linkwatch_event+0x9/0x50 net/core/link_watch.c:236 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xee0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/1:3:7502 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/1:3 D25960 7502 2 0x80000000 Workqueue: events_power_efficient reg_check_chans_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 reg_check_chans_work+0x73/0xc60 net/wireless/reg.c:1655 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xee0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task kworker/0:3:7504 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. kworker/0:3 D25552 7504 2 0x80000000 Workqueue: ipv6_addrconf addrconf_dad_work Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 addrconf_dad_work+0x8f/0xfa0 net/ipv6/addrconf.c:3918 process_one_work+0x74f/0x1620 kernel/workqueue.c:2116 worker_thread+0xcc/0xee0 kernel/workqueue.c:2250 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 INFO: task syz-executor.5:7667 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.5 D24888 7667 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:4328 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x639/0xbe0 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1e4/0x2c0 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x418cdc RSP: 002b:00007ffc32ab9b40 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000001494320 RCX: 0000000000418cdc RDX: 0000000000000020 RSI: 0000000001494370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffc32ab9b84 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000001494370 INFO: task syz-executor.3:7669 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.3 D24520 7669 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:4328 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x639/0xbe0 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1e4/0x2c0 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x418cdc RSP: 002b:00007ffe20a62840 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000001494320 RCX: 0000000000418cdc RDX: 0000000000000028 RSI: 0000000001494370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffe20a62884 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000001494370 INFO: task syz-executor.4:7673 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.4 D24184 7673 1 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 rtnl_lock net/core/rtnetlink.c:72 [inline] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:4328 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x639/0xbe0 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1e4/0x2c0 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x418cdc RSP: 002b:00007ffeda374e50 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000001494320 RCX: 0000000000418cdc RDX: 0000000000000040 RSI: 0000000001494370 RDI: 0000000000000003 RBP: 0000000000000000 R08: 00007ffeda374e94 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000001494370 INFO: task syz-executor.2:9163 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D28664 9163 7665 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 genl_lock net/netlink/genetlink.c:33 [inline] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 genl_rcv+0x23/0x40 net/netlink/genetlink.c:636 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x639/0xbe0 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 ___sys_sendmsg+0x625/0x920 net/socket.c:2062 __sys_sendmsg+0xc1/0x140 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0xd/0x20 net/socket.c:2103 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x465849 RSP: 002b:00007f3453a2c188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 000000000055bfa8 RCX: 0000000000465849 RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 RBP: 00000000004af675 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bfa8 R13: 00007ffce144badf R14: 00007f3453a2c300 R15: 0000000000022000 INFO: task syz-executor.2:9173 blocked for more than 140 seconds. Not tainted 4.14.227-syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. syz-executor.2 D29080 9173 7665 0x00000004 Call Trace: context_switch kernel/sched/core.c:2808 [inline] __schedule+0x824/0x1ee0 kernel/sched/core.c:3384 schedule+0x7f/0x1b0 kernel/sched/core.c:3428 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:3486 __mutex_lock_common kernel/locking/mutex.c:833 [inline] __mutex_lock+0x519/0x1490 kernel/locking/mutex.c:893 mutex_lock_nested+0x16/0x20 kernel/locking/mutex.c:908 genl_lock net/netlink/genetlink.c:33 [inline] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 netlink_rcv_skb+0x12f/0x3b0 net/netlink/af_netlink.c:2433 genl_rcv+0x23/0x40 net/netlink/genetlink.c:636 netlink_unicast_kernel net/netlink/af_netlink.c:1287 [inline] netlink_unicast+0x40b/0x610 net/netlink/af_netlink.c:1313 netlink_sendmsg+0x639/0xbe0 net/netlink/af_netlink.c:1878 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:656 SYSC_sendto net/socket.c:1763 [inline] SyS_sendto+0x1e4/0x2c0 net/socket.c:1731 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x418cdc RSP: 002b:00007f3453a0a030 EFLAGS: 00000293 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f3453a0a110 RCX: 0000000000418cdc RDX: 0000000000000020 RSI: 00007f3453a0a160 RDI: 0000000000000004 RBP: 0000000000000000 R08: 00007f3453a0a074 R09: 000000000000000c R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000010 R13: 0000000000000004 R14: 0000000000000000 R15: 00007f3453a0a160 Showing all locks held in the system: 3 locks held by kworker/0:0/3: #0: ("events"){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: (cfg80211_disconnect_work){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 1 lock held by khungtaskd/1524: #0: (tasklist_lock){.+.+}, at: [] debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4548 3 locks held by kworker/1:2/3545: #0: ("%s"("ipv6_addrconf")){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((&(&ifa->dad_work)->work)){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 3 locks held by kworker/0:2/4056: #0: ("events"){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((linkwatch_work).work){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 3 locks held by kworker/1:3/7502: #0: ("events_power_efficient"){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((reg_check_chans).work){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 3 locks held by kworker/0:3/7504: #0: ("%s"("ipv6_addrconf")){+.+.}, at: [] process_one_work+0x681/0x1620 kernel/workqueue.c:2087 #1: ((&(&ifa->dad_work)->work)){+.+.}, at: [] process_one_work+0x6b4/0x1620 kernel/workqueue.c:2091 #2: (rtnl_mutex){+.+.}, at: [] rtnl_lock+0x12/0x20 net/core/rtnetlink.c:72 1 lock held by syz-executor.5/7667: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 1 lock held by syz-executor.3/7669: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 1 lock held by syz-executor.4/7673: #0: (rtnl_mutex){+.+.}, at: [] rtnl_lock net/core/rtnetlink.c:72 [inline] #0: (rtnl_mutex){+.+.}, at: [] rtnetlink_rcv_msg+0x2c0/0x9e0 net/core/rtnetlink.c:4311 2 locks held by syz-executor.2/9163: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.2/9173: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.2/9174: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.2/9175: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.2/9177: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.1/9160: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.1/9169: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.1/9171: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.1/9178: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.0/9166: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.0/9170: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.0/9172: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 2 locks held by syz-executor.0/9181: #0: (cb_lock){++++}, at: [] genl_rcv+0x14/0x40 net/netlink/genetlink.c:635 #1: (genl_mutex){+.+.}, at: [] genl_lock net/netlink/genetlink.c:33 [inline] #1: (genl_mutex){+.+.}, at: [] genl_rcv_msg+0x10e/0x140 net/netlink/genetlink.c:623 ============================================= NMI backtrace for cpu 1 CPU: 1 PID: 1524 Comm: khungtaskd Not tainted 4.14.227-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x14b/0x1e7 lib/dump_stack.c:58 nmi_cpu_backtrace.cold.0+0x3c/0x78 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0xf6/0x120 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline] watchdog+0x51b/0xa70 kernel/hung_task.c:274 kthread+0x338/0x400 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 4309 Comm: systemd-journal Not tainted 4.14.227-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8881df350680 task.stack: ffff8881df358000 RIP: 0010:mark_lock+0x21/0x11a0 kernel/locking/lockdep.c:3161 RSP: 0018:ffff8881df35fb00 EFLAGS: 00000002 RAX: dffffc0000000000 RBX: 0000000000000060 RCX: 0000000000000006 RDX: ffff8881df350f50 RSI: ffff8881df350f30 RDI: ffff8881df350680 RBP: ffff8881df35fb10 R08: ffff8881df350f50 R09: 0000000000000000 R10: 0000000000000028 R11: ffff8881df350680 R12: ffff8881df350ef4 R13: ffff8881df350f52 R14: 0000000000000006 R15: ffff8881df350680 FS: 00007f31ba3168c0(0000) GS:ffff8881f6400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f31b77c6000 CR3: 00000001df3b7004 CR4: 00000000001606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: mark_irqflags kernel/locking/lockdep.c:3090 [inline] __lock_acquire+0x6d9/0x42d0 kernel/locking/lockdep.c:3448 lock_acquire+0x17e/0x3e0 kernel/locking/lockdep.c:3998 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2d/0x40 kernel/locking/spinlock.c:152 spin_lock include/linux/spinlock.h:317 [inline] lockref_put_or_lock+0xd/0x60 lib/lockref.c:143 fast_dput fs/dcache.c:697 [inline] dput.part.6+0x2f1/0x610 fs/dcache.c:818 dput+0xe/0x20 fs/dcache.c:810 path_put+0x2c/0x60 fs/namei.c:501 SYSC_faccessat fs/open.c:437 [inline] SyS_faccessat+0x397/0x630 fs/open.c:353 SYSC_access fs/open.c:450 [inline] SyS_access+0x13/0x20 fs/open.c:448 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f31b95d19c7 RSP: 002b:00007ffefc61d068 EFLAGS: 00000246 ORIG_RAX: 0000000000000015 RAX: ffffffffffffffda RBX: 00007ffefc620090 RCX: 00007f31b95d19c7 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000557f7c2de9a3 RBP: 00007ffefc61d1b0 R08: 0000557f7c2d43e5 R09: 0000000000000018 R10: 0000000000000069 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 0000557f7db938a0 R15: 00007ffefc61d6a0 Code: eb d5 e8 b3 7d 3c 00 eb 84 90 55 4c 8d 46 20 89 d1 48 b8 00 00 00 00 00 fc ff df 48 89 e5 41 57 49 89 ff 41 56 41 89 d6 4c 89 c2 <41> 55 48 c1 ea 03 41 bd 01 00 00 00 41 54 41 d3 e5 53 48 89 f3