[v6.6] INFO: task hung in register_nexthop_notifier
4 views
Skip to first unread message
syzbot
Dec 4, 2025, 3:43:30 AMDec 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 4791134e4aeb Linux 6.6.118
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15a634c2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=1e5010045d99da269265
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d5853385c5d5/disk-4791134e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/13d5cf580b4d/vmlinux-4791134e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a9536fd663f0/bzImage-4791134e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1e5010...@syzkaller.appspotmail.com
INFO: task syz.6.372:7188 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.372 state:D stack:25832 pid:7188 ppid:6910 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
schedule+0xbd/0x170 kernel/sched/core.c:6773
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6832
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6b7/0xcc0 kernel/locking/mutex.c:747
register_nexthop_notifier+0x81/0x210 net/ipv4/nexthop.c:3636
ops_init+0x397/0x640 net/core/net_namespace.c:139
setup_net+0x3a5/0xa00 net/core/net_namespace.c:343
copy_net_ns+0x36d/0x5e0 net/core/net_namespace.c:520
create_new_namespaces+0x3d3/0x6f0 kernel/nsproxy.c:110
copy_namespaces+0x430/0x4a0 kernel/nsproxy.c:179
copy_process+0x1700/0x3d70 kernel/fork.c:2509
kernel_clone+0x21b/0x840 kernel/fork.c:2914
__do_sys_clone kernel/fork.c:3057 [inline]
__se_sys_clone kernel/fork.c:3041 [inline]
__x64_sys_clone+0x18c/0x1e0 kernel/fork.c:3041
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f397af8f749
RSP: 002b:00007f397becafe8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f397b1e6090 RCX: 00007f397af8f749
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000c0001480
RBP: 00007f397b013f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f397b1e6128 R14: 00007f397b1e6090 R15: 00007ffce9e0fcc8
</TASK>
INFO: task syz.1.374:7192 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.374 state:D stack:25448 pid:7192 ppid:5782 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
schedule+0xbd/0x170 kernel/sched/core.c:6773
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6832
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6b7/0xcc0 kernel/locking/mutex.c:747
netlink_dump+0x71f/0xde0 net/netlink/af_netlink.c:2263
__netlink_dump_start+0x5f1/0x810 net/netlink/af_netlink.c:2372
netlink_dump_start include/linux/netlink.h:338 [inline]
rtnetlink_rcv_msg+0xba1/0xf10 net/core/rtnetlink.c:6428
netlink_rcv_skb+0x216/0x480 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x751/0x8d0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8c1/0xbe0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x5bf/0x950 net/socket.c:2595
___sys_sendmsg+0x220/0x290 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1a5/0x270 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f130938f749
RSP: 002b:00007f130a1e9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f13095e5fa0 RCX: 00007f130938f749
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000006
RBP: 00007f1309413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f13095e6038 R14: 00007f13095e5fa0 R15: 00007fffdee98b08
</TASK>
Showing all locks held in the system:
4 locks held by kworker/R-netns/7:
#0: ffff888017873938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017873938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc900000c7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc900000c7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffffffff8dfaf8d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x136/0xb90 net/core/net_namespace.c:606
#3: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x1c/0x1d0 drivers/net/wireguard/device.c:422
1 lock held by khungtaskd/29:
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
3 locks held by kworker/u4:2/42:
#0: ffff88802c106938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff88802c106938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90000b2fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90000b2fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4700
3 locks held by kworker/1:2/1187:
#0: ffff888017871d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017871d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90004bdfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90004bdfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x91/0xd70 net/wireless/reg.c:2463
