[v6.1] INFO: task hung in tracing_open_file_tr

0 views

Skip to first unread message

syzbot

unread,

Aug 14, 2026, 4:56:42 PM (2 days ago) Aug 14

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: e4f7d8be268e Linux 6.1.182
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=154e4a25580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31dfefc4a14efea3
dashboard link: https://syzkaller.appspot.com/bug?extid=f16c07a111bd5b958c12
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/156843a60452/disk-e4f7d8be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/719d532a0151/vmlinux-e4f7d8be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/12160bc2f9ec/bzImage-e4f7d8be.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f16c07...@syzkaller.appspotmail.com

INFO: task syz.1.1829:11097 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.1829 state:D stack:27920 pid:11097 ppid:8213 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747
trace_array_get kernel/trace/trace.c:461 [inline]
tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
tracing_open_file_tr+0xab/0x2f0 kernel/trace/trace.c:4892
do_dentry_open+0x7dd/0x10b0 fs/open.c:882
do_open fs/namei.c:3634 [inline]
path_openat+0x2674/0x2f10 fs/namei.c:3791
do_filp_open+0x1ee/0x420 fs/namei.c:3818
do_sys_openat2+0x14b/0x4f0 fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1347
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f6b7419e0d9
RSP: 002b:00007f6b75104028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f6b74426090 RCX: 00007f6b7419e0d9
RDX: 0000000000000001 RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007f6b74235024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6b74426128 R14: 00007f6b74426090 R15: 00007fff5470fe48
</TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8cb2e4f0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffffffff8cb2ed10 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/28:
#0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6527
2 locks held by getty/4031:
#0: ffff88803030f098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
#1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 drivers/tty/n_tty.c:2198
3 locks held by kworker/1:4/4328:
#0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90004627d00 (set_printk_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8cb82e28 (event_mutex){+.+.}-{3:3}, at: __ftrace_set_clr_event kernel/trace/trace_events.c:1219 [inline]
#2: ffffffff8cb82e28 (event_mutex){+.+.}-{3:3}, at: trace_set_clr_event+0xbe/0x130 kernel/trace/trace_events.c:1285
3 locks held by kworker/u4:7/4339:
4 locks held by syz.1.1829/11094:
1 lock held by syz.1.1829/11097:
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:461 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_open_file_tr+0xab/0x2f0 kernel/trace/trace.c:4892
1 lock held by syz-executor/11355:
#0: ffffffff8cb33838 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:291 [inline]
#0: ffffffff8cb33838 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2ec/0x890 kernel/rcu/tree_exp.h:962
1 lock held by syz.5.1984/11695:
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:461 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_open_file_tr+0xab/0x2f0 kernel/trace/trace.c:4892
4 locks held by syz.5.1984/11696:
#0: ffff88807d6b7768 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0x2ae/0x360 fs/file.c:1038
#1: ffff888142e94460 (sb_writers#14){.+.+}-{0:0}, at: vfs_write+0x270/0x9a0 fs/read_write.c:580
#2: ffffffff8cb95928 (dyn_event_ops_mutex){+.+.}-{3:3}, at: dyn_event_create+0x1c/0x60 kernel/trace/trace_dynevent.c:136
#3: ffffffff8cb82e28 (event_mutex){+.+.}-{3:3}, at: register_trace_uprobe+0x2e/0x12f0 kernel/trace/trace_uprobe.c:498
1 lock held by syz.7.2022/11882:
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:461 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_open_generic_tr kernel/trace/trace.c:4874 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_mark_open+0x8a/0x190 kernel/trace/trace.c:4934
3 locks held by kworker/1:5/12931:
1 lock held by syz.2.2519/13621:
2 locks held by syz.6.2523/13635:
1 lock held by syz.9.2525/13638:
1 lock held by sed/13640:

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0xf0e/0xf50 kernel/hung_task.c:377
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 3620 Comm: syslogd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:102 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:128 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:159 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x8a/0x290 mm/kasan/generic.c:189
Code: 1c 21 49 89 df 4d 29 df 49 83 ff 10 7f 29 4d 85 ff 0f 84 38 01 00 00 4c 89 cb 48 f7 d3 4c 01 f3 41 80 3b 00 0f 85 86 01 00 00 <49> ff c3 48 ff c3 75 ee e9 18 01 00 00 44 89 dd 83 e5 07 0f 84 b5
RSP: 0018:ffffc90003267d30 EFLAGS: 00000246
RAX: ffffffff81aaa501 RBX: fffffffffffffffe RCX: ffffffff81aaa539
RDX: 0000000000000001 RSI: 0000000000000020 RDI: ffffc90003267e00
RBP: 0000000000000000 R08: ffffc90003267e1f R09: 1ffff9200064cfc3
R10: dffffc0000000000 R11: fffff5200064cfc2 R12: dffffc0000000001
R13: dffffc0000000000 R14: 1ffff9200064cfc0 R15: 0000000000000004
FS: 00007fb1e97c5c80(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2d07e5f498 CR3: 000000007e788000 CR4: 00000000003506e0
Call Trace:
<TASK>
memset+0x1e/0x40 mm/kasan/shadow.c:44
rseq_get_rseq_cs kernel/rseq.c:160 [inline]
rseq_ip_fixup kernel/rseq.c:274 [inline]
__rseq_handle_notify_resume+0x409/0x11e0 kernel/rseq.c:322
rseq_handle_notify_resume include/linux/sched.h:2341 [inline]
resume_user_mode_work include/linux/resume_user_mode.h:61 [inline]
exit_to_user_mode_loop+0xbc/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fb1e9915407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffd8ecaf110 EFLAGS: 00000202 ORIG_RAX: 0000000000000000
RAX: 0000000000000058 RBX: 00007fb1e97c5c80 RCX: 00007fb1e9915407
RDX: 00000000000000ff RSI: 000056438fdf8950 RDI: 0000000000000000
RBP: 000056438fdf8910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000056438fdf89a2
R13: 0000000000000000 R14: 000056438fdf8950 R15: 0000564354044d98
</TASK>

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,

Aug 15, 2026, 9:11:36 PM (2 days ago) Aug 15

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: e4f7d8be268e Linux 6.1.182
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=14bee949580000

kernel config: https://syzkaller.appspot.com/x/.config?x=31dfefc4a14efea3
dashboard link: https://syzkaller.appspot.com/bug?extid=f16c07a111bd5b958c12
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1444c6c6580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/156843a60452/disk-e4f7d8be.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/719d532a0151/vmlinux-e4f7d8be.xz
kernel image: https://storage.googleapis.com/syzbot-assets/12160bc2f9ec/bzImage-e4f7d8be.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+f16c07...@syzkaller.appspotmail.com

INFO: task syz.3.20:4519 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.3.20 state:D stack:26736 pid:4519 ppid:4422 flags:0x00004004

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747
trace_array_get kernel/trace/trace.c:461 [inline]
tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
tracing_open_file_tr+0xab/0x2f0 kernel/trace/trace.c:4892
do_dentry_open+0x7dd/0x10b0 fs/open.c:882
do_open fs/namei.c:3634 [inline]
path_openat+0x2674/0x2f10 fs/namei.c:3791
do_filp_open+0x1ee/0x420 fs/namei.c:3818
do_sys_openat2+0x14b/0x4f0 fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1347
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2

RIP: 0033:0x7f3611b9e0d9
RSP: 002b:00007ffe1558a4c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f3611e25fa0 RCX: 00007f3611b9e0d9
RDX: 0000000000000101 RSI: 0000200000000400 RDI: ffffffffffffff9c
RBP: 00007f3611c35024 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f3611e25fac R14: 00007f3611e25fa0 R15: 00007f3611e25fa0
</TASK>
INFO: task syz.2.19:4520 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.2.19 state:D stack:25864 pid:4520 ppid:4419 flags:0x00004004

RIP: 0033:0x7f44aa19e0d9
RSP: 002b:00007fffe0e54628 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f44aa425fa0 RCX: 00007f44aa19e0d9
RDX: 0000000000000101 RSI: 0000200000000400 RDI: ffffffffffffff9c
RBP: 00007f44aa235024 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f44aa425fac R14: 00007f44aa425fa0 R15: 00007f44aa425fa0
</TASK>
INFO: task syz.1.18:4521 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.1.18 state:D stack:26736 pid:4521 ppid:4412 flags:0x00004004

RIP: 0033:0x7f985979e0d9
RSP: 002b:00007ffe09eed768 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f9859a25fa0 RCX: 00007f985979e0d9
RDX: 0000000000000101 RSI: 0000200000000400 RDI: ffffffffffffff9c
RBP: 00007f9859835024 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f9859a25fac R14: 00007f9859a25fa0 R15: 00007f9859a25fa0
</TASK>
INFO: task syz.4.21:4522 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.4.21 state:D stack:26688 pid:4522 ppid:4424 flags:0x00004004

