INFO: task hung in devinet_ioctl (2)

Status: upstream: reported on 2026/11/01 03:32
Reported-by: syzbot+237c821fe0d0c157fa15@syzkaller.appspotmail.com
First crash: 15h34m, last: 15h34m
▶ ▼ Similar bugs (20)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in devinet_ioctl (7) net 1 31 585d 593d 0/29 closed as invalid on 2025/04/18 16:40
upstream INFO: task hung in devinet_ioctl (8) net 1 syz error 7 480d 512d 0/29 closed as invalid on 2025/07/31 08:04
linux-6.1 INFO: task hung in devinet_ioctl 1 1 1302d 1302d 0/3 auto-obsoleted due to no activity on 2023/08/07 17:54
linux-6.1 INFO: task hung in devinet_ioctl (2) 1 1 1131d 1131d 0/3 auto-obsoleted due to no activity on 2024/01/05 10:55
linux-6.1 INFO: task hung in devinet_ioctl (3) 1 3 820d 890d 0/3 auto-obsoleted due to no activity on 2024/11/11 06:30
upstream INFO: task hung in devinet_ioctl (2) net 1 27 1729d 1859d 0/29 closed as invalid on 2022/02/07 19:19
linux-6.1 INFO: task hung in devinet_ioctl (5) 1 1 524d 524d 0/3 auto-obsoleted due to no activity on 2025/09/03 12:59
linux-6.6 INFO: task hung in devinet_ioctl 1 2 206d 214d 0/2 auto-obsoleted due to no activity on 2026/07/18 18:19
linux-6.1 INFO: task hung in devinet_ioctl (4) 1 2 662d 665d 0/3 auto-obsoleted due to no activity on 2025/04/18 15:16
upstream INFO: task hung in devinet_ioctl net 1 1 2934d 2934d 0/29 auto-closed as invalid on 2019/04/18 15:55
upstream INFO: task hung in devinet_ioctl (9) prio:normal net 1 syz error error 96 27d 338d 0/29 closed as invalid on 2026/10/06 01:41
linux-5.15 INFO: task hung in devinet_ioctl (2) 1 3 986d 999d 0/3 auto-obsoleted due to no activity on 2024/05/28 21:09
linux-5.15 INFO: task hung in devinet_ioctl (5) 1 1 104d 104d 0/3 auto-obsoleted due to no activity on 2026/10/28 16:56
upstream INFO: task hung in devinet_ioctl (3) net 1 825 965d 1614d 0/29 closed as invalid on 2024/03/11 20:24
linux-5.15 INFO: task hung in devinet_ioctl (3) 1 3 873d 886d 0/3 auto-obsoleted due to no activity on 2024/09/19 07:29
upstream INFO: task hung in devinet_ioctl (4) net 1 5 964d 964d 25/29 fixed on 2024/04/12 18:02
linux-6.1 INFO: task hung in devinet_ioctl (6) origin:lts-only 1 syz inconclusive 7 29d 414d 0/3 upstream: reported syz repro on 2025/09/13 16:51
linux-5.15 INFO: task hung in devinet_ioctl (4) 1 1 687d 687d 0/3 auto-obsoleted due to no activity on 2025/03/24 18:20
upstream INFO: task hung in devinet_ioctl (5) net 1 59 845d 871d 26/29 fixed on 2024/07/09 19:14
linux-5.15 INFO: task hung in devinet_ioctl 1 1 1211d 1211d 0/3 auto-obsoleted due to no activity on 2023/10/17 09:29

Sample crash report:
INFO: task dhcpcd:5452 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:21032 pid:5452  ppid:5451   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 devinet_ioctl+0x2fc/0x1d70 net/ipv4/devinet.c:1101
 inet_ioctl+0x42b/0x560 net/ipv4/af_inet.c:1000
 sock_do_ioctl+0xfc/0x310 net/socket.c:1220
 sock_ioctl+0x5be/0x7e0 net/socket.c:1341
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f26e5182378
RSP: 002b:00007ffd4c3247c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 0000000000000023 RCX: 00007f26e5182378
RDX: 00007ffd4c3349c0 RSI: 0000000000008914 RDI: 0000000000000023
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd4c344b60
R13: 00007f26e50826c8 R14: 0000000000000028 R15: 0000000000008914
 </TASK>
INFO: task kworker/0:7:5890 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:7     state:D stack:21832 pid:5890  ppid:2      flags:0x00004000
Workqueue: events switchdev_deferred_process_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task kworker/0:9:15455 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:9     state:D stack:23032 pid:15455 ppid:2      flags:0x00004000
Workqueue: events_power_efficient check_lifetime
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 check_lifetime+0x42c/0x990 net/ipv4/devinet.c:759
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task kworker/u4:6:22022 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:6    state:D stack:25960 pid:22022 ppid:2      flags:0x00004000
Workqueue: ipv6_addrconf addrconf_verify_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4737
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task syz-executor:22247 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25000 pid:22247 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 cfg802154_pernet_exit+0x18/0xc0 net/ieee802154/core.c:329
 ops_exit_list net/core/net_namespace.c:173 [inline]
