INFO: task hung in rtnl_lock

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 7fe05eed Merge 4.9.194 into android-4.9
git tree: android-4.9
console output: https://syzkaller.appspot.com/x/log.txt?x=15e5fa38e00000
kernel config: https://syzkaller.appspot.com/x/.config?x=c6d462552c77f021
dashboard link: https://syzkaller.appspot.com/bug?extid=4f5fae4d36ab8c13a4dd
compiler: gcc (GCC) 9.0.0 20181231 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+4f5fae...@syzkaller.appspotmail.com

ip6_tunnel: 8 xmit: Local address not yet configured!
ip6_tunnel: � xmit: Local address not yet configured!
INFO: task syz-executor.1:27731 blocked for more than 140 seconds.
Not tainted 4.9.194+ #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
syz-executor.1 D29432 27731 2104 0x00000004
0000000000000083 ffff88018cc42f80 ffff8801d3142680 ffff8801db621000
ffff8801c9b75f00 ffff8801db621018 ffff880186c6fa18 ffffffff8281af8e
000060fe23a17e70 1ffff10030d8df3a 00598a514859125a ffff8801db6218f0
Call Trace:
[<0000000078469d09>] schedule+0x92/0x1c0 kernel/sched/core.c:3546
[<00000000b4f502c7>] schedule_preempt_disabled+0x13/0x20
kernel/sched/core.c:3579
[<00000000d8ab04b1>] __mutex_lock_common kernel/locking/mutex.c:582
[inline]
[<00000000d8ab04b1>] mutex_lock_nested+0x38d/0x920
kernel/locking/mutex.c:621
[<00000000c88f9cbd>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:70
[<00000000afb020fa>] devinet_ioctl+0x1a1/0x1610 net/ipv4/devinet.c:991
[<00000000ca85e26f>] inet_ioctl+0x10b/0x1a0 net/ipv4/af_inet.c:904
[<00000000c16264d7>] sock_do_ioctl+0x6a/0xb0 net/socket.c:906
[<000000000ad420b4>] sock_ioctl+0x24c/0x3d0 net/socket.c:992
[<00000000f8938578>] vfs_ioctl fs/ioctl.c:43 [inline]
[<00000000f8938578>] file_ioctl fs/ioctl.c:493 [inline]
[<00000000f8938578>] do_vfs_ioctl+0xb87/0x11d0 fs/ioctl.c:677
[<00000000d0aff99b>] SYSC_ioctl fs/ioctl.c:694 [inline]
[<00000000d0aff99b>] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685
[<00000000f8f0d80e>] do_syscall_64+0x1ad/0x5c0 arch/x86/entry/common.c:288
[<000000007d24ae95>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Showing all locks held in the system:
2 locks held by khungtaskd/24:
#0: (rcu_read_lock){......}, at: [<00000000b8503986>]
check_hung_uninterruptible_tasks kernel/hung_task.c:169 [inline]
#0: (rcu_read_lock){......}, at: [<00000000b8503986>]
watchdog+0x14b/0xaf0 kernel/hung_task.c:263
#1: (tasklist_lock){.+.?..}, at: [<00000000ac32622e>]
debug_show_all_locks+0x7f/0x21f kernel/locking/lockdep.c:4336
1 lock held by rsyslogd/1895:
#0: (&f->f_pos_lock){+.+.+.}, at: [<00000000123d1ac2>]
__fdget_pos+0xa8/0xd0 fs/file.c:782
2 locks held by getty/2023:
#0: (&tty->ldisc_sem){++++++}, at: [<0000000020c8a299>]
ldsem_down_read+0x33/0x40 drivers/tty/tty_ldsem.c:376
#1: (&ldata->atomic_read_lock){+.+...}, at: [<00000000684bdc71>]
n_tty_read+0x1fe/0x1820 drivers/tty/n_tty.c:2156
4 locks held by kworker/u4:14/19330:
#0: ("%s""netns"){.+.+.+}, at: [<00000000d82513c5>]
process_one_work+0x790/0x1600 kernel/workqueue.c:2107
#1: (net_cleanup_work){+.+.+.}, at: [<00000000a5ffece4>]
process_one_work+0x7ce/0x1600 kernel/workqueue.c:2111
#2: (net_mutex){+.+.+.}, at: [<0000000064f78030>] cleanup_net+0x131/0x8a0
net/core/net_namespace.c:440
#3: (rtnl_mutex){+.+.+.}, at: [<00000000c88f9cbd>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:70
3 locks held by kworker/0:3/9551:
#0: ("%s"("ipv6_addrconf")){.+.+..}, at: [<00000000d82513c5>]
process_one_work+0x790/0x1600 kernel/workqueue.c:2107
#1: ((addr_chk_work).work){+.+...}, at: [<00000000a5ffece4>]
process_one_work+0x7ce/0x1600 kernel/workqueue.c:2111
#2: (rtnl_mutex){+.+.+.}, at: [<00000000c88f9cbd>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:70
2 locks held by syz-executor.5/27717:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
#1: (rcu_preempt_state.exp_mutex){+.+...}, at: [<00000000c8b7da35>]
exp_funnel_lock kernel/rcu/tree_exp.h:256 [inline]
#1: (rcu_preempt_state.exp_mutex){+.+...}, at: [<00000000c8b7da35>]
_synchronize_rcu_expedited+0x339/0x850 kernel/rcu/tree_exp.h:569
1 lock held by syz-executor.1/27731:
#0: (rtnl_mutex){+.+.+.}, at: [<00000000c88f9cbd>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:70
1 lock held by syz-executor.1/27732:
#0: (rtnl_mutex){+.+.+.}, at: [<00000000c88f9cbd>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:70
1 lock held by syz-executor.1/27734:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.1/27735:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.1/27736:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.1/27738:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.3/27747:
#0: (rtnl_mutex){+.+.+.}, at: [<00000000c88f9cbd>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:70
1 lock held by syz-executor.0/27750:
#0: (rtnl_mutex){+.+.+.}, at: [<00000000c88f9cbd>] rtnl_lock+0x17/0x20
net/core/rtnetlink.c:70
1 lock held by syz-executor.0/27758:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.2/27773:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.2/27774:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.2/27775:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.4/27779:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.4/27780:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.4/27781:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.4/27783:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
1 lock held by syz-executor.4/27784:
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>] rtnl_lock
net/core/rtnetlink.c:70 [inline]
#0: (rtnl_mutex){+.+.+.}, at: [<0000000072d2b816>]
rtnetlink_rcv+0x1c/0x40 net/core/rtnetlink.c:4086
2 locks held by kworker/1:5/27816:
#0: ("events"){.+.+.+}, at: [<00000000d82513c5>]
process_one_work+0x790/0x1600 kernel/workqueue.c:2107
#1: ((&rew.rew_work)){+.+...}, at: [<00000000a5ffece4>]
process_one_work+0x7ce/0x1600 kernel/workqueue.c:2111

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 24 Comm: khungtaskd Not tainted 4.9.194+ #0
ffff8801d98d7cc8 ffffffff81b67001 0000000000000001 0000000000000000
0000000000000001 ffffffff81099d01 dffffc0000000000 ffff8801d98d7d00
ffffffff81b7229c 0000000000000001 0000000000000000 0000000000000001
Call Trace:
[<000000009a8479e8>] __dump_stack lib/dump_stack.c:15 [inline]
[<000000009a8479e8>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
[<000000004fe08860>] nmi_cpu_backtrace.cold+0x47/0x87
lib/nmi_backtrace.c:99
[<00000000e9b047e4>] nmi_trigger_cpumask_backtrace+0x124/0x155
lib/nmi_backtrace.c:60
[<00000000dfe67cfc>] arch_trigger_cpumask_backtrace+0x14/0x20
arch/x86/kernel/apic/hw_nmi.c:37
[<00000000dba0ee7a>] trigger_all_cpu_backtrace include/linux/nmi.h:58
[inline]
[<00000000dba0ee7a>] check_hung_task kernel/hung_task.c:126 [inline]
[<00000000dba0ee7a>] check_hung_uninterruptible_tasks
kernel/hung_task.c:183 [inline]
[<00000000dba0ee7a>] watchdog+0x670/0xaf0 kernel/hung_task.c:263
[<00000000e3e6a64d>] kthread+0x278/0x310 kernel/kthread.c:211
[<000000001d9e9cac>] ret_from_fork+0x5c/0x70 arch/x86/entry/entry_64.S:375
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0 skipped: idling at pc 0xffffffff8282a0e1


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.