BUG: soft lockup in monitor_device_close

Status: moderation: reported on 2026/10/11 18:39
Subsystems: gfs2
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+3e975727acff79a0d29a@syzkaller.appspotmail.com
First crash: 4d03h, last: 4d03h
▶ ▼ ✨ AI Jobs (2)
ID Workflow Result Correct Bug Created Started Finished Revision
810b2edc repro-c 💥 BUG: soft lockup in monitor_device_close 2026/10/10 02:21 2026/10/10 02:21 2026/10/10 03:18 549ef7e3
65630da2 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: soft lockup in monitor_device_close 2026/10/09 00:00 2026/10/09 00:00 2026/10/09 00:36 723be09b

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz.5.1652:13010]
Modules linked in:
irq event stamp: 4224
hardirqs last  enabled at (4223): [<ffff8000804d5c74>] __call_rcu_common kernel/rcu/tree.c:3206 [inline]
hardirqs last  enabled at (4223): [<ffff8000804d5c74>] call_rcu+0x3bc/0x634 kernel/rcu/tree.c:3301
hardirqs last disabled at (4222): [<ffff8000804d59cc>] __call_rcu_common kernel/rcu/tree.c:3183 [inline]
hardirqs last disabled at (4222): [<ffff8000804d59cc>] call_rcu+0x114/0x634 kernel/rcu/tree.c:3301
softirqs last  enabled at (4202): [<ffff80008013836c>] local_bh_enable include/linux/bottom_half.h:33 [inline]
softirqs last  enabled at (4202): [<ffff80008013836c>] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline]
softirqs last  enabled at (4202): [<ffff80008013836c>] do_sve_acc+0x3ac/0x56c arch/arm64/kernel/fpsimd.c:1333
softirqs last disabled at (4224): [<ffff800080f34358>] spin_lock_bh include/linux/spinlock.h:353 [inline]
softirqs last disabled at (4224): [<ffff800080f34358>] dlm_stop_lockspaces+0x2c/0x160 fs/dlm/lockspace.c:826
CPU: 0 UID: 0 PID: 13010 Comm: syz.5.1652 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : lock_acquire+0x168/0x320 arch/arm64/include/asm/irqflags.h:-1
lr : lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline]
lr : lock_acquire+0x148/0x320 kernel/locking/lockdep.c:5945
sp : ffff800095217b40
x29: ffff800095217b90 x28: 0000000000000000 x27: ffff0000d135d880
x26: ffff800088a222f8 x25: 0000000000000000 x24: 0000000000000001
x23: 0000000000000000 x22: ffff80008e849b58 x21: ffff800080f34358
x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 000000000001c374 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000003 x9 : 0000000000000000
x8 : 00000000000000c0 x7 : 0000000000000000 x6 : ffff800080482944
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000804928a4
x2 : 0000000100000201 x1 : ffff0000d135d880 x0 : 0000000000000000
Call trace:
 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
 lock_acquire+0x168/0x320 kernel/locking/lockdep.c:5946 (P)
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:182 [inline]
 _raw_spin_lock_bh+0x48/0x60 kernel/locking/spinlock.c:205
 spin_lock_bh include/linux/spinlock.h:353 [inline]
 dlm_stop_lockspaces+0x2c/0x160 fs/dlm/lockspace.c:826
 monitor_device_close+0x60/0xf0 fs/dlm/user.c:921
 __fput+0x338/0x74c fs/file_table.c:512
 ____fput+0x20/0x30 fs/file_table.c:540
 task_work_run+0x1cc/0x25c kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x10c/0x17c kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:146 [inline]
 el0_svc+0x12c/0x1d8 arch/arm64/kernel/entry-common.c:797
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 4697 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : check_kcov_mode+0x8/0x54 kernel/kcov.c:179
lr : __sanitizer_cov_trace_pc+0x28/0x5c kernel/kcov.c:213
sp : ffff800096eb7560
x29: ffff800096eb7560 x28: 0000000000000003 x27: dfff800000000000
x26: 0000000000000001 x25: ffff0000d0598e58 x24: 0000001b34024000
x23: 0000000000000dff x22: 000000000000003f x21: 0000000000000000
x20: ffff0000d2d53b00 x19: ffff8000809f037c x18: ffff800125498000
x17: ffff0001aded5e12 x16: ffff0000d2d53b14 x15: 0000000000000001
x14: 000000008686bb60 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff60001a0b31cb x9 : 0000000000000000
x8 : ffff0000d2d53b00 x7 : 0000000000000000 x6 : ffff800080aaef7c
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff8000809f0328
x2 : 000000000000003f x1 : ffff0000d2d53b00 x0 : 0000000000000002
Call trace:
 preempt_count arch/arm64/include/asm/preempt.h:12 [inline] (P)
 check_kcov_mode+0x8/0x54 kernel/kcov.c:179 (P)
 __mapping_rmap_tree_augment_propagate mm/interval_tree.c:16 [inline]
 __rb_erase_augmented include/linux/rbtree_augmented.h:342 [inline]
 rb_erase_augmented include/linux/rbtree_augmented.h:350 [inline]
 rb_erase_augmented_cached include/linux/rbtree_augmented.h:361 [inline]
 __mapping_rmap_tree_remove mm/interval_tree.c:16 [inline]
 mapping_rmap_tree_remove+0x888/0x8f8 mm/interval_tree.c:64
 __remove_shared_vm_struct+0x16c/0x1d4 mm/vma.c:297
 unlink_file_vma_batch_process+0x160/0x24c mm/vma.c:1883
 unlink_file_vma_batch_add+0xec/0x1d0 mm/vma.c:1898
 free_pgtables+0x470/0x6f4 mm/memory.c:415
 exit_mmap+0x3ac/0x9bc mm/mmap.c:1327
 __mmput+0xe0/0x2e8 kernel/fork.c:1193
 mmput+0x70/0xa8 kernel/fork.c:1216
 exit_mm+0x13c/0x1f0 kernel/exit.c:592
 do_exit+0x524/0x1a74 kernel/exit.c:974
 do_group_exit+0x198/0x238 kernel/exit.c:1129
 __do_sys_exit_group kernel/exit.c:1140 [inline]
 __se_sys_exit_group kernel/exit.c:1138 [inline]
 pid_child_should_wake+0x0/0x104 kernel/exit.c:1138
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/07 18:32 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 71c3e5409eef 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: soft lockup in monitor_device_close
* Struck through repros no longer work on HEAD.