 setup_net+0x7e5/0xa20 net/core/net_namespace.c:375
 copy_net_ns+0x361/0x530 net/core/net_namespace.c:524
 create_new_namespaces+0x3ce/0x700 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x11a/0x160 kernel/nsproxy.c:228
 ksys_unshare+0x4fa/0x8f0 kernel/fork.c:3447
 __do_sys_unshare kernel/fork.c:3521 [inline]
 __se_sys_unshare kernel/fork.c:3519 [inline]
 __x64_sys_unshare+0x38/0x40 kernel/fork.c:3519
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fd82afa0827
RSP: 002b:00007ffdcfe78988 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007fd82b225f40 RCX: 00007fd82afa0827
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007fd82b2267b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffdcfe78bc8 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:22264 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25000 pid:22264 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 ip_tunnel_delete_nets+0xd6/0x380 net/ipv4/ip_tunnel.c:1152
 ops_exit_list net/core/net_namespace.c:178 [inline]
 setup_net+0x85a/0xa20 net/core/net_namespace.c:375
 copy_net_ns+0x361/0x530 net/core/net_namespace.c:524
 create_new_namespaces+0x3ce/0x700 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x11a/0x160 kernel/nsproxy.c:228
 ksys_unshare+0x4fa/0x8f0 kernel/fork.c:3447
 __do_sys_unshare kernel/fork.c:3521 [inline]
 __se_sys_unshare kernel/fork.c:3519 [inline]
 __x64_sys_unshare+0x38/0x40 kernel/fork.c:3519
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f02d01a0827
RSP: 002b:00007ffccbf96428 EFLAGS: 00000202 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f02d0425f40 RCX: 00007f02d01a0827
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f02d04267b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffccbf96668 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:22350 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25000 pid:22350 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 register_nexthop_notifier+0x88/0x240 net/ipv4/nexthop.c:3646
 ops_init+0x391/0x640 net/core/net_namespace.c:139
 setup_net+0x3b6/0xa20 net/core/net_namespace.c:343
 copy_net_ns+0x361/0x530 net/core/net_namespace.c:524
 create_new_namespaces+0x3ce/0x700 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x11a/0x160 kernel/nsproxy.c:228
 ksys_unshare+0x4fa/0x8f0 kernel/fork.c:3447
 __do_sys_unshare kernel/fork.c:3521 [inline]
 __se_sys_unshare kernel/fork.c:3519 [inline]
 __x64_sys_unshare+0x38/0x40 kernel/fork.c:3519
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0b067a0827
RSP: 002b:00007ffe6f789508 EFLAGS: 00000206 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f0b06a25f40 RCX: 00007f0b067a0827
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f0b06a267b8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffe6f789748 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:22365 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25384 pid:22365 ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:78 [inline]
 rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2554
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x856/0x9e0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1903
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x4a9/0x6b0 net/socket.c:2201
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0xde/0xf0 net/socket.c:2209
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7faa7675fd8e
RSP: 002b:00007fff6f1450f8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555576c07500 RCX: 00007faa7675fd8e
RDX: 0000000000000028 RSI: 00007faa77554670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007fff6f145174 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007faa77554670 R15: 0000000000000000
 </TASK>
INFO: task syz.3.5295:22373 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.5295      state:D stack:26888 pid:22373 ppid:15583  flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5393 [inline]
 __schedule+0x156f/0x4720 kernel/sched/core.c:6722
 schedule+0xbd/0x170 kernel/sched/core.c:6796
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6855
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x689/0xce0 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:78 [inline]
 rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2554
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x856/0x9e0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1903
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x61b/0x980 net/socket.c:2595
 ___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2687 [inline]
 __se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe0dd79f559
RSP: 002b:00007fe0de669028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fe0dda25fa0 RCX: 00007fe0dd79f559
RDX: 0000000000004054 RSI: 00002000000002c0 RDI: 0000000000000003
RBP: 00007fe0dd836b50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe0dda26038 R14: 00007fe0dda25fa0 R15: 00007ffc4397fc78
 </TASK>

Showing all locks held in the system:
4 locks held by kworker/0:1/9:
1 lock held by khungtaskd/29:
 #0: ffffffff8e1322e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8e1322e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8e1322e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6669
4 locks held by kworker/u4:9/2949:
3 locks held by kworker/u4:11/2961:
3 locks held by kworker/u4:15/3560:
 #0: ffff888018c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888018c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000cf77d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000cf77d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
1 lock held by dhcpcd/5452:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: devinet_ioctl+0x2fc/0x1d70 net/ipv4/devinet.c:1101
2 locks held by getty/5549:
 #0: ffff88802efd60a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000327e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x43a/0x1400 drivers/tty/n_tty.c:2217
3 locks held by kworker/0:7/5890:
 #0: ffff888018c70d38 ((wq_completion)events#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888018c70d38 ((wq_completion)events#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc900048ffd00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc900048ffd00 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
3 locks held by kworker/0:9/15455:
 #0: ffff888018c72538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888018c72538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc900032c7d00 ((check_lifetime_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc900032c7d00 ((check_lifetime_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: check_lifetime+0x42c/0x990 net/ipv4/devinet.c:759
3 locks held by kworker/u4:6/22022:
 #0: ffff88802deffd38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff88802deffd38 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc900042ffd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc900042ffd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4737
2 locks held by syz-executor/22247:
 #0: ffffffff8f3db1d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x347/0x530 net/core/net_namespace.c:520
 #1: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: cfg802154_pernet_exit+0x18/0xc0 net/ieee802154/core.c:329
2 locks held by syz-executor/22264:
 #0: ffffffff8f3db1d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x347/0x530 net/core/net_namespace.c:520
 #1: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: ip_tunnel_delete_nets+0xd6/0x380 net/ipv4/ip_tunnel.c:1152
2 locks held by syz-executor/22350:
 #0: ffffffff8f3db1d0 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x347/0x530 net/core/net_namespace.c:520
 #1: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x88/0x240 net/ipv4/nexthop.c:3646
1 lock held by syz-executor/22365:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz.3.5295/22373:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz-executor/22393:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz-executor/22403:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz-executor/22412:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz.0.5309/22423:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz.0.5309/22424:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz-executor/22428:
1 lock held by syz-executor/22429:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz-executor/22433:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz-executor/22437:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz-executor/22439:
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f3e83c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6486
1 lock held by syz-executor/22443:
1 lock held by syz-executor/22445:

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/01 03:31 linux-6.6.y b5a1dc3ad482 25a0ae84 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in devinet_ioctl
* Struck through repros no longer work on HEAD.