[v6.1] INFO: task hung in tracing_buffers_open

12 views

Skip to first unread message

syzbot

unread,

Sep 12, 2026, 6:37:27 AMSep 12

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: cf82dcca9634 Linux 6.1.187
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=145461f9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=31dfefc4a14efea3
dashboard link: https://syzkaller.appspot.com/bug?extid=93e81fe89ac91978a615
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/97e1e40b968b/disk-cf82dcca.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cfec27562c15/vmlinux-cf82dcca.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4c7cd066c46d/bzImage-cf82dcca.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+93e81f...@syzkaller.appspotmail.com

INFO: task syz.4.694:6762 blocked for more than 143 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.694 state:D stack:27920 pid:6762 ppid:6010 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747
trace_array_get kernel/trace/trace.c:461 [inline]
tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8161
do_dentry_open+0x7dd/0x10b0 fs/open.c:882
do_open fs/namei.c:3677 [inline]
path_openat+0x2674/0x2f10 fs/namei.c:3834
do_filp_open+0x1ee/0x420 fs/namei.c:3861
do_sys_openat2+0x14b/0x4f0 fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1347
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f6d3459e159
RSP: 002b:00007f6d3552f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f6d34825fa0 RCX: 00007f6d3459e159
RDX: 0000000000040880 RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007f6d3463503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6d34826038 R14: 00007f6d34825fa0 R15: 00007ffd8735b058
</TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8cb2e5b0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0:
ffffffff8cb2edd0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by khungtaskd/27:
#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6527
2 locks held by getty/4031:
#0: ffff88807f7f0098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
#1: ffffc9000327b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x41e/0x1360 drivers/tty/n_tty.c:2198
3 locks held by kworker/1:3/4262:
#0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90003d37d00 (set_printk_work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8cb82ee8 (event_mutex){+.+.}-{3:3}, at: __ftrace_set_clr_event kernel/trace/trace_events.c:1219 [inline]
#2: ffffffff8cb82ee8 (event_mutex){+.+.}-{3:3}, at: trace_set_clr_event+0xbe/0x130 kernel/trace/trace_events.c:1285
3 locks held by kworker/0:5/4321:
#0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc900047b7d00 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
#2: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962
4 locks held by syz.6.674/6685:
1 lock held by syz.4.694/6762:
#0: ffffffff8cb77808 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:461 [inline]
#0: ffffffff8cb77808 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
#0: ffffffff8cb77808 (trace_types_lock){+.+.}-{3:3}, at: tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8161
3 locks held by kworker/u4:19/9580:
#0: ffff8880b8e3acd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x130 kernel/sched/core.c:538
#1: ffff8880b8e27888 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x400/0x740 kernel/sched/psi.c:999
#2: ffff8880b8e28458 (&base->lock){-.-.}-{2:2}, at: __mod_timer+0x6c1/0xd20 kernel/time/timer.c:1112
1 lock held by dhcpcd/10221:
#0: ffff888054a93e10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:764 [inline]
#0: ffff888054a93e10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:653 [inline]
#0: ffff888054a93e10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x82/0x210 net/socket.c:1400

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0xf0e/0xf50 kernel/hung_task.c:377
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6685 Comm: syz.6.674 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4744 [inline]
RIP: 0010:__lock_acquire+0x705/0x7c40 kernel/locking/lockdep.c:5013
Code: 44 89 fb 81 e3 ff ff ff 7f 83 f8 31 73 46 48 8d 04 9b 49 8d 9c c5 00 0b 00 00 48 89 d8 48 c1 e8 03 42 0f b6 04 00 84 c0 75 45 <8b> 1b 48 8b 44 24 40 42 0f b6 04 00 84 c0 75 55 48 8b 44 24 08 33
RSP: 0018:ffffc900000078e0 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffff8880796e0ba0 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90b13240
RBP: ffffc90000007b10 R08: dffffc0000000000 R09: 1ffffffff2162648
R10: dffffc0000000000 R11: fffffbfff2162649 R12: 0000000000000000
R13: ffff8880796e0000 R14: 0000000000000006 R15: 0000000000000004
FS: 00007fbec92556c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055b1bd9a1950 CR3: 00000000597ed000 CR4: 00000000003506f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002
DR3: ffffffffefffff15 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162
debug_object_deactivate+0x63/0x380 lib/debugobjects.c:810
debug_hrtimer_deactivate kernel/time/hrtimer.c:453 [inline]
__run_hrtimer kernel/time/hrtimer.c:1719 [inline]
__hrtimer_run_queues+0x2d8/0xc90 kernel/time/hrtimer.c:1815
hrtimer_interrupt+0x399/0x980 kernel/time/hrtimer.c:1877
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline]
__sysvec_apic_timer_interrupt+0x153/0x5a0 arch/x86/kernel/apic/apic.c:1124
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:1948 [inline]
RIP: 0010:vprintk_emit+0x48b/0x6a0 kernel/printk/printk.c:2302
Code: 86 01 00 00 e8 a6 0d 1b 00 41 89 df 4d 85 f6 48 8b 5c 24 08 75 07 e8 94 0d 1b 00 eb 06 e8 8d 0d 1b 00 fb 48 c7 c7 e0 1e b2 8c <31> f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00 45 31 c9 53 e8 fd d4
RSP: 0018:ffffc9000496faa0 EFLAGS: 00000246
RAX: ffffffff81673403 RBX: ffffffff81673295 RCX: 0000000000080000
RDX: ffffc9000de51000 RSI: 000000000007ffff RDI: ffffffff8cb21ee0
RBP: ffffc9000496fb90 R08: ffffffff90b13247 R09: 1ffffffff2162648
R10: dffffc0000000000 R11: fffffbfff2162649 R12: dffffc0000000000
R13: 1ffff9200092df58 R14: 0000000000000200 R15: 0000000000000034
_printk+0xda/0x130 kernel/printk/printk.c:2328
__trace_add_event_dirs kernel/trace/trace_events.c:3204 [inline]
event_trace_add_tracer+0x2a3/0x3a0 kernel/trace/trace_events.c:3801
trace_array_create_dir+0x77/0x120 kernel/trace/trace.c:9431
trace_array_create+0x724/0xcb0 kernel/trace/trace.c:9489
instance_mkdir+0xc8/0x120 kernel/trace/trace.c:9524
tracefs_syscall_mkdir+0xb7/0x110 fs/tracefs/inode.c:87
vfs_mkdir+0x386/0x570 fs/namei.c:4157
do_mkdirat+0x1d8/0x440 fs/namei.c:4182
__do_sys_mkdirat fs/namei.c:4197 [inline]
__se_sys_mkdirat fs/namei.c:4195 [inline]
__x64_sys_mkdirat+0x85/0x90 fs/namei.c:4195
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fbec839e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbec9255028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fbec8625fa0 RCX: 00007fbec839e159
RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007fbec843503b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbec8626038 R14: 00007fbec8625fa0 R15: 00007ffc1bc9f678
</TASK>

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,

Sep 14, 2026, 6:02:26 AMSep 14

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: cf82dcca9634 Linux 6.1.187
git tree: linux-6.1.y

console output: https://syzkaller.appspot.com/x/log.txt?x=129c88c9580000

kernel config: https://syzkaller.appspot.com/x/.config?x=31dfefc4a14efea3
dashboard link: https://syzkaller.appspot.com/bug?extid=93e81fe89ac91978a615
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16952df9580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/97e1e40b968b/disk-cf82dcca.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cfec27562c15/vmlinux-cf82dcca.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4c7cd066c46d/bzImage-cf82dcca.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+93e81f...@syzkaller.appspotmail.com

INFO: task syz.0.17:4473 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:26720 pid:4473 ppid:4401 flags:0x00004004

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5246 [inline]
__schedule+0x107f/0x4030 kernel/sched/core.c:6563
schedule+0xb9/0x180 kernel/sched/core.c:6639
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6698
__mutex_lock_common kernel/locking/mutex.c:679 [inline]
__mutex_lock+0x548/0xae0 kernel/locking/mutex.c:747
trace_array_get kernel/trace/trace.c:461 [inline]
tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8161
do_dentry_open+0x7dd/0x10b0 fs/open.c:882
do_open fs/namei.c:3677 [inline]
path_openat+0x2674/0x2f10 fs/namei.c:3834
do_filp_open+0x1ee/0x420 fs/namei.c:3861
do_sys_openat2+0x14b/0x4f0 fs/open.c:1320
do_sys_open fs/open.c:1336 [inline]
__do_sys_openat fs/open.c:1352 [inline]
__se_sys_openat fs/open.c:1347 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1347
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2

