[v5.15] INFO: task hung in show_traces_open

2 views

Skip to first unread message

syzbot

unread,

Oct 6, 2026, 2:56:29 AMOct 6

to syzkaller...@googlegroups.com

Hello,

syzbot found the following issue on:

HEAD commit: a051a4bf909f Linux 5.15.222
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1535bff5580000
kernel config: https://syzkaller.appspot.com/x/.config?x=21845b39f8fc6be8
dashboard link: https://syzkaller.appspot.com/bug?extid=29e0b8d3e8d1b2f3c3e3
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/17dbe20864e0/disk-a051a4bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9d4dd272dd21/vmlinux-a051a4bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb07d17a095e/bzImage-a051a4bf.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+29e0b8...@syzkaller.appspotmail.com

INFO: task syz.1.467:6260 blocked for more than 144 seconds.
Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.467 state:D stack:27856 pid: 6260 ppid: 4186 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
trace_array_get kernel/trace/trace.c:451 [inline]
tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105
do_dentry_open+0x7f7/0xf90 fs/open.c:826
do_open fs/namei.c:3659 [inline]
path_openat+0x2718/0x2fb0 fs/namei.c:3793
do_filp_open+0x1df/0x400 fs/namei.c:3820
do_sys_openat2+0x14b/0x500 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f63361aa199
RSP: 002b:00007f63343e1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f6336432090 RCX: 00007f63361aa199
RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c
RBP: 00007f63362418e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6336432128 R14: 00007f6336432090 R15: 00007ffef11331c8
</TASK>

Showing all locks held in the system:
2 locks held by kworker/u4:0/9:
#0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000ce7d00 ((work_completion)(&sub_info->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
3 locks held by kworker/1:0/21:
#0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000db7d00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff8880206dd240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x283/0x3380 drivers/net/netdevsim/fib.c:1480
1 lock held by khungtaskd/27:
#0: ffffffff8c31efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
2 locks held by kworker/1:2/1108:
#0: ffff888016c72138 ((wq_completion)rcu_gp){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90005557d00 ((work_completion)(&rew.rew_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
1 lock held by dhcpcd/3852:
#0: ffffffff8d44d808 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x256/0x1ba0 net/ipv4/devinet.c:1076
2 locks held by getty/3939:
#0: ffff88802cd4c098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
#1: ffffc900026562e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158
3 locks held by kworker/0:15/4331:
#0:
ffff88802bb75938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90004d9fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffffffff8d44d808 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128
5 locks held by kworker/u4:9/4509:
#0:
ffff888016dcd938
((wq_completion)netns
){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc900012ffd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2:
ffffffff8d4418d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589
#3: ffffffff8d44d808 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_delete_nets+0xd2/0x370 net/ipv4/ip_tunnel.c:1132
#4: ffffffff8c323a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
#4: ffffffff8c323a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845
5 locks held by syz.1.467/6255:
1 lock held by syz.1.467/6260:
#0: ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]
#0: ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
#0: ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105
3 locks held by kworker/1:21/7435:
#0: ffff88802bb75938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc900034efd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffffffff8d44d808
(rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128
1 lock held by syz-executor/7666:
#0: ffffffff8d44d808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d44d808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xe1b/0xe60 kernel/hung_task.c:369
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 6255 Comm: syz.1.467 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:entity_tick kernel/sched/fair.c:4785 [inline]
RIP: 0010:task_tick_fair+0xce/0xfd0 kernel/sched/fair.c:11475
Code: 00 00 49 8d 5e 78 48 89 d8 48 c1 e8 03 48 89 44 24 28 42 80 3c 28 00 74 08 48 89 df e8 4b 8f 67 00 48 89 5c 24 40 4d 8b 7e 78 <4c> 89 ff e8 fa fc fe ff 4c 89 ff 4c 89 f6 ba 01 00 00 00 e8 da d2
RSP: 0018:ffffc90000dd0b60 EFLAGS: 00000046
RAX: 1ffff1100560b797 RBX: ffff88802b05bcb8 RCX: 1ffff920001ba178
RDX: 0000000000000000 RSI: ffff88802b05bc40 RDI: ffff8880b913a340
RBP: ffffc90000dd0c78 R08: ffffffff8f109048 R09: ffffffff8f109058
R10: ffffffff8f109050 R11: ffffffff8f109043 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffff88802b05bc40 R15: ffff88805ffa6c00
FS: 00007f63344026c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564632b5a660 CR3: 0000000024a77000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
scheduler_tick+0x1e2/0x4f0 kernel/sched/core.c:5320
update_process_times+0x1c7/0x200 kernel/time/timer.c:2026
tick_sched_handle kernel/time/tick-sched.c:254 [inline]
tick_sched_timer+0x37d/0x560 kernel/time/tick-sched.c:1473
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x4b0/0xb60 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x397/0x8b0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1108
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_trylock_spinning+0x301/0x370 kernel/printk/printk.c:1909
Code: 85 db 74 89 e8 30 f2 18 00 fb 31 c0 eb 48 e8 26 f2 18 00 e8 91 e5 61 08 48 85 db 74 d1 e8 17 f2 18 00 fb 48 c7 c7 e0 3a 31 8c <31> f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00 45 31 c9 68 4a 31 60
RSP: 0018:ffffc900033ff9e0 EFLAGS: 00000246
RAX: ffffffff81603149 RBX: 0000000000000200 RCX: 0000000000080000
RDX: ffffc90003cd3000 RSI: 000000000007ffff RDI: ffffffff8c313ae0
RBP: ffffc900033ffab0 R08: ffffffff902140c7 R09: 1ffffffff2042818
R10: dffffc0000000000 R11: fffffbfff2042819 R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 1ffff9200067ff3c
vprintk_emit+0xa7/0x150 kernel/printk/printk.c:2273
_printk+0xda/0x130 kernel/printk/printk.c:2299
event_subsystem_dir kernel/trace/trace_events.c:2462 [inline]
event_create_dir+0xc34/0xe80 kernel/trace/trace_events.c:2553
__trace_add_new_event kernel/trace/trace_events.c:3047 [inline]
__trace_add_event_dirs kernel/trace/trace_events.c:3259 [inline]
event_trace_add_tracer+0x1a3/0x390 kernel/trace/trace_events.c:3870
trace_array_create_dir+0x77/0x120 kernel/trace/trace.c:9390
trace_array_create+0x6fa/0xc00 kernel/trace/trace.c:9448
instance_mkdir+0xc8/0x120 kernel/trace/trace.c:9483
tracefs_syscall_mkdir+0xb7/0x110 fs/tracefs/inode.c:87
vfs_mkdir+0x386/0x570 fs/namei.c:4116
do_mkdirat+0x1dd/0x5c0 fs/namei.c:4141
__do_sys_mkdirat fs/namei.c:4156 [inline]
__se_sys_mkdirat fs/namei.c:4154 [inline]
__x64_sys_mkdirat+0x85/0x90 fs/namei.c:4154
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f63361aa199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6334402028 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007f6336431fa0 RCX: 00007f63361aa199
RDX: 00000000000001ff RSI: 0000200000000140 RDI: ffffffffffffff9c
RBP: 00007f63362418e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6336432038 R14: 00007f6336431fa0 R15: 00007ffef11331c8
</TASK>

---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

syzbot

unread,

Oct 6, 2026, 11:15:32 AMOct 6

to syzkaller...@googlegroups.com

syzbot has found a reproducer for the following issue on:

HEAD commit: a051a4bf909f Linux 5.15.222
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=1145ef25580000

kernel config: https://syzkaller.appspot.com/x/.config?x=21845b39f8fc6be8
dashboard link: https://syzkaller.appspot.com/bug?extid=29e0b8d3e8d1b2f3c3e3
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=162a81c9580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/17dbe20864e0/disk-a051a4bf.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/9d4dd272dd21/vmlinux-a051a4bf.xz
kernel image: https://storage.googleapis.com/syzbot-assets/cb07d17a095e/bzImage-a051a4bf.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+29e0b8...@syzkaller.appspotmail.com

INFO: task syz.2.19:4380 blocked for more than 143 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.2.19 state:D stack:27472 pid: 4380 ppid: 4320 flags:0x00004004

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
__mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
__mutex_lock kernel/locking/mutex.c:729 [inline]
mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
trace_array_get kernel/trace/trace.c:451 [inline]
tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105
do_dentry_open+0x7f7/0xf90 fs/open.c:826
do_open fs/namei.c:3659 [inline]
path_openat+0x2718/0x2fb0 fs/namei.c:3793
do_filp_open+0x1df/0x400 fs/namei.c:3820
do_sys_openat2+0x14b/0x500 fs/open.c:1255
do_sys_open fs/open.c:1271 [inline]
__do_sys_openat fs/open.c:1287 [inline]
__se_sys_openat fs/open.c:1282 [inline]
__x64_sys_openat+0x135/0x160 fs/open.c:1282
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

RIP: 0033:0x7f670f2e3199
RSP: 002b:00007ffc907d7af8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f670f56afa0 RCX: 00007f670f2e3199

RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c

RBP: 00007f670f37a8e0 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f670f56afac R14: 00007f670f56afa0 R15: 00007f670f56afa0
</TASK>
INFO: task syz.0.17:4381 blocked for more than 144 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.0.17 state:D stack:26624 pid: 4381 ppid: 4311 flags:0x00004004

RIP: 0033:0x7ff70fd15199
RSP: 002b:00007ffcad452118 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ff70ff9cfa0 RCX: 00007ff70fd15199

RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c

RBP: 00007ff70fdac8e0 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007ff70ff9cfac R14: 00007ff70ff9cfa0 R15: 00007ff70ff9cfa0
</TASK>
INFO: task syz.4.21:4382 blocked for more than 144 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.4.21 state:D stack:27472 pid: 4382 ppid: 4317 flags:0x00004004

RIP: 0033:0x7fd30ef45199
RSP: 002b:00007ffd45fa1808 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007fd30f1ccfa0 RCX: 00007fd30ef45199

RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c

RBP: 00007fd30efdc8e0 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fd30f1ccfac R14: 00007fd30f1ccfa0 R15: 00007fd30f1ccfa0
</TASK>
INFO: task syz.3.20:4389 blocked for more than 146 seconds.

Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.

task:syz.3.20 state:D stack:27472 pid: 4389 ppid: 4322 flags:0x00004004

RIP: 0033:0x7f541cd8b199
RSP: 002b:00007ffe64e684f8 EFLAGS: 00000246
ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f541d012fa0 RCX: 00007f541cd8b199

RDX: 000000000000001b RSI: 0000200000000080 RDI: ffffffffffffff9c

RBP: 00007f541ce228e0 R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f541d012fac R14: 00007f541d012fa0 R15: 00007f541d012fa0

</TASK>

Showing all locks held in the system:

3 locks held by kworker/1:1/23:
#0: ffff88814c860d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc90000ddfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285

#2: ffffffff8d44d808 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128

1 lock held by khungtaskd/27:
#0: ffffffff8c31efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30

2 locks held by getty/3939:
#0: ffff88814cce7098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
#1: ffffc90002d032e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158
3 locks held by kworker/u4:4/4254:
3 locks held by kworker/0:5/4280:
#0: ffff88814c860d38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
#1: ffffc900030cfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff88802c090530 (&idev->mc_lock){+.+.}-{3:3}, at: mld_dad_work+0x31/0x470 net/ipv6/mcast.c:2291
3 locks held by kworker/1:20/4301:

#0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1

#1: ffffc900031bfd00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
#2: ffff888054ca7240 (&data->fib_lock){+.+.}-{3:3}, at: nsim_fib_event_work+0x283/0x3380 drivers/net/netdevsim/fib.c:1480
3 locks held by kworker/1:21/4302:
4 locks held by syz.1.18/4379:
1 lock held by syz.2.19/4380:

#0: ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]
#0: ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]
#0: ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105

1 lock held by syz.0.17/4381:

1 lock held by syz.4.21/4382:

#0: ffffffff8c3615a8
(trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]

(trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]

(trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105

3 locks held by kworker/u4:7/4387:
1 lock held by syz.3.20/4389:

1 lock held by syz.6.23/4480:

1 lock held by syz.5.22/4481:

1 lock held by syz.8.25/4483:

1 lock held by syz.7.24/4484:

1 lock held by syz.9.26/4495:
#0: ffffffff8c3615a8 (trace_types_lock

){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]

){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]

){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105

1 lock held by syz-executor/4501:
#0: ffffffff8c323a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
#0: ffffffff8c323a28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845
1 lock held by syz.2.28/4551:

1 lock held by syz.4.30/4570:

1 lock held by syz.0.29/4581:

1 lock held by syz.3.31/4582:

1 lock held by syz.5.49/4627:

1 lock held by syz.6.58/4677:

1 lock held by syz.7.64/4718:

1 lock held by syz.8.66/4720:

1 lock held by syz.9.82/4748:

#0:
ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]

ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]

ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105

1 lock held by syz.2.95/4761:

#0:
ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: trace_array_get kernel/trace/trace.c:451 [inline]

ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: tracing_check_open_get_tr kernel/trace/trace.c:501 [inline]

ffffffff8c3615a8 (trace_types_lock){+.+.}-{3:3}, at: show_traces_open+0x7c/0x270 kernel/trace/trace.c:5105

1 lock held by syz.4.106/4818:

1 lock held by syz.0.109/4819:

1 lock held by syz.3.118/4852:

1 lock held by syz.5.124/4858:

3 locks held by syz-executor/4863:
1 lock held by syz-executor/4867:

#0: ffffffff8d44d808
(rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]

(rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695

1 lock held by syz-executor/4903:

#0: ffffffff8d44d808 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
#0: ffffffff8d44d808 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695

1 lock held by syz-executor/4928:

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
<TASK>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
watchdog+0xe1b/0xe60 kernel/hung_task.c:369
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>

Sending NMI from CPU 1 to CPUs 0:

NMI backtrace for cpu 0

CPU: 0 PID: 4863 Comm: syz-executor Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026

RIP: 0010:io_serial_in+0x73/0xb0 drivers/tty/serial/8250/8250_port.c:461
Code: e8 32 fc 23 fd 44 89 f9 d3 e3 49 83 c6 40 4c 89 f0 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 23 41 69 fd 41 03 1e 89 da ec <0f> b6 c0 5b 41 5c 41 5e 41 5f c3 44 89 f9 80 e1 07 38 c1 7c aa 4c
RSP: 0018:ffffc90003e5e4f8 EFLAGS: 00000002
RAX: 1ffffffff2cc8360 RBX: 00000000000003fd RCX: 0000000000000000
RDX: 00000000000003fd RSI: 0000000000000000 RDI: 0000000000000020
RBP: 0000000000000020 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520007cbc94 R12: dffffc0000000000
R13: dffffc0000000000 R14: ffffffff96641820 R15: 0000000000000000
FS: 000055557122d500(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 00007fd7ee3bca08 CR3: 0000000057163000 CR4: 00000000003506f0

DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:

<TASK>
serial_in drivers/tty/serial/8250/8250.h:116 [inline]
wait_for_xmitr+0x41/0x240 drivers/tty/serial/8250/8250_port.c:2076
serial8250_console_putchar+0x1a/0x50 drivers/tty/serial/8250/8250_port.c:3322
uart_console_write+0xaa/0x100 drivers/tty/serial/serial_core.c:1981
serial8250_console_write+0xb90/0xf50 drivers/tty/serial/8250/8250_port.c:3399
call_console_drivers kernel/printk/printk.c:-1 [inline]
console_unlock+0xb47/0x10f0 kernel/printk/printk.c:2744
vprintk_emit+0xc0/0x150 kernel/printk/printk.c:2274
_printk+0xda/0x130 kernel/printk/printk.c:2299
batadv_hardif_activate_interface+0x17b/0x3b0 net/batman-adv/hard-interface.c:671
batadv_hard_if_event+0xbc/0x17f0 net/batman-adv/hard-interface.c:965
notifier_call_chain kernel/notifier.c:83 [inline]
raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391
call_netdevice_notifiers_extack net/core/dev.c:2074 [inline]
call_netdevice_notifiers net/core/dev.c:2088 [inline]
__dev_notify_flags+0x194/0x300 net/core/dev.c:8917
dev_change_flags+0xda/0x1a0 net/core/dev.c:8955
do_setlink+0xca4/0x29d0 net/core/rtnetlink.c:2793
__rtnl_newlink net/core/rtnetlink.c:3464 [inline]
rtnl_newlink+0x15bb/0x1920 net/core/rtnetlink.c:3586
rtnetlink_rcv_msg+0x7f1/0xf10 net/core/rtnetlink.c:5698
netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2519
netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:706 [inline]
__sock_sendmsg net/socket.c:718 [inline]
__sys_sendto+0x46d/0x620 net/socket.c:2073
__do_sys_sendto net/socket.c:2085 [inline]
__se_sys_sendto net/socket.c:2081 [inline]
__x64_sys_sendto+0xda/0xf0 net/socket.c:2081

do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

RIP: 0033:0x7f5c5ae909ce
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007ffde354b888 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000055557122d500 RCX: 00007f5c5ae909ce
RDX: 000000000000002c RSI: 00007f5c5bc86670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffde354b904 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f5c5bc86670 R15: 0000000000000000
</TASK>

---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Reply all

Reply to author

Forward

0 new messages