INFO: task hung in nf_unregister_net_hook (2)

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 8fe42840 Merge 4.9.141 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=10be55aa600000
kernel config: https://syzkaller.appspot.com/x/.config?x=22a5ba9f73b6da1d
dashboard link: https://syzkaller.appspot.com/bug?extid=32d2fc4782f5346d68b2
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11b12072600000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+32d2fc...@syzkaller.appspotmail.com

Free swap = 0kB
Total swap = 0kB
1965979 pages RAM
0 pages HighMem/MovableOnly
313617 pages reserved
INFO: task kworker/u4:1:64 blocked for more than 140 seconds.
Not tainted 4.9.141+ #23
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
kworker/u4:1 D22728 64 2 0x80000000
Workqueue: netns cleanup_net
ffff8801d786af80 0000000000000000 ffff8801ca15a680 ffff8801da6b2f80
ffff8801db721018 ffff8801d79af7b8 ffffffff828075c2 0000000000000286
0000000000000002 0000000041b58ab3 00ffffff82e2b9d2 ffff8801db7218f0
Call Trace:
[<ffffffff82808aef>] schedule+0x7f/0x1b0 kernel/sched/core.c:3553
[<ffffffff8124a9a2>] _synchronize_rcu_expedited+0x592/0x840
kernel/rcu/tree_exp.h:588
[<ffffffff8124fd62>] synchronize_rcu_expedited+0x22/0x30
kernel/rcu/tree_exp.h:687
[<ffffffff82301f9f>] synchronize_net+0x2f/0x50 net/core/dev.c:7862
[<ffffffff823dcd8c>] nf_unregister_net_hook+0x1ec/0x380
net/netfilter/core.c:161
[<ffffffff823dd6c0>] nf_unregister_hook_list net/netfilter/core.c:482
[inline]
[<ffffffff823dd6c0>] netfilter_net_exit+0x40/0xb0 net/netfilter/core.c:514
[<ffffffff822e3d70>] ops_exit_list.isra.0+0xb0/0x160
net/core/net_namespace.c:136
[<ffffffff822e6ad2>] cleanup_net+0x3f2/0x8b0 net/core/net_namespace.c:473
[<ffffffff81131001>] process_one_work+0x831/0x15f0 kernel/workqueue.c:2092
[<ffffffff81131e96>] worker_thread+0xd6/0x1140 kernel/workqueue.c:2226
[<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
[<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373

Showing all locks held in the system:
2 locks held by init/1:
#0: (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>]
__do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
#1: (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>]
ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
3 locks held by kworker/1:1/22:
#0: ("events"){.+.+.+}, at: [<ffffffff81130f0c>]
process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
#1: ((&ht->run_work)){+.+.+.}, at: [<ffffffff81130f44>]
process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
#2: (&ht->mutex){+.+.+.}, at: [<ffffffff81b98f89>]
rht_deferred_worker+0x39/0x1a50 lib/rhashtable.c:365
2 locks held by khungtaskd/24:
#0: (rcu_read_lock){......}, at: [<ffffffff8131c0cc>]
check_hung_uninterruptible_tasks kernel/hung_task.c:168 [inline]
#0: (rcu_read_lock){......}, at: [<ffffffff8131c0cc>]
watchdog+0x11c/0xa20 kernel/hung_task.c:239
#1: (tasklist_lock){.+.+..}, at: [<ffffffff813fe63f>]
debug_show_all_locks+0x79/0x218 kernel/locking/lockdep.c:4336
5 locks held by kworker/u4:1/64:
#0: ("%s""netns"){.+.+.+}, at: [<ffffffff81130f0c>]
process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
#1: (net_cleanup_work){+.+.+.}, at: [<ffffffff81130f44>]
process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
#2: (net_mutex){+.+.+.}, at: [<ffffffff822e681f>] cleanup_net+0x13f/0x8b0
net/core/net_namespace.c:439
#3: (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:70
#4: (rcu_preempt_state.exp_mutex){+.+...}, at: [<ffffffff8124a749>]
exp_funnel_lock kernel/rcu/tree_exp.h:256 [inline]
#4: (rcu_preempt_state.exp_mutex){+.+...}, at: [<ffffffff8124a749>]
_synchronize_rcu_expedited+0x339/0x840 kernel/rcu/tree_exp.h:569
2 locks held by udevd/595:
#0: (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>]
__do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
#1: (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>]
ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
1 lock held by rsyslogd/1898:
#0: (&f->f_pos_lock){+.+.+.}, at: [<ffffffff8156cc7c>]
__fdget_pos+0xac/0xd0 fs/file.c:781
2 locks held by cron/1940:
#0: (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>]
__do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
#1: (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>]
ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
2 locks held by getty/2025:
#0: (&tty->ldisc_sem){++++++}, at: [<ffffffff82815952>]
ldsem_down_read+0x32/0x40 drivers/tty/tty_ldsem.c:367
#1: (&ldata->atomic_read_lock){+.+...}, at: [<ffffffff81d37362>]
n_tty_read+0x202/0x16e0 drivers/tty/n_tty.c:2142
2 locks held by syz-execprog/2155:
#0: (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>]
__do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
#1: (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>]
ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
3 locks held by kworker/0:0/2309:
#0: ("%s"("ipv6_addrconf")){.+.+..}, at: [<ffffffff81130f0c>]
process_one_work+0x73c/0x15f0 kernel/workqueue.c:2085
#1: ((addr_chk_work).work){+.+...}, at: [<ffffffff81130f44>]
process_one_work+0x774/0x15f0 kernel/workqueue.c:2089
#2: (rtnl_mutex){+.+.+.}, at: [<ffffffff823412d7>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:70
1 lock held by syz-executor.1/2356:
#0: (net_mutex){+.+.+.}, at: [<ffffffff822e70e5>] copy_net_ns+0x155/0x330
net/core/net_namespace.c:406
1 lock held by syz-executor.2/2357:
#0: (net_mutex){+.+.+.}, at: [<ffffffff822e70e5>] copy_net_ns+0x155/0x330
net/core/net_namespace.c:406
2 locks held by blkid/2360:
#0: (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>]
__do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
#1: (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>]
ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
2 locks held by blkid/2361:
#0: (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>]
__do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
#1: (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>]
ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852
2 locks held by syz-executor.0/2362:
#0: (&mm->mmap_sem){++++++}, at: [<ffffffff810b29a2>]
__do_page_fault+0x272/0xa60 arch/x86/mm/fault.c:1335
#1: (&ei->i_mmap_sem){++++.+}, at: [<ffffffff816e7716>]
ext4_filemap_fault+0x66/0xa0 fs/ext4/inode.c:5852