RIP: 0033:0x7f900b79e0d9
RSP: 002b:00007ffc7c9e26e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f900ba25fa0 RCX: 00007f900b79e0d9
RDX: 0000000000000101 RSI: 0000200000000400 RDI: ffffffffffffff9c
RBP: 00007f900b835024 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f900ba25fac R14: 00007f900ba25fa0 R15: 00007f900ba25fa0

</TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8cb2e4f0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0: ffffffff8cb2ed10 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517

3 locks held by kworker/0:1/14:

#0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267

#1: ffffc90000137d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffff88805a197240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x283/0x3320 drivers/net/netdevsim/fib.c:1491
1 lock held by khungtaskd/27:

#0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#0: ffffffff8cb2db60 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6527

3 locks held by kworker/u4:4/76:
2 locks held by getty/4027:
#0: ffff88814d22c098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244

#1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 drivers/tty/n_tty.c:2198

3 locks held by kworker/1:17/4388:

#0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267

#1: ffffc90004277d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffff888027d8d240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x283/0x3320 drivers/net/netdevsim/fib.c:1491
3 locks held by kworker/0:8/4459:
#0: ffff88802f087538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90003427d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd5b968 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1500 net/ipv6/addrconf.c:4138
9 locks held by syz.0.17/4518:
1 lock held by syz.3.20/4519:

#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:461 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
#0: ffffffff8cb77748 (trace_types_lock){+.+.}-{3:3}, at: tracing_open_file_tr+0xab/0x2f0 kernel/trace/trace.c:4892

1 lock held by syz.2.19/4520:

1 lock held by syz.1.18/4521:

1 lock held by syz.4.21/4522:

1 lock held by syz.5.22/4582:

1 lock held by syz.7.24/4623:

1 lock held by syz.8.25/4624:

1 lock held by syz.6.23/4625:

1 lock held by syz.9.26/4626:

1 lock held by syz.1.28/4700:

1 lock held by syz.3.33/4731:

1 lock held by syz.2.32/4733:

1 lock held by syz.4.34/4734:

1 lock held by syz.5.65/4770:

1 lock held by syz.7.80/4837:

1 lock held by syz.6.82/4867:

1 lock held by syz.8.84/4868:

1 lock held by syz.9.98/4894:

3 locks held by syz-executor/4913:
#0: ffffffff8ddbc170 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860
#1: ffffffff8ddbbf88 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
#1: ffffffff8ddbbf88 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x107/0x790 net/netlink/genetlink.c:848
#2: ffffffff8dd5b968 (rtnl_mutex){+.+.}-{3:3}, at: ieee80211_register_hw+0x28a0/0x39f0 net/mac80211/main.c:1335
2 locks held by syz-executor/4917:
#0: ffffffff8ddbc170 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:860
#1: ffffffff8dd5b968 (rtnl_mutex){+.+.}-{3:3}, at: nl80211_pre_doit+0x5a/0x890 net/wireless/nl80211.c:16372
1 lock held by syz.1.118/4921:

7 locks held by syz-executor/4939:
4 locks held by syz.0.148/4961:
1 lock held by syz-executor/4963:
#0: ffffffff8dd5b968 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5b968 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163

=============================================

NMI backtrace for cpu 0

CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0xf0e/0xf50 kernel/hung_task.c:377
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1

CPU: 1 PID: 4518 Comm: syz.0.17 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026

RIP: 0010:unwind_next_frame+0x97/0x1fd0 arch/x86/kernel/unwind_orc.c:436
Code: 85 c0 0f 84 24 17 00 00 89 44 24 64 48 89 6c 24 40 4c 89 6c 24 68 4c 89 64 24 48 4c 89 7c 24 10 bf 01 00 00 00 e8 09 c1 1f 00 <4c> 8d 7b 50 4c 89 f8 48 c1 e8 03 48 89 44 24 30 42 80 3c 30 00 74
RSP: 0018:ffffc900001dfe60 EFLAGS: 00000202
RAX: 0000000000000303 RBX: ffffc900001dff08 RCX: ffffffff96c17103
RDX: dffffc0000000000 RSI: ffffffff8187b988 RDI: 0000000000000001
RBP: 1ffff9200003bfe8 R08: ffffc900001dffd0 R09: 000000000000001b
R10: dffffc0000000000 R11: fffff5200003bfed R12: ffffffff8187b988
R13: ffffc900034d7d60 R14: dffffc0000000000 R15: 1ffff9200003bfe1
FS: 000055557f9c3500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007f7e34b58060 CR3: 000000007c8a0000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
__kasan_slab_alloc+0x6b/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x4b/0x490 mm/slab.h:737
slab_alloc_node mm/slub.c:3359 [inline]
slab_alloc mm/slub.c:3367 [inline]
__kmem_cache_alloc_lru mm/slub.c:3374 [inline]
kmem_cache_alloc+0x18b/0x2f0 mm/slub.c:3383
kmem_cache_zalloc include/linux/slab.h:689 [inline]
fill_pool lib/debugobjects.c:169 [inline]
debug_objects_fill_pool+0x40a/0x780 lib/debugobjects.c:654
debug_object_activate+0x32/0x4f0 lib/debugobjects.c:743
debug_rcu_head_queue kernel/rcu/rcu.h:190 [inline]
kvfree_call_rcu+0xae/0x890 kernel/rcu/tree.c:3396
neigh_del net/core/neighbour.c:226 [inline]
neigh_remove_one+0x5ed/0x700 net/core/neighbour.c:247
neigh_forced_gc net/core/neighbour.c:280 [inline]
neigh_alloc net/core/neighbour.c:486 [inline]
___neigh_create+0x487/0x2450 net/core/neighbour.c:649
ip6_finish_output2+0x150e/0x15c0 net/ipv6/ip6_output.c:129
dst_output include/net/dst.h:453 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ndisc_send_skb+0xc04/0x1520 net/ipv6/ndisc.c:513
addrconf_rs_timer+0x367/0x640 net/ipv6/addrconf.c:3986
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x56c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:console_emit_next_record+0x92f/0xb50 kernel/printk/printk.c:2786
Code: 0f 85 af 00 00 00 e8 80 ab 1a 00 0f b6 5c 24 0f 4d 85 f6 75 07 e8 71 ab 1a 00 eb 06 e8 6a ab 1a 00 fb 66 43 c7 44 2f 24 f8 f8 <43> c6 44 2f 26 f8 48 b8 f8 f2 f2 f2 f8 f8 f8 f8 48 05 00 06 06 06
RSP: 0018:ffffc900034d7800 EFLAGS: 00000293
RAX: ffffffff816782b6 RBX: 0000000000000001 RCX: ffff88807b185a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900034d7a20 R08: ffffffff90b10247 R09: 1ffffffff2162048
R10: dffffc0000000000 R11: fffffbfff2162049 R12: 1ffff9200069af4b
R13: dffffc0000000000 R14: 0000000000000200 R15: 1ffff9200069af0c
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x223/0x630 kernel/printk/printk.c:2906
vprintk_emit+0x4b3/0x6a0 kernel/printk/printk.c:2303
_printk+0xda/0x130 kernel/printk/printk.c:2328
__trace_add_event_dirs kernel/trace/trace_events.c:3202 [inline]
event_trace_add_tracer+0x2a3/0x3a0 kernel/trace/trace_events.c:3799
trace_array_create_dir+0x77/0x120 kernel/trace/trace.c:9431
trace_array_create+0x724/0xcb0 kernel/trace/trace.c:9489
instance_mkdir+0xc8/0x120 kernel/trace/trace.c:9524
tracefs_syscall_mkdir+0xb7/0x110 fs/tracefs/inode.c:87
vfs_mkdir+0x386/0x570 fs/namei.c:4114
do_mkdirat+0x1d8/0x440 fs/namei.c:4139
__do_sys_mkdirat fs/namei.c:4154 [inline]
__se_sys_mkdirat fs/namei.c:4152 [inline]
__x64_sys_mkdirat+0x85/0x90 fs/namei.c:4152

do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2

RIP: 0033:0x7fcf5499e0d9
Code: Unable to access opcode bytes at 0x7fcf5499e0af.
RSP: 002b:00007ffe26787d08 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fcf54c25fa0 RCX: 00007fcf5499e0d9
RDX: 00000000000001ff RSI: 0000200000000100 RDI: ffffffffffffff9c
RBP: 00007fcf54a35024 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fcf54c25fac R14: 00007fcf54c25fa0 R15: 00007fcf54c25fa0
</TASK>

---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Reply all

Reply to author

Forward

0 new messages