INFO: task hung in synchronize_rcu

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 10e570bf Merge 4.14.153 into android-4.14
git tree: android-4.14
console output: https://syzkaller.appspot.com/x/log.txt?x=1626794ae00000
kernel config: https://syzkaller.appspot.com/x/.config?x=4545e90c2f38a204
dashboard link: https://syzkaller.appspot.com/bug?extid=6b9b9c58b872e18fd87e
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+6b9b9c...@syzkaller.appspotmail.com

INFO: task kworker/u4:3:1851 blocked for more than 140 seconds.
Not tainted 4.14.153+ #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:3 D26832 1851 2 0x80000000
Workqueue: netns cleanup_net
Call Trace:
schedule+0x92/0x1c0 kernel/sched/core.c:3499
exp_funnel_lock kernel/rcu/tree_exp.h:295 [inline]
_synchronize_rcu_expedited+0x68c/0x840 kernel/rcu/tree_exp.h:596
synchronize_net+0x2b/0x40 net/core/dev.c:8222
nf_unregister_net_hooks+0x356/0x410 net/netfilter/core.c:439
ip6t_unregister_table+0x49/0x60 net/ipv6/netfilter/ip6_tables.c:1815
ip6table_mangle_net_exit+0x4d/0x90 net/ipv6/netfilter/ip6table_mangle.c:112
ops_exit_list.isra.0+0xa8/0x150 net/core/net_namespace.c:142
cleanup_net+0x3ce/0x870 net/core/net_namespace.c:484
process_one_work+0x7f1/0x1580 kernel/workqueue.c:2134
worker_thread+0xdd/0xdf0 kernel/workqueue.c:2271
kthread+0x31f/0x430 kernel/kthread.c:232
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:404

Showing all locks held in the system:
1 lock held by khungtaskd/23:
#0: (tasklist_lock){.+.+}, at: [<00000000a35b01af>]
debug_show_all_locks+0x7c/0x21a kernel/locking/lockdep.c:4544
1 lock held by rsyslogd/1626:
#0: (&f->f_pos_lock){+.+.}, at: [<00000000cebdb78d>]
__fdget_pos+0xb5/0xd0 fs/file.c:769
2 locks held by getty/1754:
#0: (&tty->ldisc_sem){++++}, at: [<000000008cb9591c>]
tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284
#1: (&ldata->atomic_read_lock){+.+.}, at: [<00000000c4fcaa34>]
n_tty_read+0x1f7/0x1700 drivers/tty/n_tty.c:2156
3 locks held by kworker/u4:3/1851:
#0: ("%s""netns"){+.+.}, at: [<0000000098b61dc2>]
process_one_work+0x6ff/0x1580 kernel/workqueue.c:2105
#1: (net_cleanup_work){+.+.}, at: [<00000000ce045505>]
process_one_work+0x735/0x1580 kernel/workqueue.c:2109
#2: (net_mutex){+.+.}, at: [<000000003b4ae4d1>] cleanup_net+0x136/0x870
net/core/net_namespace.c:450
1 lock held by syz-executor.1/8739:
#0: (&pipe->mutex/1){+.+.}, at: [<00000000ede8f577>] pipe_lock_nested
fs/pipe.c:67 [inline]
#0: (&pipe->mutex/1){+.+.}, at: [<00000000ede8f577>] pipe_lock+0x58/0x70
fs/pipe.c:75
1 lock held by syz-executor.0/11190:
#0: (&pipe->mutex/1){+.+.}, at: [<00000000ede8f577>] pipe_lock_nested
fs/pipe.c:67 [inline]
#0: (&pipe->mutex/1){+.+.}, at: [<00000000ede8f577>] pipe_lock+0x58/0x70
fs/pipe.c:75
1 lock held by syz-executor.3/14816:
#0: (net_mutex){+.+.}, at: [<0000000089279cfe>] copy_net_ns+0x150/0x480
net/core/net_namespace.c:410
1 lock held by syz-executor.5/14822:
#0: (net_mutex){+.+.}, at: [<0000000089279cfe>] copy_net_ns+0x150/0x480
net/core/net_namespace.c:410

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 23 Comm: khungtaskd Not tainted 4.14.153+ #0
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xca/0x134 lib/dump_stack.c:53
nmi_cpu_backtrace.cold+0x47/0x86 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x119/0x147 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:140 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:195 [inline]
watchdog+0x629/0xbe0 kernel/hung_task.c:274
kthread+0x31f/0x430 kernel/kthread.c:232
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:404
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffffa1aa5373


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.