syzbot
BUG: workqueue lockup in bpf_map_free_deferred
Status:
premoderation: reported on 2026/09/12 21:51
Reported-by: syzbot+15241628cda6cd022776@syzkaller.appspotmail.com
First crash: 9d20h, last: 9d20h
Sample crash report:
BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 144s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=7/256 refcnt=8
in-flight: 7889:bpf_map_free_deferred
pending: free_work, vmstat_shepherd, destroy_list_workfn, rht_deferred_worker, kernfs_notify_workfn, rht_deferred_worker
workqueue events_long: flags=0x0
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=6/256 refcnt=7
pending: br_fdb_cleanup, br_multicast_gc_work, br_multicast_gc_work, br_multicast_gc_work, br_fdb_cleanup, br_fdb_cleanup
workqueue events_unbound: flags=0x2
pwq 4: cpus=0-1 flags=0x4 nice=0 active=4/512 refcnt=6
in-flight: 7:fsnotify_mark_destroy_workfn fsnotify_mark_destroy_workfn, 301:fsnotify_connector_destroy_workfn fsnotify_connector_destroy_workfn
workqueue events_power_efficient: flags=0x80
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: neigh_periodic_work
workqueue rcu_gp: flags=0x8
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: process_srcu, wait_rcu_exp_gp
workqueue mm_percpu_wq: flags=0x8
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: vmstat_update
workqueue netns: flags=0xe000a
pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/1 refcnt=4
in-flight: 302:cleanup_net
delayed: cleanup_net
workqueue dm_bufio_cache: flags=0x8
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: work_fn
workqueue wg-kex-wg0: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: wg_packet_tx_worker, wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg1: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: wg_packet_tx_worker, wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg2: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg0: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg1: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg2: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg0: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg1: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg2: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg1: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=2/256 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg2: flags=0x24
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2
pending: wg_packet_encrypt_worker
pool 0: cpus=0 node=0 flags=0x0 nice=0 hung=145s workers=40 idle: 7893 878 10024 5 866 5272 10016 3449 10015 7888 642 879 880 10025 583 394 629 287 865 10026 867 10018 15 5273 627 872 645 876 881 7892 3444 7886 586 397 862 3437 10020 329 3443
pool 4: cpus=0-1 flags=0x4 nice=0 hung=0s workers=6 idle: 1214 9 192
NMI backtrace for cpu 0
CPU: 0 PID: 7889 Comm: kworker/0:41 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events bpf_map_free_deferred
RIP: 0010:deliver_ptype_list_skb net/core/dev.c:2283 [inline]
RIP: 0010:__netif_receive_skb_core+0x2971/0x30b0 net/core/dev.c:5369
Code: 07 38 c1 0f 8c e6 fd ff ff 4c 89 e7 e8 c8 94 fe fd e9 d9 fd ff ff e8 4e 14 c4 fd e9 5d fe ff ff e8 44 14 c4 fd 4c 89 f0 eb 0a <e8> 3a 14 c4 fd 48 8b 44 24 08 49 89 c6 48 89 84 24 98 00 00 00 48
RSP: 0018:ffffc90000007680 EFLAGS: 00000246
RAX: 1ffff1102420f813 RBX: 000000000000dd86 RCX: ffff88819783c640
RDX: 0000000080000101 RSI: 000000000000dd86 RDI: 000000000000dd86
RBP: ffffc90000007828 R08: ffff88810fe99400 R09: 0000000000000002
R10: 000000000000a888 R11: 0000000080000101 R12: 0000000000000001
R13: dffffc0000000000 R14: ffff88812107c098 R15: ffff88812107c098
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000011c657000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000200000000300
DR3: 0000200000000300 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
__netif_receive_skb_one_core net/core/dev.c:5411 [inline]
__netif_receive_skb+0x72/0x280 net/core/dev.c:5527
netif_receive_skb_internal net/core/dev.c:5632 [inline]
netif_receive_skb+0x9b/0x3e0 net/core/dev.c:5691
br_netif_receive_skb net/bridge/br_input.c:30 [inline]
NF_HOOK include/linux/netfilter.h:299 [inline]
br_pass_frame_up+0x164/0x1e0 net/bridge/br_input.c:72
br_handle_frame_finish+0xce7/0x10f0 net/bridge/br_input.c:179
nf_hook_bridge_pre net/bridge/br_input.c:259 [inline]
br_handle_frame+0x406/0x8e0 net/bridge/br_input.c:363
__netif_receive_skb_core+0xed5/0x30b0 net/core/dev.c:5307
__netif_receive_skb_one_core net/core/dev.c:5411 [inline]
__netif_receive_skb+0x72/0x280 net/core/dev.c:5527
process_backlog+0x351/0x600 net/core/dev.c:6434
napi_poll net/core/dev.c:6885 [inline]
net_rx_action+0x48d/0xed0 net/core/dev.c:6955
__do_softirq+0x255/0x563 kernel/softirq.c:309
asm_call_irq_on_stack+0xf/0x20
</IRQ>
__run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
do_softirq+0xb0/0xf0 kernel/softirq.c:358
__local_bh_enable_ip+0x70/0x80 kernel/softirq.c:194
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline]
_raw_spin_unlock_bh+0x51/0x60 kernel/locking/spinlock.c:207
sock_hash_free+0x2e8/0x620 net/core/sock_map.c:1206
bpf_map_free_deferred+0xaf/0x110 kernel/bpf/syscall.c:486
process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
kthread+0x324/0x3b0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 38 c1 cmp %al,%cl
2: 0f 8c e6 fd ff ff jl 0xfffffdee
8: 4c 89 e7 mov %r12,%rdi
b: e8 c8 94 fe fd call 0xfdfe94d8
10: e9 d9 fd ff ff jmp 0xfffffdee
15: e8 4e 14 c4 fd call 0xfdc41468
1a: e9 5d fe ff ff jmp 0xfffffe7c
1f: e8 44 14 c4 fd call 0xfdc41468
24: 4c 89 f0 mov %r14,%rax
27: eb 0a jmp 0x33
* 29: e8 3a 14 c4 fd call 0xfdc41468 <-- trapping instruction
2e: 48 8b 44 24 08 mov 0x8(%rsp),%rax
33: 49 89 c6 mov %rax,%r14
36: 48 89 84 24 98 00 00 mov %rax,0x98(%rsp)
3d: 00
3e: 48 rex.W
Struck through repros no longer work on HEAD.