[v6.1] INFO: task hung in addrconf_verify_work (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 228da13e907e Linux 6.1.175
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=144bcf2e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4dd3c1715f0a309b
dashboard link: https://syzkaller.appspot.com/bug?extid=461cdb82c969e43cfb81
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=152083d2580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/a1730af56ab4/disk-228da13e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/eafe9b37a422/vmlinux-228da13e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7353ac7f337a/bzImage-228da13e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+461cdb...@syzkaller.appspotmail.com

INFO: task kworker/1:12:4681 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:12 state:D stack:25936 pid:4681 ppid:2 flags:0x00004000
Workqueue: ipv6_addrconf addrconf_verify_work
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0x11d1/0x40e0 kernel/sched/core.c:6562
schedule+0xb9/0x180 kernel/sched/core.c:6638
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6697
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x562/0xaf0 kernel/locking/mutex.c:747
addrconf_verify_work+0x15/0x30 net/ipv6/addrconf.c:4672
process_one_work+0x8a2/0x1160 kernel/workqueue.c:2292
worker_thread+0xaa2/0x1270 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>

Showing all locks held in the system:
2 locks held by kworker/u4:1/11:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8cb2e7f0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffffffff8cb2f010 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xf00 kernel/rcu/tasks.h:517
3 locks held by kworker/1:0/22:
#0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
#1: ffffc900001c7d00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7b0/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd4abe8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:104
1 lock held by khungtaskd/28:


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup