syzbot

 sign-in | mailing list | source | docs
🐞 Open [855]
🐞 Fixed [87]
🐞 Invalid [1336]
⬇ Missing Backports [131]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

INFO: task hung in rtnetlink_rcv_msg (4)

Status: upstream: reported on 2026/04/05 04:20
Reported-by: syzbot+1d97f4017fc4aea2c9fa@syzkaller.appspotmail.com
First crash: 57d, last: 16d
▶ ▼ Similar bugs (18)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 INFO: task hung in rtnetlink_rcv_msg (2) 1 1 16d 16d 0/2 upstream: reported on 2026/05/16 14:21
linux-5.15 INFO: task hung in rtnetlink_rcv_msg 1 1 1052d 1052d 0/3 auto-obsoleted due to no activity on 2023/10/22 21:13
linux-4.19 INFO: task hung in rtnetlink_rcv_msg (2) 1 14 1595d 1774d 0/1 auto-closed as invalid on 2022/05/18 11:30
linux-4.19 INFO: task hung in rtnetlink_rcv_msg (3) 1 8 1208d 1441d 0/1 upstream: reported on 2022/06/20 23:55
linux-4.19 INFO: task hung in rtnetlink_rcv_msg 1 11 2026d 2348d 0/1 auto-closed as invalid on 2021/03/12 19:03
upstream INFO: task hung in rtnetlink_rcv_msg (2) net 1 C inconclusive 548 434d 642d 0/29 closed as invalid on 2025/04/18 16:40
linux-6.1 INFO: task hung in rtnetlink_rcv_msg (3) origin:upstream 1 C error 21 58d 620d 0/3 upstream: reported C repro on 2024/09/19 14:16
linux-5.15 INFO: task hung in rtnetlink_rcv_msg (3) 1 1 410d 410d 0/3 auto-obsoleted due to no activity on 2025/07/26 04:34
upstream INFO: task hung in rtnetlink_rcv_msg net 1 C inconclusive inconclusive 1970 692d 2656d 26/29 fixed on 2024/07/09 19:14
linux-4.14 INFO: task hung in rtnetlink_rcv_msg 1 1 1187d 1187d 0/1 upstream: reported on 2023/03/01 21:15
linux-5.15 INFO: task hung in rtnetlink_rcv_msg (2) 1 70 563d 854d 0/3 auto-obsoleted due to no activity on 2025/01/24 13:11
android-6-12 INFO: task hung in rtnetlink_rcv_msg (2) 1 150 1d00h 131d 0/1 premoderation: reported on 2026/01/21 16:59
linux-6.1 INFO: task hung in rtnetlink_rcv_msg (2) 1 67 692d 856d 0/3 auto-obsoleted due to no activity on 2024/09/17 07:45
linux-6.1 INFO: task hung in rtnetlink_rcv_msg 1 1 977d 977d 0/3 auto-obsoleted due to no activity on 2024/01/09 18:18
android-6-12 INFO: task hung in rtnetlink_rcv_msg 1 265 200d 345d 0/1 auto-obsoleted due to no activity on 2026/01/02 16:22
linux-6.6 INFO: task hung in rtnetlink_rcv_msg 1 3 118d 211d 0/2 auto-obsoleted due to no activity on 2026/05/14 04:07
upstream INFO: task hung in rtnetlink_rcv_msg (3) net 1 4 360d 401d 0/29 auto-obsoleted due to no activity on 2025/09/03 19:16
upstream INFO: task hung in cangw_pernet_exit (3) can 1 syz unreliable 290 1616d 1722d 0/29 closed as invalid on 2022/02/08 10:22

Sample crash report:
INFO: task dhcpcd:3853 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:21328 pid: 3853 ppid:  3852 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 rtnl_lock net/core/rtnetlink.c:72 [inline]
 rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:706 [inline]
 __sock_sendmsg net/socket.c:718 [inline]
 ____sys_sendmsg+0x5b7/0x8f0 net/socket.c:2445
 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2499
 __sys_sendmsg net/socket.c:2528 [inline]
 __do_sys_sendmsg net/socket.c:2537 [inline]
 __se_sys_sendmsg+0x1af/0x290 net/socket.c:2535
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f0fc4029407
RSP: 002b:00007ffe1133c8e0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f0fc3f9f740 RCX: 00007f0fc4029407
RDX: 0000000000000000 RSI: 00007ffe11350ac0 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe11360cf0
R13: 00007f0fc3f9f6c8 R14: 0000000000000048 R15: 00007ffe11350ac0
 </TASK>
INFO: task kworker/u4:4:4213 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:4    state:D stack:22736 pid: 4213 ppid:     2 flags:0x00004000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 linkwatch_event+0xa/0x50 net/core/link_watch.c:251
 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/u4:5:4230 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:5    state:D stack:23472 pid: 4230 ppid:     2 flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 cangw_pernet_exit+0xe/0x20 net/can/gw.c:1279
 ops_exit_list net/core/net_namespace.c:172 [inline]
 cleanup_net+0x706/0xba0 net/core/net_namespace.c:635
 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/u4:6:4242 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:6    state:D stack:23216 pid: 4242 ppid:     2 flags:0x00004000
Workqueue: events_unbound fsnotify_connector_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
 do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
 __synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930
 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234
 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/u4:17:5826 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:17   state:D stack:24688 pid: 5826 ppid:     2 flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_timeout+0xbd/0x2d0 kernel/time/timer.c:2093
 do_wait_for_common+0x2a2/0x450 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
 __synchronize_srcu+0x2bb/0x350 kernel/rcu/srcutree.c:930
 fsnotify_mark_destroy_workfn+0x106/0x2f0 fs/notify/mark.c:924
 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task syz-executor:6938 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22224 pid: 6938 ppid:     1 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 synchronize_rcu_expedited+0x5c1/0x750 kernel/rcu/tree_exp.h:861
 synchronize_rcu+0x119/0x1e0 kernel/rcu/tree.c:3802
 hsr_add_port+0x3b9/0x770 net/hsr/hsr_slave.c:203
 hsr_dev_finalize+0x3f2/0x870 net/hsr/hsr_device.c:678
 hsr_newlink+0x637/0x6f0 net/hsr/hsr_netlink.c:102
 __rtnl_newlink net/core/rtnetlink.c:3529 [inline]
 rtnl_newlink+0x1359/0x1a50 net/core/rtnetlink.c:3577
 rtnetlink_rcv_msg+0x844/0xf30 net/core/rtnetlink.c:5687
 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:706 [inline]
 __sock_sendmsg net/socket.c:718 [inline]
 __sys_sendto+0x46d/0x620 net/socket.c:2072
 __do_sys_sendto net/socket.c:2084 [inline]
 __se_sys_sendto net/socket.c:2080 [inline]
 __x64_sys_sendto+0xda/0xf0 net/socket.c:2080
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f01602ae68e
RSP: 002b:00007ffe742ab0b8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000055556d116500 RCX: 00007f01602ae68e
RDX: 0000000000000058 RSI: 00007f0161095670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffe742ab134 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f0161095670 R15: 0000000000000000
 </TASK>
INFO: task syz.8.511:7045 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.511       state:D stack:27824 pid: 7045 ppid:  5170 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 __tun_chr_ioctl+0x3fc/0x1ec0 drivers/net/tun.c:3052
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fa8745aee59
RSP: 002b:00007fa872808028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fa874827fa0 RCX: 00007fa8745aee59
RDX: 0000200000000040 RSI: 00000000400454ca RDI: 0000000000000003
RBP: 00007fa874644d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa874828038 R14: 00007fa874827fa0 R15: 00007ffc10042e28
 </TASK>
INFO: task syz.8.511:7048 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.8.511       state:D stack:27152 pid: 7048 ppid:  5170 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 rtnl_lock net/core/rtnetlink.c:72 [inline]
 rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:706 [inline]
 __sock_sendmsg net/socket.c:718 [inline]
 ____sys_sendmsg+0x5b7/0x8f0 net/socket.c:2445
 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2499
 __sys_sendmsg net/socket.c:2528 [inline]
 __do_sys_sendmsg net/socket.c:2537 [inline]
 __se_sys_sendmsg+0x1af/0x290 net/socket.c:2535
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fa8745aee59
RSP: 002b:00007fa8727c6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fa874828180 RCX: 00007fa8745aee59
RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000007
RBP: 00007fa874644d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa874828218 R14: 00007fa874828180 R15: 00007ffc10042e28
 </TASK>
INFO: task syz.9.513:7056 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.513       state:D stack:27600 pid: 7056 ppid:  5262 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
 packet_release+0x976/0xc30 net/packet/af_packet.c:3175
 __sock_release net/socket.c:651 [inline]
 sock_close+0xd5/0x240 net/socket.c:1345
 __fput+0x234/0x930 fs/file_table.c:311
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fdea8eeae59
RSP: 002b:00007fffe1753248 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fdea9165da0 RCX: 00007fdea8eeae59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fdea9165da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007fdea9165cb0 R11: 0000000000000246 R12: 000000000005f877
R13: 00007fdea9163fac R14: 000000000005f57b R15: 00007fffe1753350
 </TASK>
INFO: task syz.9.513:7057 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.513       state:D stack:27152 pid: 7057 ppid:  5262 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xcfc/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 rtnl_lock net/core/rtnetlink.c:72 [inline]
 rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
 netlink_rcv_skb+0x1f5/0x440 net/netlink/af_netlink.c:2507
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:706 [inline]
 __sock_sendmsg net/socket.c:718 [inline]
 ____sys_sendmsg+0x5b7/0x8f0 net/socket.c:2445
 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2499
 __sys_sendmsg net/socket.c:2528 [inline]
 __do_sys_sendmsg net/socket.c:2537 [inline]
 __se_sys_sendmsg+0x1af/0x290 net/socket.c:2535
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fdea8eeae59
RSP: 002b:00007fdea7144028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fdea9163fa0 RCX: 00007fdea8eeae59
RDX: 0000000000004000 RSI: 0000200000000200 RDI: 000000000000001d
RBP: 00007fdea8f80d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fdea9164038 R14: 00007fdea9163fa0 R15: 00007fffe17530e8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8c31f320 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
2 locks held by kworker/0:3/2346:
1 lock held by dhcpcd/3853:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
2 locks held by getty/3954:
 #0: ffff88802bbcf098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc90002d032e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x5df/0x1a70 drivers/tty/n_tty.c:2158
3 locks held by kworker/u4:4/4213:
 #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
 #1: ffffc9000303fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
 #2: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251
4 locks held by kworker/u4:5/4230:
 #0: ffff888016dcd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
 #1: ffffc9000313fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
 #2: ffffffff8d431cd0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589
 #3: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: cangw_pernet_exit+0xe/0x20 net/can/gw.c:1279
2 locks held by kworker/u4:6/4242:
 #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
 #1: ffffc9000321fd00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
2 locks held by kworker/u4:17/5826:
 #0: ffff888016c79138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
 #1: ffffc900034afd00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
3 locks held by kworker/1:11/6217:
 #0: ffff888016c70938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x761/0x1010 kernel/workqueue.c:-1
 #1: ffffc900030efd00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x79f/0x1010 kernel/workqueue.c:2285
 #2: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:74
2 locks held by syz-executor/6938:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
 #1: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #1: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x2d1/0x750 kernel/rcu/tree_exp.h:845
1 lock held by syz.8.511/7045:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: __tun_chr_ioctl+0x3fc/0x1ec0 drivers/net/tun.c:3052
1 lock held by syz.8.511/7048:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
2 locks held by syz.9.513/7056:
 #0: ffff88805e1bee10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
 #0: ffff88805e1bee10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:650 [inline]
 #0: ffff88805e1bee10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1345
 #1: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #1: ffffffff8c323da8 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x3a5/0x750 kernel/rcu/tree_exp.h:845
1 lock held by syz.9.513/7057:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
2 locks held by syz.4.514/7060:
 #0: ffff88805e1bd010 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
 #0: ffff88805e1bd010 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:650 [inline]
 #0: ffff88805e1bd010 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x90/0x240 net/socket.c:1345
 #1: ffff88801eda0120 (sk_lock-AF_CAN){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1744 [inline]
 #1: ffff88801eda0120 (sk_lock-AF_CAN){+.+.}-{0:0}, at: bcm_release+0x1c9/0x850 net/can/bcm.c:1558
1 lock held by syz-executor/7069:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7075:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7080:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7083:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7086:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7091:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7098:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7103:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7106:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7109:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7113:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7119:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7122:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684
1 lock held by syz-executor/7125:
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d43dbc8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ee/0xf30 net/core/rtnetlink.c:5684

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xe0f/0xe50 kernel/hung_task.c:369
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 5654 Comm: kworker/u4:16 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__lock_release kernel/locking/lockdep.c:-1 [inline]
RIP: 0010:lock_release+0x29e/0x8a0 kernel/locking/lockdep.c:5643
Code: f0 ff 41 89 cf 41 81 c7 00 00 f0 ff 42 0f b6 04 2b 84 c0 0f 85 bc 04 00 00 41 89 3e 45 85 ff 4c 8b 7c 24 20 0f 85 9f 02 00 00 <48> 8b 44 24 40 42 0f b6 04 28 84 c0 0f 85 73 04 00 00 48 8b 04 24
RSP: 0018:ffffc9000395fac0 EFLAGS: 00000083
RAX: 0000000000020015 RBX: 1ffff11005649524 RCX: 0000000000000001
RDX: 0000000000000002 RSI: ffffffff8c31f320 RDI: ffff88802b24a900
RBP: ffffc9000395fbd0 R08: ffffffff8d89f82f R09: 1ffffffff1b13f05
R10: dffffc0000000000 R11: fffffbfff1b13f06 R12: ffff88802b24a900
R13: dffffc0000000000 R14: ffff88802b24a920 R15: 0000000000000246
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564706e07000 CR3: 000000007e010000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 rcu_read_unlock include/linux/rcupdate.h:773 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:416 [inline]
 batadv_nc_worker+0x25b/0x5c0 net/batman-adv/network-coding.c:723
 process_one_work+0x85f/0x1010 kernel/workqueue.c:2310
 worker_thread+0xaa6/0x1290 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/16 06:40 linux-5.15.y 93741761e5e3 81fb92f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in rtnetlink_rcv_msg
2026/04/14 19:53 linux-5.15.y 91d48252ad4b 362d1323 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in rtnetlink_rcv_msg
2026/04/05 04:19 linux-5.15.y 91d48252ad4b 4440e7c2 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in rtnetlink_rcv_msg
* Struck through repros no longer work on HEAD.