From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-il1-f197.google.com (mail-il1-f197.google.com [209.85.166.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E22C72FD7C8 for ; Fri, 28 Nov 2025 09:12:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.166.197 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764321126; cv=none; b=NyEC0O6qb5/LiZUEmaLW9bZuZVzNb+Haz0tTzAq1kfn5ZZBUdDNXOgY9CJ2E9Uf8HuaP7MW3/5FUiCla6GXrvs8+Vr7aVHrbneisnXIwQvs0iaG58MEFwrQOUQQBPf2ygCsY9e5AQAy5qz7/fJYUhxn86xR6HpGjprgzUaYRccI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764321126; c=relaxed/simple; bh=2pxGrgfyjT8hK5dt7sj34INHa1EpVV3lJ0ds04Ywifo=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=sNLKjdEF53fwxG014oBMdeQjb9kOf2pVNmBIfMJEGpfEU8ZpDC0iEp1HimGML/I+mLr32AbToyAjxHgumdvWKdtMYxuwGURgsIyuGi1AIo37wA5ojh7gqW4efC/nh/IsIXgAMSj6E2uaxhr73MdLO4e/JRMjpiHNR4hNmX3gT/o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.166.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-il1-f197.google.com with SMTP id e9e14a558f8ab-4347bc50df4so11461385ab.0 for ; Fri, 28 Nov 2025 01:12:03 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764321123; x=1764925923; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=zrLsIDjCSOgI2XBJLdzMBGvti00z/TVzulr44VE9GVs=; b=OayJp2Kf0EmHV4r6tigfn/SW3sunWRr/NPBZ5l8JJ0377Bj1ds8S9+9jDigHdeSSOf 5KndLkyjTdnAXztbvVFZ8mTvkubjK7p9TVMsjsUV6Ve9VnFj3+MzvusmSaRGgxQQ5u5K gUaHCR1nFhT6mIZgGnh2kPk1F6ws/SKbJ7cAqMohlQ4bGoMiu05l5Jb7QP7wiiRalsxu qKtq3QyMBtnJ9ducPI8KUZ+Tv3TQTDZApSx4vpaarXB2PITeveE7HUurLQtVl6cB3JHX Mk4GO1KbnP30DUYw2YMN/D0FE2kt9036REkkvxt0U7vE4DaxaZ5qmGU98YHdcJMInTpZ q9AQ== X-Forwarded-Encrypted: i=1; AJvYcCUPDUuGczZyLyyRL/oL+ygJBL2D0VKMGON9wdMhbzhLyL8OCD5gHVWx5FujUQyEc+1/rwr8a4xzdTbPhuw=@vger.kernel.org X-Gm-Message-State: AOJu0YwtuFY1qSaqrfT8BgD+yxuezflkhVP4mdoAY7tryO0iMMEOJhWn mfXyhdBlxzOn+fH9nYn5zhh1Mg9A6jZfgoU03/t9RnsJ2rw67Dg+tx/GcK6zNLEXB8qViYFnT4v 2bfH/WkKYLOHYZGUdOOaiP0TMlufYB2MxRkk167/rDHg1r5NXVTGqHTxqhjk= X-Google-Smtp-Source: AGHT+IH7vZ0R/XP2NwKEwapnF/OES9hyzmPc0ElTwx09wqLa9n81UE5TCG5ng5cyz2lkUP5CciFlSpdwQwHWpJy5P94QcgdYXT/8 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6e02:b46:b0:434:96ea:ff45 with SMTP id e9e14a558f8ab-435aa8ee764mr269788015ab.19.1764321123107; Fri, 28 Nov 2025 01:12:03 -0800 (PST) Date: Fri, 28 Nov 2025 01:12:03 -0800 In-Reply-To: X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69296763.a70a0220.d98e3.0136.GAE@google.com> Subject: Re: [syzbot] [net?] INFO: task hung in devlink_health_report (3) From: syzbot To: eadavis@qq.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: INFO: task hung in remove_one INFO: task kworker/u8:9:1158 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:kworker/u8:9 state:D stack:24472 pid:1158 tgid:1158 ppid:2 task_flags:0x4208060 flags:0x00080000 Workqueue: netns cleanup_net Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1190/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_timeout+0x257/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:100 [inline] __wait_for_common+0x2fc/0x4e0 kernel/sched/completion.c:121 __debugfs_file_removed fs/debugfs/inode.c:770 [inline] remove_one+0x312/0x420 fs/debugfs/inode.c:777 __simple_recursive_removal+0x15b/0x610 fs/libfs.c:631 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:800 nsim_dev_health_exit+0x3b/0xe0 drivers/net/netdevsim/health.c:227 nsim_dev_reload_destroy+0x144/0x4d0 drivers/net/netdevsim/dev.c:1710 nsim_dev_reload_down+0x6e/0xd0 drivers/net/netdevsim/dev.c:983 devlink_reload+0x1a1/0x7c0 net/devlink/dev.c:461 devlink_pernet_pre_exit+0x1b8/0x2c0 net/devlink/core.c:510 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0xab0 net/core/net_namespace.c:234 cleanup_net+0x41b/0x8b0 net/core/net_namespace.c:695 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 INFO: task syz-executor:11435 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz-executor state:D stack:23720 pid:11435 tgid:11435 ppid:1 task_flags:0x400140 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1190/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x818/0x1060 kernel/locking/mutex.c:760 device_lock include/linux/device.h:914 [inline] device_del+0xa0/0x9f0 drivers/base/core.c:3840 device_unregister+0x1d/0xc0 drivers/base/core.c:3919 nsim_bus_dev_del drivers/net/netdevsim/bus.c:483 [inline] del_device_store+0x355/0x4a0 drivers/net/netdevsim/bus.c:244 bus_attr_store+0x74/0xb0 drivers/base/bus.c:172 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:142 kernfs_fop_write_iter+0x3af/0x570 fs/kernfs/file.c:352 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x7d3/0x11d0 fs/read_write.c:686 ksys_write+0x12a/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff03d78e27f RSP: 002b:00007ffcb83e5ab0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007ff03d78e27f RDX: 0000000000000001 RSI: 00007ffcb83e5b00 RDI: 0000000000000005 RBP: 00007ff03d8152cb R08: 0000000000000000 R09: 00007ffcb83e5907 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 R13: 00007ffcb83e5b00 R14: 00007ff03e514620 R15: 0000000000000003 INFO: task syz.3.2358:11455 blocked for more than 143 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.3.2358 state:D stack:28856 pid:11455 tgid:11453 ppid:6409 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1190/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x818/0x1060 kernel/locking/mutex.c:760 devlink_health_report+0x6b4/0xb00 net/devlink/health.c:680 nsim_dev_health_break_write+0x166/0x210 drivers/net/netdevsim/health.c:162 full_proxy_write+0x131/0x1a0 fs/debugfs/file.c:388 vfs_write+0x2a0/0x11d0 fs/read_write.c:684 ksys_write+0x12a/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fca8398f7c9 RSP: 002b:00007fca8490b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fca83be5fa0 RCX: 00007fca8398f7c9 RDX: 0000000000000006 RSI: 0000200000005900 RDI: 0000000000000003 RBP: 00007fca83a13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fca83be6038 R14: 00007fca83be5fa0 R15: 00007ffed5e04d38 INFO: task syz.0.2377:11497 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.0.2377 state:D stack:29096 pid:11497 tgid:11496 ppid:6395 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1190/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083 rwsem_down_read_slowpath+0x64b/0xbf0 kernel/locking/rwsem.c:1086 __down_read_common kernel/locking/rwsem.c:1261 [inline] __down_read kernel/locking/rwsem.c:1274 [inline] down_read+0xef/0x480 kernel/locking/rwsem.c:1539 inode_lock_shared include/linux/fs.h:995 [inline] open_last_lookups fs/namei.c:3894 [inline] path_openat+0x818/0x2cb0 fs/namei.c:4131 do_filp_open+0x20b/0x470 fs/namei.c:4161 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f693bf8f7c9 RSP: 002b:00007f693ce55038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f693c1e5fa0 RCX: 00007f693bf8f7c9 RDX: 0000000000048081 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f693c013f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f693c1e6038 R14: 00007f693c1e5fa0 R15: 00007ffd737e93b8 INFO: task syz.1.2378:11500 blocked for more than 144 seconds. Not tainted syzkaller #0 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:syz.1.2378 state:D stack:28432 pid:11500 tgid:11498 ppid:6397 task_flags:0x400040 flags:0x00080002 Call Trace: context_switch kernel/sched/core.c:5325 [inline] __schedule+0x1190/0x5de0 kernel/sched/core.c:6929 __schedule_loop kernel/sched/core.c:7011 [inline] schedule+0xe7/0x3a0 kernel/sched/core.c:7026 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083 rwsem_down_read_slowpath+0x64b/0xbf0 kernel/locking/rwsem.c:1086 __down_read_common kernel/locking/rwsem.c:1261 [inline] __down_read kernel/locking/rwsem.c:1274 [inline] down_read+0xef/0x480 kernel/locking/rwsem.c:1539 inode_lock_shared include/linux/fs.h:995 [inline] open_last_lookups fs/namei.c:3894 [inline] path_openat+0x818/0x2cb0 fs/namei.c:4131 do_filp_open+0x20b/0x470 fs/namei.c:4161 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437 do_sys_open fs/open.c:1452 [inline] __do_sys_openat fs/open.c:1468 [inline] __se_sys_openat fs/open.c:1463 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1463 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f0217d8f7c9 RSP: 002b:00007f0218c82038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f0217fe5fa0 RCX: 00007f0217d8f7c9 RDX: 0000000000048081 RSI: 0000200000000000 RDI: ffffffffffffff9c RBP: 00007f0217e13f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f0217fe6038 R14: 00007f0217fe5fa0 R15: 00007ffc44959248 Showing all locks held in the system: 1 lock held by khungtaskd/31: #0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline] #0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775 6 locks held by kworker/u8:9/1158: #0: ffff88801ba9f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238 #1: ffffc90003e4fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239 #2: ffffffff900d5090 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x8b0 net/core/net_namespace.c:669 #3: ffff88802128f0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:914 [inline] #3: ffff88802128f0e8 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:108 [inline] #3: ffff88802128f0e8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x144/0x2c0 net/devlink/core.c:507 #4: ffff88807a393250 (&devlink->lock_key#5){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:276 [inline] #4: ffff88807a393250 (&devlink->lock_key#5){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:109 [inline] #4: ffff88807a393250 (&devlink->lock_key#5){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x14e/0x2c0 net/devlink/core.c:507 #5: ffff888072ff3398 (&sb->s_type->i_mutex_key#3/2){+.+.}-{4:4}, at: inode_lock_nested include/linux/fs.h:1025 [inline] #5: ffff888072ff3398 (&sb->s_type->i_mutex_key#3/2){+.+.}-{4:4}, at: __simple_recursive_removal+0x354/0x610 fs/libfs.c:627 1 lock held by klogd/5190: #0: ffff8880b843a4d8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:638 2 locks held by getty/5593: #0: ffff88803469d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222 5 locks held by syz-executor/11435: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff888076d95c88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 #4: ffff88802128f0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:914 [inline] #4: ffff88802128f0e8 (&dev->mutex){....}-{4:4}, at: device_del+0xa0/0x9f0 drivers/base/core.c:3840 3 locks held by syz.3.2358/11455: #0: ffff88803023beb8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2a2/0x370 fs/file.c:1232 #1: ffff888141ad0420 (sb_writers#8){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #2: ffff88807a393250 (&devlink->lock_key#5){+.+.}-{4:4}, at: devlink_health_report+0x6b4/0xb00 net/devlink/health.c:680 2 locks held by syz.0.2377/11497: #0: ffff888141ad0420 (sb_writers#8){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:3884 [inline] #0: ffff888141ad0420 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x1ec8/0x2cb0 fs/namei.c:4131 #1: ffff888072ff3398 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:995 [inline] #1: ffff888072ff3398 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: open_last_lookups fs/namei.c:3894 [inline] #1: ffff888072ff3398 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: path_openat+0x818/0x2cb0 fs/namei.c:4131 2 locks held by syz.1.2378/11500: #0: ffff888141ad0420 (sb_writers#8){.+.+}-{0:0}, at: open_last_lookups fs/namei.c:3884 [inline] #0: ffff888141ad0420 (sb_writers#8){.+.+}-{0:0}, at: path_openat+0x1ec8/0x2cb0 fs/namei.c:4131 #1: ffff888072ff3398 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: inode_lock_shared include/linux/fs.h:995 [inline] #1: ffff888072ff3398 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: open_last_lookups fs/namei.c:3894 [inline] #1: ffff888072ff3398 (&sb->s_type->i_mutex_key#3){++++}-{4:4}, at: path_openat+0x818/0x2cb0 fs/namei.c:4131 4 locks held by syz-executor/11508: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff88802785c088 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11509: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff888072ab5c88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11513: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff8880718cf888 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11542: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff888055217488 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11557: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff88805b35c488 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11558: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff8880550b0c88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11561: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff8880599b0c88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11588: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff88801bf8f888 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11606: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff88807e9cec88 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11607: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff88801e2c1088 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 4 locks held by syz-executor/11611: #0: ffff88807f52a420 (sb_writers#7){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 fs/read_write.c:738 #1: ffff88805cc85488 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x28f/0x570 fs/kernfs/file.c:343 #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline] #2: ffff888144f46788 (kn->active#58){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x2ff/0x570 fs/kernfs/file.c:344 #3: ffffffff8f66d288 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd1/0x4a0 drivers/net/netdevsim/bus.c:234 ============================================= NMI backtrace for cpu 0 CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline] check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline] watchdog+0xf3f/0x1170 kernel/hung_task.c:495 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: events_unbound cfg80211_wiphy_work RIP: 0010:skb_kfree_head net/core/skbuff.c:1046 [inline] RIP: 0010:skb_kfree_head net/core/skbuff.c:1043 [inline] RIP: 0010:skb_free_head+0x19e/0x210 net/core/skbuff.c:1060 Code: 84 1e ff ff ff 48 83 c4 08 5b 5d 41 5c 41 5d e9 a8 f7 93 f8 e8 a3 f7 93 f8 48 c7 c0 e0 6d 06 8e 48 ba 00 00 00 00 00 fc ff df <48> c1 e8 03 80 3c 10 00 75 3c 48 8b 3d d1 0d de 04 4c 89 ee e8 69 RSP: 0018:ffffc90000117ac8 EFLAGS: 00000293 RAX: ffffffff8e066de0 RBX: 0000000000000180 RCX: ffffffff89285f5b RDX: dffffc0000000000 RSI: ffffffff89285fed RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000180 R10: 0000000000000180 R11: 0000000000002b81 R12: 0000000000000000 R13: ffff888074101380 R14: ffff888032c7e210 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888124b0d000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055d26edc1088 CR3: 000000000e182000 CR4: 00000000003526f0 Call Trace: skb_release_data+0x795/0x9e0 net/core/skbuff.c:1087 skb_release_all net/core/skbuff.c:1152 [inline] __kfree_skb net/core/skbuff.c:1166 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1204 kfree_skb_reason include/linux/skbuff.h:1322 [inline] kfree_skb include/linux/skbuff.h:1331 [inline] ieee80211_iface_work+0x435/0x1360 net/mac80211/iface.c:1758 cfg80211_wiphy_work+0x2c7/0x580 net/wireless/core.c:435 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263 process_scheduled_works kernel/workqueue.c:3346 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427 kthread+0x3c5/0x780 kernel/kthread.c:463 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Tested on: commit: e538109a Merge tag 'drm-fixes-2025-11-28' of https://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=107cae12580000 kernel config: https://syzkaller.appspot.com/x/.config?x=1cd7f786c0f5182f dashboard link: https://syzkaller.appspot.com/bug?extid=11d9554b851e6081de70 compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40 patch: https://syzkaller.appspot.com/x/patch.diff?x=16667e12580000