[v6.6] BUG: workqueue lockup

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c2603c511feb Linux 6.6.93
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=165a4370580000
kernel config: https://syzkaller.appspot.com/x/.config?x=486bade17c8c30b9
dashboard link: https://syzkaller.appspot.com/bug?extid=1fbf3f633f815f423a8c
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/8754f950a6e7/disk-c2603c51.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/3b19332dbf63/vmlinux-c2603c51.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb245e836038/bzImage-c2603c51.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1fbf3f...@syzkaller.appspotmail.com

BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 179s!
BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=0 stuck for 179s!
BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=-20 stuck for 175s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=13/256 refcnt=14
pending: 2*nsim_dev_hwstats_traffic_work, kvmclock_update_fn, 4*psi_avgs_work, 3*ovs_dp_masks_rebalance, kfree_rcu_monitor, l2cap_chan_timeout, rht_deferred_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=14/256 refcnt=15
pending: 7*nsim_dev_hwstats_traffic_work, psi_avgs_work, kfree_rcu_monitor, vmstat_shepherd, 2*ovs_dp_masks_rebalance, delayed_vfree_work, switchdev_deferred_process_work
workqueue events_long: flags=0x0
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: defense_work_handler, br_fdb_cleanup
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=6/256 refcnt=7
pending: 4*defense_work_handler, br_fdb_cleanup, br_multicast_gc_work
workqueue events_unbound: flags=0x2
pwq 4: cpus=0-1 flags=0x4 nice=0 active=10/512 refcnt=11
pending: 3*cfg80211_wiphy_work, toggle_allocation_gate, crng_reseed, macvlan_process_broadcast, idle_cull_fn, 3*macvlan_process_broadcast
pwq 4: cpus=0-1 flags=0x4 nice=0 active=21/512 refcnt=22
pending: 9*nsim_dev_trap_report_work, 5*cfg80211_wiphy_work, flush_memcg_stats_dwork, 2*idle_cull_fn, 3*macvlan_process_broadcast, idle_cull_fn
workqueue events_freezable: flags=0x4
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: update_balloon_stats_func
workqueue events_power_efficient: flags=0x80
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=8/256 refcnt=9
pending: wg_ratelimiter_gc_entries, 2*neigh_managed_work, 2*neigh_periodic_work, device_uncache_fw_images_work, do_cache_clean, gc_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: check_lifetime
workqueue rcu_gp: flags=0x8
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wait_rcu_exp_gp
workqueue mm_percpu_wq: flags=0x8
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: vmstat_update
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: vmstat_update
workqueue writeback: flags=0x4a
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=2
pending: wb_workfn
workqueue kblockd: flags=0x18
pwq 3: cpus=1 node=0 flags=0x0 nice=-20 active=1/256 refcnt=2
pending: blk_mq_requeue_work
workqueue dm_bufio_cache: flags=0x8
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: work_fn
workqueue ipv6_addrconf: flags=0x40008
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/1 refcnt=4
pending: addrconf_verify_work
inactive: 2*addrconf_verify_work
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/1 refcnt=3
pending: addrconf_verify_work
inactive: addrconf_verify_work
workqueue bat_events: flags=0xe000a
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/1 refcnt=39
pending: batadv_nc_worker
inactive: 3*batadv_nc_worker, 4*batadv_mcast_mla_update, 2*batadv_purge_orig, batadv_iv_send_outstanding_bat_ogm_packet, 2*batadv_purge_orig, 11*batadv_iv_send_outstanding_bat_ogm_packet, 4*batadv_tt_purge, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, 2*batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge
workqueue wg-crypt-wg0: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x6
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x6
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue hci4: flags=0xa0012
pwq 5: cpus=0-1 node=0 flags=0x4 nice=-20 active=1/1 refcnt=4
in-flight: 338:hci_cmd_sync_work
workqueue wg-kex-wg0: flags=0x6
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x6
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x6
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pool 5: cpus=0-1 node=0 flags=0x4 nice=-20 hung=0s workers=4 idle: 22863 355 27301
Showing backtraces of running workers in stalled CPU-bound worker pools:


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: 59a2de10b81a Linux 6.6.97
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1365fe8c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ac0b29aca872266f
dashboard link: https://syzkaller.appspot.com/bug?extid=1fbf3f633f815f423a8c
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=133190f0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1765fe8c580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/32864b54a55c/disk-59a2de10.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/b0bbe4ada642/vmlinux-59a2de10.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9e3fe91e14c2/bzImage-59a2de10.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1fbf3f...@syzkaller.appspotmail.com

BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 159s!

Showing busy workqueues and worker pools:
workqueue events: flags=0x0

pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=4/256 refcnt=5
pending: 4*ovs_dp_masks_rebalance
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: vmstat_shepherd, psi_avgs_work, ovs_dp_masks_rebalance

workqueue events_long: flags=0x0
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=2/256 refcnt=3

pending: 2*defense_work_handler
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: 3*defense_work_handler
workqueue events_unbound: flags=0x2
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/512 refcnt=2
pending: toggle_allocation_gate
pwq 4: cpus=0-1 flags=0x4 nice=0 active=2/512 refcnt=3
pending: flush_memcg_stats_dwork, crng_reseed

workqueue events_freezable: flags=0x4
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: update_balloon_stats_func
workqueue events_power_efficient: flags=0x80

pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=5/256 refcnt=6
pending: do_cache_clean, 2*neigh_managed_work, 2*neigh_periodic_work
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: gc_worker, reg_check_chans_work, check_lifetime

workqueue rcu_gp: flags=0x8
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wait_rcu_exp_gp
workqueue mm_percpu_wq: flags=0x8
pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: vmstat_update
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: vmstat_update
workqueue writeback: flags=0x4a
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=2
pending: wb_workfn

workqueue dm_bufio_cache: flags=0x8

pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2

pending: work_fn
workqueue ipv6_addrconf: flags=0x40008

pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/1 refcnt=2
pending: addrconf_verify_work
workqueue krxrpcd: flags=0xa001a
pwq 5: cpus=0-1 node=0 flags=0x4 nice=-20 active=1/1 refcnt=8
pending: rxrpc_peer_keepalive_worker
inactive: 4*rxrpc_peer_keepalive_worker

Showing backtraces of running workers in stalled CPU-bound worker pools:


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.