RIP: 0033:0x7f67b299e159
RSP: 002b:00007ffd5d746148 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f67b2c25fa0 RCX: 00007f67b299e159

RDX: 0000000000040880 RSI: 0000200000000140 RDI: ffffffffffffff9c

RBP: 00007f67b2a3503b R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f67b2c25fac R14: 00007f67b2c25fa0 R15: 00007f67b2c25fa0
</TASK>
INFO: task syz.3.20:4475 blocked for more than 144 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.3.20 state:D stack:26736 pid:4475 ppid:4412 flags:0x00004004

RIP: 0033:0x7f15a399e159
RSP: 002b:00007fff9d54fc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f15a3c25fa0 RCX: 00007f15a399e159

RDX: 0000000000040880 RSI: 0000200000000140 RDI: ffffffffffffff9c

RBP: 00007f15a3a3503b R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f15a3c25fac R14: 00007f15a3c25fa0 R15: 00007f15a3c25fa0
</TASK>
INFO: task syz.2.19:4501 blocked for more than 145 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.2.19 state:D stack:26736 pid:4501 ppid:4407 flags:0x00004004

RIP: 0033:0x7fedd739e159
RSP: 002b:00007ffe38943b38 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fedd7625fa0 RCX: 00007fedd739e159

RDX: 0000000000040880 RSI: 0000200000000140 RDI: ffffffffffffff9c

RBP: 00007fedd743503b R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fedd7625fac R14: 00007fedd7625fa0 R15: 00007fedd7625fa0

</TASK>

Showing all locks held in the system:
1 lock held by rcu_tasks_kthre/12:
#0: ffffffff8cb2e5b0 (rcu_tasks.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517
1 lock held by rcu_tasks_trace/13:
#0:
ffffffff8cb2edd0 (rcu_tasks_trace.tasks_gp_mutex){+.+.}-{3:3}, at: rcu_tasks_one_gp+0x33/0xef0 kernel/rcu/tasks.h:517

3 locks held by kworker/1:0/22:
#0: ffff88802ebb2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc900001c7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1500 net/ipv6/addrconf.c:4138
1 lock held by khungtaskd/28:

#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:791 [inline]
#0: ffffffff8cb2dc20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x51/0x290 kernel/locking/lockdep.c:6527

2 locks held by kworker/u4:3/47:
1 lock held by dhcpcd/3932:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: __netlink_dump_start+0x11e/0x6f0 net/netlink/af_netlink.c:2310
2 locks held by getty/4034:
#0: ffff88807f048098 (

&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:244
#1:
ffffc9000327b2f0
(&ldata->atomic_read_lock
){+.+.}-{3:3}
, at: n_tty_read+0x41e/0x1360 drivers/tty/n_tty.c:2198

3 locks held by kworker/0:3/4352:
#0:
ffff88802ebb2138
(
(wq_completion)ipv6_addrconf

){+.+.}-{0:0}
, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267

#1: ffffc90004127d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1500 net/ipv6/addrconf.c:4138
3 locks held by kworker/u4:7/4356:
#0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc90004167d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#2: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:263
2 locks held by kworker/1:12/4457:
#0:
ffff888017472138
((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
#1: ffffc900038c7d00 ((work_completion)(&rew->rew_work)){+.+.}-{0:0}, at: process_one_work+0x7b4/0x1160 kernel/workqueue.c:2267
7 locks held by syz.1.18/4463:
1 lock held by syz.0.17/4473:

#0: ffffffff8cb77808 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:461 [inline]
#0: ffffffff8cb77808 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]
#0: ffffffff8cb77808 (trace_types_lock){+.+.}-{3:3}, at: tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8161

1 lock held by syz.3.20/4475:

1 lock held by syz.2.19/4501:

1 lock held by syz.4.21/4504:

1 lock held by syz.5.22/4546:

1 lock held by syz.6.23/4583:

1 lock held by syz.7.24/4585:
#0: ffffffff8cb77808 (trace_types_lock

){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:461 [inline]

){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:511 [inline]

){+.+.}-{3:3}, at: tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8161

1 lock held by syz.8.25/4607:

1 lock held by syz.9.26/4608:

1 lock held by syz-executor/4610:
#0: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
#0: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962
1 lock held by syz.0.28/4680:

1 lock held by syz.3.32/4685:

1 lock held by syz.4.40/4709:

1 lock held by syz.2.38/4710:

1 lock held by syz.5.64/4758:

3 locks held by kworker/u4:8/4793:
1 lock held by syz.6.71/4794:

1 lock held by syz.8.82/4846:

1 lock held by syz.7.81/4847:

1 lock held by syz.0.104/4878:

1 lock held by syz.9.98/4880:

1 lock held by syz-executor/4921:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
3 locks held by syz-executor/4923:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163
#1: ffff888076abd3e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x223/0x420 drivers/net/wireguard/device.c:49

#2: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:323 [inline]
#2: ffffffff8cb338f8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3c0/0x890 kernel/rcu/tree_exp.h:962

1 lock held by syz.3.123/4936:

1 lock held by syz.2.124/4939:

2 locks held by syz-executor/4979:
#0: ffffffff8dd4fa90 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x324/0x5b0 net/core/net_namespace.c:504
#1: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_init_net+0x29c/0x7a0 net/ipv4/ip_tunnel.c:1103
1 lock held by syz-executor/4983:
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:74 [inline]
#0: ffffffff8dd5c928 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x80d/0xfb0 net/core/rtnetlink.c:6163

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 28 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026

Call Trace:
<TASK>
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
nmi_cpu_backtrace+0x3e6/0x460 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x1d4/0x450 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:220 [inline]
watchdog+0xf0e/0xf50 kernel/hung_task.c:377
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>

Sending NMI from CPU 0 to CPUs 1:

NMI backtrace for cpu 1

CPU: 1 PID: 4463 Comm: syz.1.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/08/2026
RIP: 0010:io_serial_out+0x78/0xb0 drivers/tty/serial/8250/8250_port.c:468
Code: fc fa fc 44 89 f9 d3 e5 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 e0 39 4c fd 41 03 2e 89 d8 89 ea ee <5b> 41 5c 41 5e 41 5f 5d c3 44 89 f9 80 e1 07 38 c1 7c aa 4c 89 ff
RSP: 0018:ffffc90003877590 EFLAGS: 00000002
RAX: 000000000000005b RBX: 000000000000005b RCX: 0000000000000000
RDX: 00000000000003f8 RSI: 0000000000000000 RDI: 0000000000000020
RBP: 00000000000003f8 R08: ffff8880234e0237 R09: 1ffff1100469c046
R10: dffffc0000000000 R11: ffffed100469c047 R12: dffffc0000000000
R13: ffffffff96c5ce01 R14: ffffffff96fa15e0 R15: 0000000000000000
FS: 0000555558b79500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007ffd4b69ded0 CR3: 00000000267e7000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
serial_out drivers/tty/serial/8250/8250.h:122 [inline]
serial8250_console_fifo_write drivers/tty/serial/8250/8250_port.c:-1 [inline]
serial8250_console_write+0x11ed/0x18b0 drivers/tty/serial/8250/8250_port.c:3479
call_console_driver kernel/printk/printk.c:1977 [inline]
console_emit_next_record+0x795/0xb50 kernel/printk/printk.c:2777
console_flush_all kernel/printk/printk.c:-1 [inline]
console_unlock+0x223/0x630 kernel/printk/printk.c:2906
vprintk_emit+0x4b3/0x6a0 kernel/printk/printk.c:2303
_printk+0xda/0x130 kernel/printk/printk.c:2328
event_subsystem_dir kernel/trace/trace_events.c:2490 [inline]
event_create_dir+0xbfe/0xe50 kernel/trace/trace_events.c:2582
__trace_add_new_event kernel/trace/trace_events.c:2988 [inline]
__trace_add_event_dirs kernel/trace/trace_events.c:3202 [inline]
event_trace_add_tracer+0x19b/0x3a0 kernel/trace/trace_events.c:3801

trace_array_create_dir+0x77/0x120 kernel/trace/trace.c:9431
trace_array_create+0x724/0xcb0 kernel/trace/trace.c:9489
instance_mkdir+0xc8/0x120 kernel/trace/trace.c:9524
tracefs_syscall_mkdir+0xb7/0x110 fs/tracefs/inode.c:87
vfs_mkdir+0x386/0x570 fs/namei.c:4157
do_mkdirat+0x1d8/0x440 fs/namei.c:4182
__do_sys_mkdirat fs/namei.c:4197 [inline]
__se_sys_mkdirat fs/namei.c:4195 [inline]
__x64_sys_mkdirat+0x85/0x90 fs/namei.c:4195
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2

RIP: 0033:0x7fa1e499e159
Code: Unable to access opcode bytes at 0x7fa1e499e12f.
RSP: 002b:00007ffe4042cf68 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fa1e4c25fa0 RCX: 00007fa1e499e159

RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c

RBP: 00007fa1e4a3503b R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fa1e4c25fac R14: 00007fa1e4c25fa0 R15: 00007fa1e4c25fa0
</TASK>

---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

syzbot

unread,

Sep 19, 2026, 4:28:30 PMSep 19

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: 0248c33e835e Linux 5.15.221
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=117e9ff9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=21845b39f8fc6be8
dashboard link: https://syzkaller.appspot.com/bug?extid=16135ab0703ba4c9746e

compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

IMPORTANT: if you fix the issue, please add the following tag to the commit:

Reported-by: syzbot+16135a...@syzkaller.appspotmail.com

INFO: task syz.5.373:6448 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.5.373 state:D stack:27888 pid: 6448 ppid: 4399 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
trace_array_get kernel/trace/trace.c:451 [inline]
tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8117
do_dentry_open+0x7f7/0xf90 fs/open.c:826
do_open fs/namei.c:3659 [inline]
path_openat+0x2718/0x2fb0 fs/namei.c:3793
do_filp_open+0x1df/0x400 fs/namei.c:3820
do_sys_openat2+0x14b/0x500 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fb054f02159
RSP: 002b:00007fb05315a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fb055189fa0 RCX: 00007fb054f02159
RDX: 0000000000000000 RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007fb054f9906b R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fb05518a038 R14: 00007fb055189fa0 R15: 00007fff638a3648

</TASK>

Showing all locks held in the system:

1 lock held by khungtaskd/27:
#0:
ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
2 locks held by kworker/u4:1/144:
2 locks held by getty/3943:
#0: ffff88802c09c098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
#1: ffffc90002cf62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158
3 locks held by udevd/4313:
4 locks held by udevd/4314:
#0: ffff8880b903a358 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x130 kernel/sched/core.c:475
#1: ffff8880b9027888 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x517/0x810 kernel/sched/psi.c:891
#2: ffff88807d54e558 (&ep->lock){....}-{2:2}, at: ep_poll_callback+0x79/0x9c0 fs/eventpoll.c:1219
#3: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
3 locks held by kworker/u4:8/4515:
4 locks held by kworker/u4:9/4517:
4 locks held by syz.3.368/6419:
1 lock held by syz.5.373/6448:
#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]
#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8117
2 locks held by syz.9.430/6824:
#0: ffff888017fa0460 (sb_writers#17){.+.+}-{0:0}, at: mnt_want_write+0x3d/0x90 fs/namespace.c:386
#1: ffffffff8c36c7c8 (event_mutex){+.+.}-{3:3}, at: instance_mkdir+0x1e/0x120 kernel/trace/trace.c:9476
1 lock held by syz.2.905/9794:
#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]
#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8117

=============================================

NMI backtrace for cpu 0

CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xe1b/0xe60 kernel/hung_task.c:369
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1

CPU: 1 PID: 1269 Comm: kworker/u4:5 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: bat_events batadv_nc_worker
RIP: 0010:arch_atomic_try_cmpxchg arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:513 [inline]
RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock+0x135/0x2f0 kernel/locking/spinlock_debug.c:115
Code: df be 04 00 00 00 49 89 d6 e8 37 09 60 00 48 8d 7c 24 40 be 04 00 00 00 e8 28 09 60 00 8b 44 24 40 b9 01 00 00 00 f0 0f b1 0b <0f> 85 1c 01 00 00 43 c6 44 34 04 f8 65 8b 1d 60 d4 a3 7e 43 0f b6
RSP: 0018:ffffc90004fa7a80 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888023885140 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90004fa7ac0
RBP: ffffc90004fa7b40 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520009f4f58 R12: 1ffff920009f4f54
R13: ffff888023885148 R14: dffffc0000000000 R15: 1ffff11004710a29
FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007ffc3c5175c8 CR3: 00000000233d6000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

spin_lock_bh include/linux/spinlock.h:369 [inline]
batadv_nc_purge_paths+0xe2/0x3a0 net/batman-adv/network-coding.c:446
batadv_nc_worker+0x2e1/0x5c0 net/batman-adv/network-coding.c:724
process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

syzbot

unread,

Sep 20, 2026, 2:05:35 AMSep 20

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: 0248c33e835e Linux 5.15.221
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=137b5ff9580000

kernel config: https://syzkaller.appspot.com/x/.config?x=21845b39f8fc6be8
dashboard link: https://syzkaller.appspot.com/bug?extid=16135ab0703ba4c9746e
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1281e525580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/cdcbd8738a16/disk-0248c33e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/864175e96c3d/vmlinux-0248c33e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb031d3f4011/bzImage-0248c33e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+16135a...@syzkaller.appspotmail.com

INFO: task syz.4.21:4466 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.4.21 state:D stack:27504 pid: 4466 ppid: 4302 flags:0x00004004

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
trace_array_get kernel/trace/trace.c:451 [inline]
tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8117
do_dentry_open+0x7f7/0xf90 fs/open.c:826
do_open fs/namei.c:3659 [inline]
path_openat+0x2718/0x2fb0 fs/namei.c:3793
do_filp_open+0x1df/0x400 fs/namei.c:3820
do_sys_openat2+0x14b/0x500 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

RIP: 0033:0x7f3174cbe159
RSP: 002b:00007ffcb5e6c0b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f3174f45fa0 RCX: 00007f3174cbe159

RDX: 0000000000000000 RSI: 0000200000000140 RDI: ffffffffffffff9c

RBP: 00007f3174d5506b R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f3174f45fac R14: 00007f3174f45fa0 R15: 00007f3174f45fa0

</TASK>

Showing all locks held in the system:

3 locks held by kworker/u4:0/9:
#0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000ce7d00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff8880b913a358 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x130 kernel/sched/core.c:475
3 locks held by kworker/0:1/13:
#0: ffff88802b8a9538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000d27d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffffffff8d44d548 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4120

1 lock held by khungtaskd/27:
#0: ffffffff8c31ef60 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30

2 locks held by kworker/1:2/2855:
#0: ffff888016c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc9000cb67d00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285

2 locks held by getty/3943:

#0: ffff88814cba7098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252

#1: ffffc90002cf62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158

3 locks held by kworker/1:26/4361:
#0: ffff88802b8a9538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc900035bfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffffffff8d44d548 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4120
3 locks held by kworker/u4:6/4409:
#0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc9000368fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffffffff8d44d548 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251
5 locks held by syz.0.17/4461:
1 lock held by syz.4.21/4466:

#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]
#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
#0: ffffffff8c361568 (trace_types_lock){+.+.}-{3:3}, at: tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8117

1 lock held by syz.3.20/4468:

1 lock held by syz.2.19/4469:

1 lock held by syz.1.18/4470:
#0: ffffffff8c361568 (

trace_types_lock){+.+.}-{3:3}
, at: trace_array_get kernel/trace/trace.c:451 [inline]

, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]

, at: tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8117

1 lock held by syz.5.22/4507:
#0: ffffffff8c361568 (
trace_types_lock

){+.+.}-{3:3}
, at: trace_array_get kernel/trace/trace.c:451 [inline]

, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]

, at: tracing_buffers_open+0x7f/0x4b0 kernel/trace/trace.c:8117

1 lock held by syz.6.23/4541:

1 lock held by syz.7.24/4572:

1 lock held by syz.8.25/4573:

1 lock held by syz.9.26/4574:

1 lock held by syz.4.28/4644:

1 lock held by syz.2.36/4662:

1 lock held by syz.1.40/4679:

1 lock held by syz.3.39/4687:

1 lock held by syz.5.61/4712:

1 lock held by syz.6.75/4761:

1 lock held by syz.7.82/4793:

1 lock held by syz.9.85/4814:

1 lock held by syz.8.95/4848:

1 lock held by syz.4.110/4865:

1 lock held by syz.2.121/4886:

3 locks held by syz-executor/4894:
#0: ffffffff8d44d548 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d44d548 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
#1: ffff88805ca553e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_open+0x223/0x420 drivers/net/wireguard/device.c:49
#2: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
#2: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845
1 lock held by syz.1.129/4904:

1 lock held by syz-executor/4908:
#0: ffffffff8d44d548 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d44d548 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
2 locks held by syz-executor/4931:
#0: ffffffff8d441610 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x324/0x5b0 net/core/net_namespace.c:499
#1:
ffffffff8d44d548 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_init_net+0x234/0x710 net/ipv4/ip_tunnel.c:1083
4 locks held by syz.0.158/4937:
2 locks held by dhcpcd/4938:
#0: ffff888054374120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
#0: ffff888054374120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243
#1: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
#1: ffffffff8c3239e8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
1 lock held by dhcpcd/4939:
#0:
ffff88804cd92120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
ffff88804cd92120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243
1 lock held by dhcpcd/4940:
#0: ffff88804ee12120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
#0: ffff88804ee12120 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x32/0xd60 net/packet/af_packet.c:3243

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xe1b/0xe60 kernel/hung_task.c:369
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1

CPU: 1 PID: 144 Comm: kworker/u4:1 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026

Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:mark_lock+0xe2/0x320 kernel/locking/lockdep.c:4569
Code: 03 42 0f b6 04 28 84 c0 0f 85 06 02 00 00 83 3d 73 db d1 14 00 74 36 45 31 ff 49 83 c7 50 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 <74> 08 4c 89 ff e8 34 a4 60 00 b8 01 00 00 00 45 85 27 74 50 48 83
RSP: 0018:ffffc9000136f460 EFLAGS: 00000046
RAX: 1ffffffff1f7bb5a RBX: ffff8880185f8000 RCX: ffffffff815da3d4
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff901f11c8
RBP: 0000000000000006 R08: ffffffff901f11cf R09: 1ffffffff203e239
R10: dffffc0000000000 R11: fffffbfff203e23a R12: 0000000000000040
R13: dffffc0000000000 R14: ffff8880185f8b18 R15: ffffffff8fbddad0

FS: 0000000000000000(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000559e8bea8d90 CR3: 000000002b652000 CR4: 00000000003506e0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>

mark_held_locks kernel/locking/lockdep.c:4193 [inline]
__trace_hardirqs_on_caller kernel/locking/lockdep.c:4219 [inline]
lockdep_hardirqs_on_prepare+0x380/0x7c0 kernel/locking/lockdep.c:4278
trace_hardirqs_on+0x67/0x80 kernel/trace/trace_preemptirq.c:49
___slab_alloc+0x942/0xdd0 mm/slub.c:3001
__slab_alloc mm/slub.c:3100 [inline]
slab_alloc_node mm/slub.c:3191 [inline]
slab_alloc mm/slub.c:3233 [inline]
__kmalloc+0x11d/0x340 mm/slub.c:4408
kmalloc include/linux/slab.h:612 [inline]
kzalloc include/linux/slab.h:738 [inline]
ieee802_11_parse_elems_crc+0xb3/0x1090 net/mac80211/util.c:1478
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2243 [inline]
ieee80211_bss_info_update+0x74d/0xa80 net/mac80211/scan.c:212
ieee80211_rx_bss_info net/mac80211/ibss.c:1123 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1614 [inline]
ieee80211_ibss_rx_queued_mgmt+0x1763/0x2b50 net/mac80211/ibss.c:1643
ieee80211_iface_process_skb net/mac80211/iface.c:1465 [inline]
ieee80211_iface_work+0x714/0xc50 net/mac80211/iface.c:1519
cfg80211_wiphy_work+0x224/0x260 net/wireless/core.c:433

process_one_work+0x867/0xff0 kernel/workqueue.c:2310
worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>

---

Reply all

Reply to author

Forward

0 new messages