5 locks held by kworker/u5:1/5104:
#0: ffff888048b4bd38 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888048b4bd38 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90010327d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90010327d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffff88802679ce70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1d4/0x390 net/bluetooth/hci_sync.c:326
#3: ffff88802679c0b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1f7/0xdc0 net/bluetooth/hci_sync.c:5658
#4: ffffffff8e129888 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1996 [inline]
#4: ffffffff8e129888 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x165/0x300 net/bluetooth/hci_conn.c:1251
2 locks held by kworker/1:3/5175:
#0: ffff888017872538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017872538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc900031c7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc900031c7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
2 locks held by getty/5548:
#0: ffff88802ca070a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x425/0x1380 drivers/tty/n_tty.c:2217
6 locks held by kworker/u5:2/5787:
#0: ffff888048b51938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888048b51938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc9000455fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc9000455fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffff88804a6cce70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1d4/0x390 net/bluetooth/hci_sync.c:326
#3: ffff88804a6cc0b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1f7/0xdc0 net/bluetooth/hci_sync.c:5658
#4: ffffffff8e129888 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1996 [inline]
#4: ffffffff8e129888 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x165/0x300 net/bluetooth/hci_conn.c:1251
#5: ffff888022807b38 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_conn_del+0x70/0x660 net/bluetooth/l2cap_core.c:1763
2 locks held by kworker/0:3/5790:
2 locks held by kworker/0:5/7025:
1 lock held by syz.4.371/7181:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511
3 locks held by syz.4.371/7183:
2 locks held by syz.6.372/7188:
#0: ffffffff8dfaf8d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x351/0x5e0 net/core/net_namespace.c:516
#1: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x81/0x210 net/ipv4/nexthop.c:3636
2 locks held by syz.1.374/7192:
#0: ffff88804c1fb690 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0xf4/0x810 net/netlink/af_netlink.c:2336
#1: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0x71f/0xde0 net/netlink/af_netlink.c:2263
1 lock held by syz.5.375/7196:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511
1 lock held by syz-executor/7209:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7212:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7216:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7219:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7243:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7246:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7248:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7251:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7256:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
2 locks held by dhcpcd/7261:
#0: ffff888046d3c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff888046d3c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
#1: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline]
#1: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x448/0x830 kernel/rcu/tree_exp.h:1004
2 locks held by dhcpcd/7262:
#0: ffff8880229ec130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff8880229ec130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
#1: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#1: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x360/0x830 kernel/rcu/tree_exp.h:1004
1 lock held by dhcpcd/7263:
#0: ffff88804c892130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff88804c892130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
1 lock held by dhcpcd/7264:
#0: ffff8880372b2130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff8880372b2130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
1 lock held by dhcpcd/7265:
#0: ffff88803b956130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff88803b956130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
nmi_cpu_backtrace+0x39b/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf41/0xf80 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 7183 Comm: syz.4.371 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:212
Code: 00 0f 0b 0f 1f 80 00 00 00 00 f3 0f 1e fa 53 48 89 fb e8 13 00 00 00 48 8b 3d 5c 05 c5 0c 48 89 de 5b e9 43 9d 56 00 cc cc cc <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0d f0 24 7e 7e 65 8b 15 f1 24 7e
RSP: 0018:ffffc90000006438 EFLAGS: 00000087
RAX: 1ffff1100f602cff RBX: ffffc90000006600 RCX: ffff8880228b1e00
RDX: 0000000000000100 RSI: ffffffff8aaace60 RDI: ffff88807b016a88
RBP: ffffc900000066c8 R08: ffffffff8e4a93ef R09: 1ffffffff1c9527d
R10: dffffc0000000000 R11: fffffbfff1c9527e R12: ffff88807b010618
R13: ffffc900000064c8 R14: ffff8880b8e36910 R15: dffffc0000000000
FS: 00007f22eb41b6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055def952e270 CR3: 0000000046e82000 CR4: 00000000003506f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
perf_tp_event+0x52f/0x13a0 kernel/events/core.c:10332
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10268
perf_trace_preemptirq_template+0x281/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:104 [inline]
RIP: 0010:__local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:413
Code: 8a e8 be a0 1d 09 65 66 8b 05 86 22 b2 7e 66 85 c0 75 54 bf 01 00 00 00 e8 67 db 09 00 e8 62 60 3a 00 fb 65 8b 05 52 22 b2 7e <85> c0 75 05 e8 31 08 af ff 48 c7 04 24 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc900000068e0 EFLAGS: 00000282
RAX: 0000000000000102 RBX: 0000000000000201 RCX: 379244555a4cae00
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6f80
RBP: ffffc90000006970 R08: ffffffff90da952f R09: 1ffffffff21b52a5
R10: dffffc0000000000 R11: fffffbfff21b52a6 R12: ffffffff8957e7ad
R13: ffffc900035ab090 R14: dffffc0000000000 R15: 1ffff92000000d1c
ebt_do_table+0x259d/0x2750 net/bridge/netfilter/ebtables.c:-1
nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:259 [inline]
NF_HOOK+0x213/0x3d0 include/linux/netfilter.h:302
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
br_nf_hook_thresh net/bridge/br_netfilter_hooks.c:-1 [inline]
br_nf_forward_finish+0xa33/0xe50 net/bridge/br_netfilter_hooks.c:684
NF_HOOK+0x613/0x6a0 include/linux/netfilter.h:304
br_nf_forward_ip+0xcc1/0x1110 net/bridge/br_netfilter_hooks.c:754
nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:259 [inline]
NF_HOOK+0x213/0x3d0 include/linux/netfilter.h:302
__br_forward+0x41f/0x600 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver+0xb5/0x150 net/bridge/br_forward.c:191
br_flood+0x31b/0x680 net/bridge/br_forward.c:237
br_handle_frame_finish+0x143d/0x1950 net/bridge/br_input.c:215
br_nf_hook_thresh+0x3b6/0x480 net/bridge/br_netfilter_hooks.c:1184
br_nf_pre_routing_finish_ipv6+0x9e3/0xd90 net/bridge/br_netfilter_ipv6.c:-1
NF_HOOK include/linux/netfilter.h:304 [inline]
br_nf_pre_routing_ipv6+0x34d/0x680 net/bridge/br_netfilter_ipv6.c:184
nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]
br_handle_frame+0x957/0x14c0 net/bridge/br_input.c:424
__netif_receive_skb_core+0xf6b/0x3ac0 net/core/dev.c:5502
__netif_receive_skb_one_core net/core/dev.c:5606 [inline]
__netif_receive_skb+0x74/0x290 net/core/dev.c:5722
process_backlog+0x380/0x6e0 net/core/dev.c:6050
__napi_poll+0xc0/0x460 net/core/dev.c:6612
napi_poll net/core/dev.c:6679 [inline]
net_rx_action+0x5ea/0xbf0 net/core/dev.c:6815
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 ca 2b 13 f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> a2 a6 e2 f6 65 8b 05 93 ed 8a 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc90004c96fe0 EFLAGS: 00000206
RAX: 379244555a4cae00 RBX: 0000000000000a06 RCX: 379244555a4cae00
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc90004c97078 R08: ffffffff90da952f R09: 1ffffffff21b52a5
R10: dffffc0000000000 R11: fffffbfff21b52a6 R12: dffffc0000000000
R13: ffff88806f045f00 R14: ffffffff970fbae8 R15: 1ffff92000992dfc
__debug_check_no_obj_freed lib/debugobjects.c:999 [inline]
debug_check_no_obj_freed+0x51f/0x540 lib/debugobjects.c:1020
slab_free_hook mm/slub.c:1786 [inline]
slab_free_freelist_hook+0xd2/0x1b0 mm/slub.c:1837
slab_free mm/slub.c:3830 [inline]
kmem_cache_free+0xf8/0x280 mm/slub.c:3852
mmdrop include/linux/sched/mm.h:54 [inline]
mmdrop_sched include/linux/sched/mm.h:82 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:109 [inline]
finish_task_switch+0x3e0/0x920 kernel/sched/core.c:5279
context_switch kernel/sched/core.c:5383 [inline]
__schedule+0x14da/0x44d0 kernel/sched/core.c:6699
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6866
preempt_schedule+0xab/0xc0 kernel/sched/core.c:6890
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0xfa/0x110 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__slab_free+0x353/0x410 mm/slub.c:3734
qlink_free mm/kasan/quarantine.c:166 [inline]
qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
____kasan_kmalloc mm/kasan/common.c:340 [inline]
__kasan_kmalloc+0x22/0xa0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc_node+0xb4/0x230 mm/slab_common.c:1014
kmalloc_node include/linux/slab.h:620 [inline]
kvmalloc_node+0x70/0x180 mm/util.c:617
kvmalloc include/linux/slab.h:738 [inline]
kvmalloc_array include/linux/slab.h:756 [inline]
__ptr_ring_init_queue_alloc include/linux/ptr_ring.h:471 [inline]
ptr_ring_init include/linux/ptr_ring.h:489 [inline]
skb_array_init include/linux/skb_array.h:182 [inline]
pfifo_fast_init+0x10d/0x6a0 net/sched/sch_generic.c:870
qdisc_create_dflt+0x11e/0x430 net/sched/sch_generic.c:1019
mq_init+0x2e3/0x660 net/sched/sch_mq.c:90
qdisc_create_dflt+0x11e/0x430 net/sched/sch_generic.c:1019
attach_default_qdiscs net/sched/sch_generic.c:1199 [inline]
dev_activate+0x1d0/0x11a0 net/sched/sch_generic.c:1253
__dev_open+0x338/0x430 net/core/dev.c:1515
__dev_change_flags+0x20e/0x6a0 net/core/dev.c:8685
dev_change_flags+0x88/0x1a0 net/core/dev.c:8757
dev_ifsioc+0x6a7/0xe20 net/core/dev_ioctl.c:529
dev_ioctl+0x7e2/0x1170 net/core/dev_ioctl.c:786
sock_do_ioctl+0x226/0x2f0 net/socket.c:1236
sock_ioctl+0x623/0x7a0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f22ea58f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f22eb41b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f22ea7e5fa0 RCX: 00007f22ea58f749
RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000010
RBP: 00007f22ea613f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f22ea7e6038 R14: 00007f22ea7e5fa0 R15: 00007ffc0012f7a8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 4791134e4aeb Linux 6.6.118
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=15a634c2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=1e5010045d99da269265
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/d5853385c5d5/disk-4791134e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/13d5cf580b4d/vmlinux-4791134e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a9536fd663f0/bzImage-4791134e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+1e5010...@syzkaller.appspotmail.com
INFO: task syz.6.372:7188 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.6.372 state:D stack:25832 pid:7188 ppid:6910 flags:0x00004006
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
schedule+0xbd/0x170 kernel/sched/core.c:6773
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6832
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6b7/0xcc0 kernel/locking/mutex.c:747
register_nexthop_notifier+0x81/0x210 net/ipv4/nexthop.c:3636
ops_init+0x397/0x640 net/core/net_namespace.c:139
setup_net+0x3a5/0xa00 net/core/net_namespace.c:343
copy_net_ns+0x36d/0x5e0 net/core/net_namespace.c:520
create_new_namespaces+0x3d3/0x6f0 kernel/nsproxy.c:110
copy_namespaces+0x430/0x4a0 kernel/nsproxy.c:179
copy_process+0x1700/0x3d70 kernel/fork.c:2509
kernel_clone+0x21b/0x840 kernel/fork.c:2914
__do_sys_clone kernel/fork.c:3057 [inline]
__se_sys_clone kernel/fork.c:3041 [inline]
__x64_sys_clone+0x18c/0x1e0 kernel/fork.c:3041
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f397af8f749
RSP: 002b:00007f397becafe8 EFLAGS: 00000202 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f397b1e6090 RCX: 00007f397af8f749
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000c0001480
RBP: 00007f397b013f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f397b1e6128 R14: 00007f397b1e6090 R15: 00007ffce9e0fcc8
</TASK>
INFO: task syz.1.374:7192 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.374 state:D stack:25448 pid:7192 ppid:5782 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
schedule+0xbd/0x170 kernel/sched/core.c:6773
schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6832
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x6b7/0xcc0 kernel/locking/mutex.c:747
netlink_dump+0x71f/0xde0 net/netlink/af_netlink.c:2263
__netlink_dump_start+0x5f1/0x810 net/netlink/af_netlink.c:2372
netlink_dump_start include/linux/netlink.h:338 [inline]
rtnetlink_rcv_msg+0xba1/0xf10 net/core/rtnetlink.c:6428
netlink_rcv_skb+0x216/0x480 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x751/0x8d0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8c1/0xbe0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x5bf/0x950 net/socket.c:2595
___sys_sendmsg+0x220/0x290 net/socket.c:2649
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2687 [inline]
__se_sys_sendmsg+0x1a5/0x270 net/socket.c:2685
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f130938f749
RSP: 002b:00007f130a1e9038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f13095e5fa0 RCX: 00007f130938f749
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000006
RBP: 00007f1309413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f13095e6038 R14: 00007f13095e5fa0 R15: 00007fffdee98b08
</TASK>
Showing all locks held in the system:
4 locks held by kworker/R-netns/7:
#0: ffff888017873938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017873938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc900000c7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc900000c7d20 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffffffff8dfaf8d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x136/0xb90 net/core/net_namespace.c:606
#3: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: wg_netns_pre_exit+0x1c/0x1d0 drivers/net/wireguard/device.c:422
1 lock held by khungtaskd/29:
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
#0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
3 locks held by kworker/u4:2/42:
#0: ffff88802c106938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff88802c106938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90000b2fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90000b2fd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4700
3 locks held by kworker/1:2/1187:
#0: ffff888017871d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017871d38 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90004bdfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90004bdfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x91/0xd70 net/wireless/reg.c:2463
5 locks held by kworker/u5:1/5104:
#0: ffff888048b4bd38 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888048b4bd38 ((wq_completion)hci5){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc90010327d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc90010327d00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffff88802679ce70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1d4/0x390 net/bluetooth/hci_sync.c:326
#3: ffff88802679c0b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1f7/0xdc0 net/bluetooth/hci_sync.c:5658
#4: ffffffff8e129888 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1996 [inline]
#4: ffffffff8e129888 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x165/0x300 net/bluetooth/hci_conn.c:1251
2 locks held by kworker/1:3/5175:
#0: ffff888017872538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888017872538 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc900031c7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc900031c7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
2 locks held by getty/5548:
#0: ffff88802ca070a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
#1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x425/0x1380 drivers/tty/n_tty.c:2217
6 locks held by kworker/u5:2/5787:
#0: ffff888048b51938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#0: ffff888048b51938 ((wq_completion)hci4){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#1: ffffc9000455fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
#1: ffffc9000455fd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
#2: ffff88804a6cce70 (&hdev->req_lock){+.+.}-{3:3}, at: hci_cmd_sync_work+0x1d4/0x390 net/bluetooth/hci_sync.c:326
#3: ffff88804a6cc0b8 (&hdev->lock){+.+.}-{3:3}, at: hci_abort_conn_sync+0x1f7/0xdc0 net/bluetooth/hci_sync.c:5658
#4: ffffffff8e129888 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_connect_cfm include/net/bluetooth/hci_core.h:1996 [inline]
#4: ffffffff8e129888 (hci_cb_list_lock){+.+.}-{3:3}, at: hci_conn_failed+0x165/0x300 net/bluetooth/hci_conn.c:1251
#5: ffff888022807b38 (&conn->lock#2){+.+.}-{3:3}, at: l2cap_conn_del+0x70/0x660 net/bluetooth/l2cap_core.c:1763
2 locks held by kworker/0:3/5790:
2 locks held by kworker/0:5/7025:
1 lock held by syz.4.371/7181:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511
3 locks held by syz.4.371/7183:
2 locks held by syz.6.372/7188:
#0: ffffffff8dfaf8d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x351/0x5e0 net/core/net_namespace.c:516
#1: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x81/0x210 net/ipv4/nexthop.c:3636
2 locks held by syz.1.374/7192:
#0: ffff88804c1fb690 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0xf4/0x810 net/netlink/af_netlink.c:2336
#1: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0x71f/0xde0 net/netlink/af_netlink.c:2263
1 lock held by syz.5.375/7196:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3511
1 lock held by syz-executor/7209:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7212:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7216:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7219:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7243:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7246:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7248:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7251:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/7256:
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
#0: ffffffff8dfbc708 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
2 locks held by dhcpcd/7261:
#0: ffff888046d3c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff888046d3c130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
#1: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:292 [inline]
#1: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x448/0x830 kernel/rcu/tree_exp.h:1004
2 locks held by dhcpcd/7262:
#0: ffff8880229ec130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff8880229ec130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
#1: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:324 [inline]
#1: ffffffff8cd358f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x360/0x830 kernel/rcu/tree_exp.h:1004
1 lock held by dhcpcd/7263:
#0: ffff88804c892130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff88804c892130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
1 lock held by dhcpcd/7264:
#0: ffff8880372b2130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff8880372b2130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
1 lock held by dhcpcd/7265:
#0: ffff88803b956130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
#0: ffff88803b956130 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xcc0 net/packet/af_packet.c:3258
=============================================
NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
<TASK>
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
nmi_cpu_backtrace+0x39b/0x3d0 lib/nmi_backtrace.c:113
nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
watchdog+0xf41/0xf80 kernel/hung_task.c:379
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 7183 Comm: syz.4.371 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:212
Code: 00 0f 0b 0f 1f 80 00 00 00 00 f3 0f 1e fa 53 48 89 fb e8 13 00 00 00 48 8b 3d 5c 05 c5 0c 48 89 de 5b e9 43 9d 56 00 cc cc cc <f3> 0f 1e fa 48 8b 04 24 65 48 8b 0d f0 24 7e 7e 65 8b 15 f1 24 7e
RSP: 0018:ffffc90000006438 EFLAGS: 00000087
RAX: 1ffff1100f602cff RBX: ffffc90000006600 RCX: ffff8880228b1e00
RDX: 0000000000000100 RSI: ffffffff8aaace60 RDI: ffff88807b016a88
RBP: ffffc900000066c8 R08: ffffffff8e4a93ef R09: 1ffffffff1c9527d
R10: dffffc0000000000 R11: fffffbfff1c9527e R12: ffff88807b010618
R13: ffffc900000064c8 R14: ffff8880b8e36910 R15: dffffc0000000000
FS: 00007f22eb41b6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055def952e270 CR3: 0000000046e82000 CR4: 00000000003506f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
perf_tp_event+0x52f/0x13a0 kernel/events/core.c:10332
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10268
perf_trace_preemptirq_template+0x281/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:104 [inline]
RIP: 0010:__local_bh_enable_ip+0x136/0x1c0 kernel/softirq.c:413
Code: 8a e8 be a0 1d 09 65 66 8b 05 86 22 b2 7e 66 85 c0 75 54 bf 01 00 00 00 e8 67 db 09 00 e8 62 60 3a 00 fb 65 8b 05 52 22 b2 7e <85> c0 75 05 e8 31 08 af ff 48 c7 04 24 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc900000068e0 EFLAGS: 00000282
RAX: 0000000000000102 RBX: 0000000000000201 RCX: 379244555a4cae00
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6f80
RBP: ffffc90000006970 R08: ffffffff90da952f R09: 1ffffffff21b52a5
R10: dffffc0000000000 R11: fffffbfff21b52a6 R12: ffffffff8957e7ad
R13: ffffc900035ab090 R14: dffffc0000000000 R15: 1ffff92000000d1c
ebt_do_table+0x259d/0x2750 net/bridge/netfilter/ebtables.c:-1
nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:259 [inline]
NF_HOOK+0x213/0x3d0 include/linux/netfilter.h:302
br_forward_finish+0xd3/0x130 net/bridge/br_forward.c:66
br_nf_hook_thresh net/bridge/br_netfilter_hooks.c:-1 [inline]
br_nf_forward_finish+0xa33/0xe50 net/bridge/br_netfilter_hooks.c:684
NF_HOOK+0x613/0x6a0 include/linux/netfilter.h:304
br_nf_forward_ip+0xcc1/0x1110 net/bridge/br_netfilter_hooks.c:754
nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
nf_hook_slow+0xbd/0x200 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:259 [inline]
NF_HOOK+0x213/0x3d0 include/linux/netfilter.h:302
__br_forward+0x41f/0x600 net/bridge/br_forward.c:115
deliver_clone net/bridge/br_forward.c:131 [inline]
maybe_deliver+0xb5/0x150 net/bridge/br_forward.c:191
br_flood+0x31b/0x680 net/bridge/br_forward.c:237
br_handle_frame_finish+0x143d/0x1950 net/bridge/br_input.c:215
br_nf_hook_thresh+0x3b6/0x480 net/bridge/br_netfilter_hooks.c:1184
br_nf_pre_routing_finish_ipv6+0x9e3/0xd90 net/bridge/br_netfilter_ipv6.c:-1
NF_HOOK include/linux/netfilter.h:304 [inline]
br_nf_pre_routing_ipv6+0x34d/0x680 net/bridge/br_netfilter_ipv6.c:184
nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]
br_handle_frame+0x957/0x14c0 net/bridge/br_input.c:424
__netif_receive_skb_core+0xf6b/0x3ac0 net/core/dev.c:5502
__netif_receive_skb_one_core net/core/dev.c:5606 [inline]
__netif_receive_skb+0x74/0x290 net/core/dev.c:5722
process_backlog+0x380/0x6e0 net/core/dev.c:6050
__napi_poll+0xc0/0x460 net/core/dev.c:6612
napi_poll net/core/dev.c:6679 [inline]
net_rx_action+0x5ea/0xbf0 net/core/dev.c:6815
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 ca 2b 13 f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> a2 a6 e2 f6 65 8b 05 93 ed 8a 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc90004c96fe0 EFLAGS: 00000206
RAX: 379244555a4cae00 RBX: 0000000000000a06 RCX: 379244555a4cae00
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc90004c97078 R08: ffffffff90da952f R09: 1ffffffff21b52a5
R10: dffffc0000000000 R11: fffffbfff21b52a6 R12: dffffc0000000000
R13: ffff88806f045f00 R14: ffffffff970fbae8 R15: 1ffff92000992dfc
__debug_check_no_obj_freed lib/debugobjects.c:999 [inline]
debug_check_no_obj_freed+0x51f/0x540 lib/debugobjects.c:1020
slab_free_hook mm/slub.c:1786 [inline]
slab_free_freelist_hook+0xd2/0x1b0 mm/slub.c:1837
slab_free mm/slub.c:3830 [inline]
kmem_cache_free+0xf8/0x280 mm/slub.c:3852
mmdrop include/linux/sched/mm.h:54 [inline]
mmdrop_sched include/linux/sched/mm.h:82 [inline]
mmdrop_lazy_tlb_sched include/linux/sched/mm.h:109 [inline]
finish_task_switch+0x3e0/0x920 kernel/sched/core.c:5279
context_switch kernel/sched/core.c:5383 [inline]
__schedule+0x14da/0x44d0 kernel/sched/core.c:6699
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6866
preempt_schedule+0xab/0xc0 kernel/sched/core.c:6890
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0xfa/0x110 kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__slab_free+0x353/0x410 mm/slub.c:3734
qlink_free mm/kasan/quarantine.c:166 [inline]
qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
____kasan_kmalloc mm/kasan/common.c:340 [inline]
__kasan_kmalloc+0x22/0xa0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc_node+0xb4/0x230 mm/slab_common.c:1014
kmalloc_node include/linux/slab.h:620 [inline]
kvmalloc_node+0x70/0x180 mm/util.c:617
kvmalloc include/linux/slab.h:738 [inline]
kvmalloc_array include/linux/slab.h:756 [inline]
__ptr_ring_init_queue_alloc include/linux/ptr_ring.h:471 [inline]
ptr_ring_init include/linux/ptr_ring.h:489 [inline]
skb_array_init include/linux/skb_array.h:182 [inline]
pfifo_fast_init+0x10d/0x6a0 net/sched/sch_generic.c:870
qdisc_create_dflt+0x11e/0x430 net/sched/sch_generic.c:1019
mq_init+0x2e3/0x660 net/sched/sch_mq.c:90
qdisc_create_dflt+0x11e/0x430 net/sched/sch_generic.c:1019
attach_default_qdiscs net/sched/sch_generic.c:1199 [inline]
dev_activate+0x1d0/0x11a0 net/sched/sch_generic.c:1253
__dev_open+0x338/0x430 net/core/dev.c:1515
__dev_change_flags+0x20e/0x6a0 net/core/dev.c:8685
dev_change_flags+0x88/0x1a0 net/core/dev.c:8757
dev_ifsioc+0x6a7/0xe20 net/core/dev_ioctl.c:529
dev_ioctl+0x7e2/0x1170 net/core/dev_ioctl.c:786
sock_do_ioctl+0x226/0x2f0 net/socket.c:1236
sock_ioctl+0x623/0x7a0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f22ea58f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f22eb41b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f22ea7e5fa0 RCX: 00007f22ea58f749
RDX: 0000200000000000 RSI: 0000000000008914 RDI: 0000000000000010
RBP: 00007f22ea613f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f22ea7e6038 R14: 00007f22ea7e5fa0 R15: 00007ffc0012f7a8
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages