INFO: task syz.4.41:6538 blocked for more than 143 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.4.41 state:D stack:26840 pid:6538 tgid:6538 ppid:6325 task_flags:0x40004c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5357 [inline] __schedule+0x1794/0x4c40 kernel/sched/core.c:6961 __schedule_loop kernel/sched/core.c:7043 [inline] schedule+0x161/0x360 kernel/sched/core.c:7058 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:7115 rwsem_down_write_slowpath+0x922/0x10d0 kernel/locking/rwsem.c:1185 __down_write_common kernel/locking/rwsem.c:1317 [inline] __down_write kernel/locking/rwsem.c:1326 [inline] down_write+0x1a7/0x1f0 kernel/locking/rwsem.c:1591 mmap_write_lock include/linux/mmap_lock.h:397 [inline] exit_mmap+0x28a/0xb10 mm/mmap.c:1288 __mmput+0x118/0x430 kernel/fork.c:1129 exit_mm+0x1d6/0x2b0 kernel/exit.c:582 do_exit+0x644/0x22f0 kernel/exit.c:949 do_group_exit+0x218/0x2d0 kernel/exit.c:1102 __do_sys_exit_group kernel/exit.c:1113 [inline] __se_sys_exit_group kernel/exit.c:1111 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1111 x64_sys_call+0x21f3/0x2200 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x86/0x2e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f9888b8eec9 RSP: 002b:00007fff31148ae8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9888b8eec9 RDX: 0000000000000064 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00007fff31148b4c R08: 0000000531148bdf R09: 00000000000927c0 R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000002 R13: 00000000000927c0 R14: 0000000000021ed0 R15: 00007fff31148ba0 INFO: task syz.4.41:6538 is blocked on an rw-semaphore, but the owner is not found. INFO: task dhcpcd-run-hook:6540 blocked for more than 143 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:dhcpcd-run-hook state:D stack:25632 pid:6540 tgid:6540 ppid:6522 task_flags:0x40004c flags:0x00004002 Call Trace: context_switch kernel/sched/core.c:5357 [inline] __schedule+0x1794/0x4c40 kernel/sched/core.c:6961 __schedule_loop kernel/sched/core.c:7043 [inline] schedule+0x161/0x360 kernel/sched/core.c:7058 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:7115 rwsem_down_write_slowpath+0x922/0x10d0 kernel/locking/rwsem.c:1185 __down_write_common kernel/locking/rwsem.c:1317 [inline] __down_write kernel/locking/rwsem.c:1326 [inline] down_write+0x1a7/0x1f0 kernel/locking/rwsem.c:1591 mmap_write_lock include/linux/mmap_lock.h:397 [inline] exit_mmap+0x28a/0xb10 mm/mmap.c:1288 __mmput+0x118/0x430 kernel/fork.c:1129 exit_mm+0x1d6/0x2b0 kernel/exit.c:582 do_exit+0x644/0x22f0 kernel/exit.c:949 do_group_exit+0x218/0x2d0 kernel/exit.c:1102 __do_sys_exit_group kernel/exit.c:1113 [inline] __se_sys_exit_group kernel/exit.c:1111 [inline] __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1111 x64_sys_call+0x21f3/0x2200 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x86/0x2e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fe39da2b6c5 RSP: 002b:00007ffd04a53728 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007ffd04a53a04 RCX: 00007fe39da2b6c5 RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000000 RBP: 0000000000000003 R08: 00007ffd04a53820 R09: 0000000000000002 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007ffd04a53a60 R14: 00007fe39dc3b000 R15: 00005651d17e7d98 INFO: task dhcpcd-run-hook:6540 is blocked on an rw-semaphore, but the owner is not found. INFO: task syz.2.42:6543 blocked for more than 144 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.2.42 state:D stack:25736 pid:6543 tgid:6541 ppid:6317 task_flags:0x40054c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5357 [inline] __schedule+0x1794/0x4c40 kernel/sched/core.c:6961 __schedule_loop kernel/sched/core.c:7043 [inline] schedule+0x161/0x360 kernel/sched/core.c:7058 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:7115 rwsem_down_write_slowpath+0x922/0x10d0 kernel/locking/rwsem.c:1185 __down_write_common kernel/locking/rwsem.c:1317 [inline] __down_write kernel/locking/rwsem.c:1326 [inline] down_write+0x1a7/0x1f0 kernel/locking/rwsem.c:1591 mmap_write_lock include/linux/mmap_lock.h:397 [inline] exit_mmap+0x28a/0xb10 mm/mmap.c:1288 __mmput+0x118/0x430 kernel/fork.c:1129 exit_mm+0x1d6/0x2b0 kernel/exit.c:582 do_exit+0x644/0x22f0 kernel/exit.c:949 do_group_exit+0x218/0x2d0 kernel/exit.c:1102 get_signal+0x125a/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x96/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x71/0x110 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x213/0x2e0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0a21d8eec9 RSP: 002b:00007f0a22cd60e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f0a21fe5fa8 RCX: 00007f0a21d8eec9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f0a21fe5fa8 RBP: 00007f0a21fe5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0a21fe6038 R14: 00007ffe8c2134d0 R15: 00007ffe8c2135b8 INFO: task syz.2.42:6543 is blocked on an rw-semaphore, but the owner is not found. INFO: task syz.0.43:6545 blocked for more than 144 seconds. Not tainted syzkaller #0 Blocked by coredump. "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.43 state:D stack:25736 pid:6545 tgid:6544 ppid:6314 task_flags:0x40054c flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5357 [inline] __schedule+0x1794/0x4c40 kernel/sched/core.c:6961 __schedule_loop kernel/sched/core.c:7043 [inline] schedule+0x161/0x360 kernel/sched/core.c:7058 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:7115 rwsem_down_write_slowpath+0x922/0x10d0 kernel/locking/rwsem.c:1185 __down_write_common kernel/locking/rwsem.c:1317 [inline] __down_write kernel/locking/rwsem.c:1326 [inline] down_write+0x1a7/0x1f0 kernel/locking/rwsem.c:1591 mmap_write_lock include/linux/mmap_lock.h:397 [inline] exit_mmap+0x28a/0xb10 mm/mmap.c:1288 __mmput+0x118/0x430 kernel/fork.c:1129 exit_mm+0x1d6/0x2b0 kernel/exit.c:582 do_exit+0x644/0x22f0 kernel/exit.c:949 do_group_exit+0x218/0x2d0 kernel/exit.c:1102 get_signal+0x125a/0x1310 kernel/signal.c:3034 arch_do_signal_or_restart+0x96/0x750 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x71/0x110 kernel/entry/common.c:40 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x213/0x2e0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f02be38eec9 RSP: 002b:00007f02bf1c10e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007f02be5e5fa8 RCX: 00007f02be38eec9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f02be5e5fa8 RBP: 00007f02be5e5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f02be5e6038 R14: 00007ffc67469ff0 R15: 00007ffc6746a0d8 INFO: task syz.0.43:6545 is blocked on an rw-semaphore, but the owner is not found. Showing all locks held in the system: 2 locks held by kworker/u8:0/12: #0: ffff888019c89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff888019c89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b0/0x1780 kernel/workqueue.c:3319 #1: ffffc90000117ba0 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc90000117ba0 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9eb/0x1780 kernel/workqueue.c:3319 3 locks held by kworker/1:0/24: #0: ffff888019c80d48 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff888019c80d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b0/0x1780 kernel/workqueue.c:3319 #1: ffff8880b8924008 (psi_seq){-.-.}-{0:0}, at: psi_sched_switch kernel/sched/stats.h:220 [inline] #1: ffff8880b8924008 (psi_seq){-.-.}-{0:0}, at: __schedule+0x22ae/0x4c40 kernel/sched/core.c:6955 #2: ffff8880b8925918 (&base->lock){-.-.}-{2:2}, at: lock_timer_base kernel/time/timer.c:1004 [inline] #2: ffff8880b8925918 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x1ae/0xf30 kernel/time/timer.c:1085 1 lock held by khungtaskd/31: #0: ffffffff8db39620 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8db39620 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #0: ffffffff8db39620 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2a/0x180 kernel/locking/lockdep.c:6775 2 locks held by kworker/u8:6/2945: #0: ffff888019c89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff888019c89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b0/0x1780 kernel/workqueue.c:3319 #1: ffffc9000b007ba0 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc9000b007ba0 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9eb/0x1780 kernel/workqueue.c:3319 2 locks held by kworker/u8:7/2973: #0: ffff888019c89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff888019c89148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b0/0x1780 kernel/workqueue.c:3319 #1: ffffc9000b197ba0 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc9000b197ba0 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9eb/0x1780 kernel/workqueue.c:3319 2 locks held by udevd/5167: #0: ffffffff8dbf0890 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1484 [inline] #0: ffffffff8dbf0890 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x131/0x4b0 kernel/fork.c:1537 #1: ffff88807d5b0ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:415 [inline] #1: ffff88807d5b0ca0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x12a/0x1a90 mm/mmap.c:1727 2 locks held by getty/5553: #0: ffff88814db3e0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:243 #1: ffffc900036ae2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43a/0x1400 drivers/tty/n_tty.c:2222 1 lock held by udevd/6241: #0: ffff88807d5b4260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:415 [inline] #0: ffff88807d5b4260 (&mm->mmap_lock){++++}-{4:4}, at: __vm_munmap+0x158/0x3c0 mm/vma.c:3152 1 lock held by syz-executor/6314: #0: ffff888072e562a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072e562a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6317: #0: ffff888072e50ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072e50ca0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6322: #0: ffff8880270137a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff8880270137a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6325: #0: ffff888027014260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888027014260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6326: #0: ffff888072e537a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072e537a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.4.41/6538: #0: ffff8880300fe2a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff8880300fe2a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by dhcpcd-run-hook/6540: #0: ffff888072e51760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072e51760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.2.42/6543: #0: ffff888072e52220 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072e52220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.0.43/6545: #0: ffff88807cfb9760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807cfb9760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6550: #0: ffff88807cfbc260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807cfbc260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6552: #0: ffff88807cfbcd20 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807cfbcd20 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6554: #0: ffff88807cfba220 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807cfba220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6558: #0: ffff88807cfbed60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807cfbed60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6560: #0: ffff8880278c0ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff8880278c0ca0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.7.46/6689: #0: ffff88802352ed60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88802352ed60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.5.44/6706: #0: ffff888072ddace0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072ddace0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.8.63/6710: #0: ffff888072dded60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072dded60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.9.64/6712: #0: ffff888072ddcd20 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072ddcd20 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6727: #0: ffff888072ddc260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072ddc260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6729: #0: ffff888029300ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888029300ca0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6731: #0: ffff888029301760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888029301760 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.1.124/6927: #0: ffff888072dd8ca0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072dd8ca0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.0.125/6929: #0: ffff888072dde2a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072dde2a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.2.141/6969: #0: ffff88807dcee2a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807dcee2a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.4.146/6978: #0: ffff88807d116d60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807d116d60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6982: #0: ffff88803251ed60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88803251ed60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/6984: #0: ffff88803251d7e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88803251d7e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/7005: #0: ffff88803251c260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88803251c260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.7.148/7093: #0: ffff8880300fc260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff8880300fc260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by modprobe/7094: #0: ffff8880300fd7e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff8880300fd7e0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by modprobe/7098: #0: ffff8880300face0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:415 [inline] #0: ffff8880300face0 (&mm->mmap_lock){++++}-{4:4}, at: vm_mmap_pgoff+0x20d/0x4c0 mm/util.c:578 1 lock held by modprobe/7099: #0: ffff8880300f9760 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:415 [inline] #0: ffff8880300f9760 (&mm->mmap_lock){++++}-{4:4}, at: setup_arg_pages+0x2af/0xa80 fs/exec.c:650 1 lock held by syz-executor/7103: #0: ffff88807d114260 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807d114260 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz-executor/7105: #0: ffff88807d112220 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807d112220 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.0.169/7163: #0: ffff888072e52ce0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888072e52ce0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.3.177/7218: #0: ffff8880300fed60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff8880300fed60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 1 lock held by syz.2.178/7220: #0: ffff88807d5b6d60 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff88807d5b6d60 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 2 locks held by syz-executor/7227: #0: ffffffff8dbf0890 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1484 [inline] #0: ffffffff8dbf0890 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x131/0x4b0 kernel/fork.c:1537 #1: ffff8880300f81e0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock_killable include/linux/mmap_lock.h:415 [inline] #1: ffff8880300f81e0 (&mm->mmap_lock){++++}-{4:4}, at: dup_mmap+0x12a/0x1a90 mm/mmap.c:1727 3 locks held by syz-executor/7229: #0: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8d7/0x1c60 net/core/rtnetlink.c:4056 #1: ffff8880632e94e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x223/0x420 drivers/net/wireguard/device.c:50 #2: ffffffff8db3f0b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline] #2: ffffffff8db3f0b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f2/0x730 kernel/rcu/tree_exp.h:957 1 lock held by syz-executor/7251: #0: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #0: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x3ac/0x18a0 net/ipv4/devinet.c:978 1 lock held by syz-executor/7252: #0: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline] #0: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline] #0: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8d7/0x1c60 net/core/rtnetlink.c:4056 3 locks held by kworker/u8:11/7315: #0: ffff88802e884148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3211 [inline] #0: ffff88802e884148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b0/0x1780 kernel/workqueue.c:3319 #1: ffffc9000c847ba0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3212 [inline] #1: ffffc9000c847ba0 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9eb/0x1780 kernel/workqueue.c:3319 #2: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline] #2: ffffffff8ee6cc48 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x10e/0x14b0 net/ipv6/addrconf.c:4194 1 lock held by syz.6.150/7356: #0: ffff888020ebb7a0 (&mm->mmap_lock){++++}-{4:4}, at: mmap_write_lock include/linux/mmap_lock.h:397 [inline] #0: ffff888020ebb7a0 (&mm->mmap_lock){++++}-{4:4}, at: exit_mmap+0x28a/0xb10 mm/mmap.c:1288 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: dump_stack_lvl+0x185/0x250 lib/dump_stack.c:120 nmi_cpu_backtrace+0x39a/0x3d0 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x176/0x2e0 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:328 [inline] watchdog+0x15a7/0x15f0 kernel/hung_task.c:491 kthread+0x70a/0x890 kernel/kthread.c:463 ret_from_fork+0x431/0x7a0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 5149 Comm: syslogd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:do_raw_spin_lock+0x6/0x2c0 kernel/locking/spinlock_debug.c:114 Code: c1 7c 90 48 89 df e8 69 6b 84 00 eb 86 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57 <41> 56 41 55 41 54 53 48 83 e4 e0 48 81 ec 80 00 00 00 48 89 fb 65 RSP: 0018:ffffc90000a08af8 EFLAGS: 00000096 RAX: cb4a3c93287bd100 RBX: 0000000000000001 RCX: cb4a3c93287bd100 RDX: 000000007d47d300 RSI: ffffffff8d4c8dc5 RDI: ffff888019ca0000 RBP: ffffc90000a08b00 R08: ffff888019ca0018 R09: ffffffff8188a319 R10: dffffc0000000000 R11: ffffed100adab2fd R12: dffffc0000000000 R13: ffff88802f570400 R14: ffff888019ca0000 R15: ffff888019ca0000 FS: 00007fd969687c80(0000) GS:ffff88812679e000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcbc10f7e9c CR3: 0000000032652000 CR4: 00000000003526f0 Call Trace: __queue_work+0x809/0xf90 kernel/workqueue.c:-1 call_timer_fn+0x17a/0x5d0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1793 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x642/0x860 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb3/0x170 kernel/time/timer.c:2403 handle_softirqs+0x27f/0x850 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xc6/0x1e0 kernel/softirq.c:680 irq_exit_rcu+0x5/0x20 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1050 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:rcu_is_watching_curr_cpu include/linux/context_tracking.h:128 [inline] RIP: 0010:rcu_is_watching+0x2a/0xb0 kernel/rcu/tree.c:751 Code: 41 57 41 56 53 65 ff 05 d4 4b 73 10 e8 ef 3e 68 09 89 c3 83 f8 08 73 65 49 bf 00 00 00 00 00 fc ff df 4c 8d 34 dd d0 0c 50 8d <4c> 89 f0 48 c1 e8 03 42 80 3c 38 00 74 08 4c 89 f7 e8 90 20 7c 00 RSP: 0018:ffffc90002fc74b8 EFLAGS: 00000297 RAX: 0000000000000001 RBX: 0000000000000001 RCX: cb4a3c93287bd100 RDX: ffffffff8fcef301 RSI: ffffffff8b7e7460 RDI: ffffffff8b7e7420 RBP: dffffc0000000000 R08: ffffc90002fc7607 R09: 0000000000000000 R10: ffffc90002fc75f8 R11: fffff520005f8ec1 R12: ffffc90002fc7938 R13: ffffc90002fc0000 R14: ffffffff8d500cd8 R15: dffffc0000000000 rcu_read_unlock include/linux/rcupdate.h:869 [inline] class_rcu_destructor include/linux/rcupdate.h:1155 [inline] unwind_next_frame+0x1961/0x2390 arch/x86/kernel/unwind_orc.c:680 arch_stack_walk+0x118/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x98/0xe0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3a/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x42/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x57/0x70 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2422 [inline] slab_free mm/slub.c:4695 [inline] kmem_cache_free+0x187/0x3e0 mm/slub.c:4797 __unix_dgram_recvmsg+0x9f5/0xd50 net/unix/af_unix.c:2683 sock_recvmsg_nosec net/socket.c:1065 [inline] sock_recvmsg+0x225/0x270 net/socket.c:1087 sock_read_iter+0x22d/0x2e0 net/socket.c:1157 new_sync_read fs/read_write.c:491 [inline] vfs_read+0x547/0xa30 fs/read_write.c:572 ksys_read+0x141/0x250 fs/read_write.c:715 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x86/0x2e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd9697d7407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007fff206d4fd0 EFLAGS: 00000202 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007fd969687c80 RCX: 00007fd9697d7407 RDX: 00000000000000ff RSI: 000055e73bd1d950 RDI: 0000000000000000 RBP: 000055e73bd1d910 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 000055e73bd1d99d R13: 0000000000000000 R14: 000055e73bd1d950 R15: 000055e7307e6d98