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.141+ #23
ffff8801d9907d08 ffffffff81b42e79 0000000000000000 0000000000000001
0000000000000001 0000000000000001 ffffffff810983b0 ffff8801d9907d40
ffffffff81b4df89 0000000000000001 0000000000000000 0000000000000003
Call Trace:
[<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff81b4df89>] nmi_cpu_backtrace.cold.0+0x48/0x87
lib/nmi_backtrace.c:99
[<ffffffff81b4df1c>] nmi_trigger_cpumask_backtrace+0x12c/0x151
lib/nmi_backtrace.c:60
[<ffffffff810984b4>] arch_trigger_cpumask_backtrace+0x14/0x20
arch/x86/kernel/apic/hw_nmi.c:37
[<ffffffff8131c65d>] trigger_all_cpu_backtrace include/linux/nmi.h:58
[inline]
[<ffffffff8131c65d>] check_hung_task kernel/hung_task.c:125 [inline]
[<ffffffff8131c65d>] check_hung_uninterruptible_tasks
kernel/hung_task.c:182 [inline]
[<ffffffff8131c65d>] watchdog+0x6ad/0xa20 kernel/hung_task.c:239
[<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
[<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 25 Comm: oom_reaper Not tainted 4.9.141+ #23
task: ffff8801d9c217c0 task.stack: ffff8801d9908000
RIP: 0010:[<ffffffff81b70843>] c [<ffffffff81b70843>] delay_tsc+0x33/0xc0
arch/x86/lib/delay.c:67
RSP: 0018:ffff8801d990f720 EFLAGS: 00000082
RAX: 0000000080000001 RBX: 000001cd23ee903d RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffffffff81ba7d7b RDI: ffffffff841eb840
RBP: ffff8801d990f740 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 000001cd23ee8f18
R13: 00000000000008fd R14: 0000000000000000 R15: fffffbfff096b76d
FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6cf8978943 CR3: 0000000048a60000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
ffffffff84b5bb20 c 000000000000270b c 0000000000000020 c fffffbfff096b7ab c
ffff8801d990f750 c ffffffff81b70750 c ffff8801d990f760 c ffffffff81b7078a c
ffff8801d990f7b0 c ffffffff81d6473f c ffffffff81b6cdd8 c ffffffff84b5bb68 c
Call Trace:
[<ffffffff81b70750>] __delay+0x10/0x20 arch/x86/lib/delay.c:160
[<ffffffff81b7078a>] __const_udelay+0x2a/0x30 arch/x86/lib/delay.c:174
[<ffffffff81d6473f>] wait_for_xmitr+0x6f/0x1e0
drivers/tty/serial/8250/8250_port.c:2005
[<ffffffff81d648cf>] serial8250_console_putchar+0x1f/0x60
drivers/tty/serial/8250/8250_port.c:3103
[<ffffffff81d4cce9>] uart_console_write+0x59/0xf0
drivers/tty/serial/serial_core.c:1866
[<ffffffff81d6fae8>] serial8250_console_write+0x528/0x820
drivers/tty/serial/8250/8250_port.c:3169
[<ffffffff81d5d4ff>] univ8250_console_write+0x5f/0x70
drivers/tty/serial/8250/8250_core.c:594
[<ffffffff8122387d>] call_console_drivers.isra.0.constprop.15+0x1ad/0x360
kernel/printk/printk.c:1594
[<ffffffff812265af>] console_unlock+0x47f/0xb50 kernel/printk/printk.c:2454
[<ffffffff812270c8>] vprintk_emit+0x448/0x790 kernel/printk/printk.c:1908
[<ffffffff81227438>] vprintk+0x28/0x30 kernel/printk/printk.c:1918
[<ffffffff8122745d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1919
[<ffffffff81402f9f>] vprintk_func kernel/printk/internal.h:36 [inline]
[<ffffffff81402f9f>] printk+0xaf/0xd7 kernel/printk/printk.c:1980
[<ffffffff814fb370>] __oom_reap_task_mm.cold.8+0x112/0x15e
mm/oom_kill.c:555
[<ffffffff81419ab5>] oom_reap_task mm/oom_kill.c:580 [inline]
[<ffffffff81419ab5>] oom_reaper+0x155/0x390 mm/oom_kill.c:618
[<ffffffff81142c3d>] kthread+0x26d/0x300 kernel/kthread.c:211
[<ffffffff82817a5c>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:373
Code: c49 c89 cfd cbf c01 c00 c00 c00 c41 c54 c53 ce8 c18 c6d
c5f cff ce8 c13 c77 c03 c00 c41 c89 cc6 c0f cae ce8 c0f c31
c48 cc1 ce2 c20 c48 c09 cc2 c49 c89 cd4 ceb c16 cf3 c90
c<bf> c01 c00 c00 c00 ce8 cf3 c6c c5f cff ce8 cee c76 c03
c00 c44 c39 cf0 c75 c36 c0f c


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches