INFO: task hung in rtnetlink_rcv_msg (2)

Status: upstream: reported on 2026/05/16 14:21
Reported-by: syzbot+40666be185ef012c4b9a@syzkaller.appspotmail.com
First crash: 145d, last: 21h29m
▶ ▼ Similar bugs (19)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in rtnetlink_rcv_msg 1 1 1182d 1182d 0/3 auto-obsoleted due to no activity on 2023/10/22 21:13
linux-4.19 INFO: task hung in rtnetlink_rcv_msg (2) 1 14 1725d 1904d 0/1 auto-closed as invalid on 2022/05/18 11:30
linux-4.19 INFO: task hung in rtnetlink_rcv_msg (3) 1 8 1337d 1571d 0/1 upstream: reported on 2022/06/20 23:55
linux-4.19 INFO: task hung in rtnetlink_rcv_msg 1 11 2156d 2478d 0/1 auto-closed as invalid on 2021/03/12 19:03
upstream INFO: task hung in rtnetlink_rcv_msg (2) net 1 syz, C inconclusive 548 564d 772d 0/29 closed as invalid on 2025/04/18 16:40
linux-5.15 INFO: task hung in rtnetlink_rcv_msg (4) origin:upstream 1 syz 4 43d 187d 0/3 upstream: reported syz repro on 2026/04/05 04:20
upstream INFO: task hung in rtnetlink_rcv_msg (4) prio:normal net 1 syz 59 4d15h 396d 0/29 closed as invalid on 2026/10/06 01:41
linux-6.1 INFO: task hung in rtnetlink_rcv_msg (3) origin:upstream 1 syz, C error 25 19d 749d 0/3 upstream: reported C repro on 2024/09/19 14:16
linux-5.15 INFO: task hung in rtnetlink_rcv_msg (3) 1 1 540d 540d 0/3 auto-obsoleted due to no activity on 2025/07/26 04:34
upstream INFO: task hung in rtnetlink_rcv_msg net 1 syz, C inconclusive inconclusive 1970 822d 2785d 26/29 fixed on 2024/07/09 19:14
linux-4.14 INFO: task hung in rtnetlink_rcv_msg 1 1 1317d 1317d 0/1 upstream: reported on 2023/03/01 21:15
linux-5.15 INFO: task hung in rtnetlink_rcv_msg (2) 1 70 692d 984d 0/3 auto-obsoleted due to no activity on 2025/01/24 13:11
android-6-12 INFO: task hung in rtnetlink_rcv_msg (2) 1 251 7d11h 260d 0/1 premoderation: reported on 2026/01/21 16:59
linux-6.1 INFO: task hung in rtnetlink_rcv_msg (2) 1 67 822d 986d 0/3 auto-obsoleted due to no activity on 2024/09/17 07:45
linux-6.1 INFO: task hung in rtnetlink_rcv_msg 1 1 1107d 1107d 0/3 auto-obsoleted due to no activity on 2024/01/09 18:18
android-6-12 INFO: task hung in rtnetlink_rcv_msg 1 265 329d 475d 0/1 auto-obsoleted due to no activity on 2026/01/02 16:22
linux-6.6 INFO: task hung in rtnetlink_rcv_msg 1 3 248d 340d 0/2 auto-obsoleted due to no activity on 2026/05/14 04:07
upstream INFO: task hung in rtnetlink_rcv_msg (3) net 1 4 490d 531d 0/29 auto-obsoleted due to no activity on 2025/09/03 19:16
upstream INFO: task hung in cangw_pernet_exit (3) can 1 syz unreliable 290 1746d 1852d 0/29 closed as invalid on 2022/02/08 10:22

Sample crash report:
INFO: task dhcpcd:5434 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:21032 pid:5434  ppid:5433   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:78 [inline]
 rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x61b/0x980 net/socket.c:2595
 ___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2687 [inline]
 __se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fbcad6b0407
RSP: 002b:00007fffdf995bb0 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fbcad626740 RCX: 00007fbcad6b0407
RDX: 0000000000000000 RSI: 00007fffdf9a9d90 RDI: 0000000000000004
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00007fffdf9b9fc0
R13: 00007fbcad6266c8 R14: 0000000000000048 R15: 00007fffdf9a9d90
 </TASK>
INFO: task kworker/0:10:8849 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:10    state:D stack:27272 pid:8849  ppid:2      flags:0x00004000
Workqueue: events switchdev_deferred_process_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task kworker/u4:54:11911 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:54   state:D stack:24392 pid:11911 ppid:2      flags:0x00004000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 linkwatch_event+0xe/0x60 net/core/link_watch.c:286
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task syz-executor:12163 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22344 pid:12163 ppid:1      flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 nsim_init_netdevsim drivers/net/netdevsim/netdev.c:335 [inline]
 nsim_create+0x378/0x4a0 drivers/net/netdevsim/netdev.c:401
 __nsim_dev_port_add+0x761/0xb90 drivers/net/netdevsim/dev.c:1393
 nsim_dev_port_add_all+0x35/0xe0 drivers/net/netdevsim/dev.c:1449
 nsim_drv_probe+0x8ad/0xb90 drivers/net/netdevsim/dev.c:1608
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x247/0xae0 drivers/base/dd.c:717
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:879
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:909
 __device_attach_driver+0x2ca/0x510 drivers/base/dd.c:1037
 bus_for_each_drv+0x252/0x2e0 drivers/base/bus.c:459
 __device_attach+0x2c1/0x420 drivers/base/dd.c:1109
 bus_probe_device+0x180/0x260 drivers/base/bus.c:580
 device_add+0x87c/0xc40 drivers/base/core.c:3767
 nsim_bus_dev_new drivers/net/netdevsim/bus.c:290 [inline]
 new_device_store+0x37c/0x690 drivers/net/netdevsim/bus.c:167
 kernfs_fop_write_iter+0x3a4/0x520 fs/kernfs/file.c:352
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x474/0x9a0 fs/read_write.c:584
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f0cd695e9ce
RSP: 002b:00007ffdfb4151b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000555584062500 RCX: 00007f0cd695e9ce
RDX: 0000000000000003 RSI: 00007ffdfb415240 RDI: 0000000000000005
RBP: 00007f0cd6a3612f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 00007ffdfb415240 R14: 00007f0cd7754620 R15: 0000000000000003
 </TASK>
INFO: task syz.1.2327:12295 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.2327      state:D stack:27048 pid:12295 ppid:5769   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 tun_detach drivers/net/tun.c:698 [inline]
 tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3525
 __fput+0x221/0x940 fs/file_table.c:418
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f76b4d9e199
RSP: 002b:00007ffc640eb518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f76b5027da0 RCX: 00007f76b4d9e199
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f76b5027da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007f76b5027cb0 R11: 0000000000000246 R12: 000000000005a43f
R13: 00007f76b5025fac R14: 000000000005a1d8 R15: 00007ffc640eb620
 </TASK>
INFO: task syz.1.2327:12296 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.2327      state:D stack:25768 pid:12296 ppid:5769   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:78 [inline]
 rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 sock_write_iter+0x2dc/0x420 net/socket.c:1161
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x474/0x9a0 fs/read_write.c:584
 ksys_write+0x151/0x260 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f76b4d9e199
RSP: 002b:00007f76b5d32028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f76b5025fa0 RCX: 00007f76b4d9e199
RDX: 000000000000fe33 RSI: 0000200000000040 RDI: 0000000000000005
RBP: 00007f76b4e35888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f76b5026038 R14: 00007f76b5025fa0 R15: 00007ffc640eb3b8
 </TASK>
INFO: task syz.0.2331:12306 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.2331      state:D stack:24872 pid:12306 ppid:5767   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 netlink_dump+0x77c/0xec0 net/netlink/af_netlink.c:2268
 __netlink_dump_start+0x57c/0x7a0 net/netlink/af_netlink.c:2377
 netlink_dump_start include/linux/netlink.h:338 [inline]
 rtnetlink_rcv_msg+0xe19/0xf90 net/core/rtnetlink.c:6440
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x61b/0x980 net/socket.c:2595
 ___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2687 [inline]
 __se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2ba619e199
RSP: 002b:00007f2ba703d028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f2ba6425fa0 RCX: 00007f2ba619e199
RDX: 0000000000004080 RSI: 0000200000000080 RDI: 0000000000000006
RBP: 00007f2ba6235888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2ba6426038 R14: 00007f2ba6425fa0 R15: 00007ffc4976c2b8
 </TASK>
INFO: task syz.0.2331:12313 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.2331      state:D stack:26376 pid:12313 ppid:5767   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:78 [inline]
 rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x61b/0x980 net/socket.c:2595
 ___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2687 [inline]
 __se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2ba619e199
RSP: 002b:00007f2ba6fda028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f2ba6426270 RCX: 00007f2ba619e199
RDX: 0000000000000000 RSI: 0000200000000080 RDI: 0000000000000009
RBP: 00007f2ba6235888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2ba6426308 R14: 00007f2ba6426270 R15: 00007ffc4976c2b8
 </TASK>
INFO: task syz.2.2333:12310 blocked for more than 146 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.2333      state:D stack:27048 pid:12310 ppid:5768   flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 tun_detach drivers/net/tun.c:698 [inline]
 tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3525
 __fput+0x221/0x940 fs/file_table.c:418
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 exit_to_user_mode_loop+0xe6/0x110 kernel/entry/common.c:180
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc3b4f9e199
RSP: 002b:00007fffa282f518 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007fffa282f600 RCX: 00007fc3b4f9e199
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 000000000005a2b1 R08: 0000000000000001 R09: 0000000000000000
R10: 0000001b2c520000 R11: 0000000000000246 R12: 00007fffa282f640
R13: 00007fc3b5225fac R14: 000000000005a303 R15: 00007fc3b5225fa0
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/29:
 #0: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8df320e0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6669
1 lock held by dhcpcd/5434:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
2 locks held by getty/5526:
 #0: ffff88814cc120a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000327e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
3 locks held by kworker/1:5/5809:
 #0: ffff888018872538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888018872538 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc900048bfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc900048bfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x92/0xd90 net/wireless/reg.c:2463
3 locks held by kworker/0:10/8849:
 #0: ffff888018870d38 ((wq_completion)events#2){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888018870d38 ((wq_completion)events#2){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000cd6fd00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000cd6fd00 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
5 locks held by kworker/u4:52/11909:
3 locks held by kworker/u4:53/11910:
 #0: ffff88802cee7138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff88802cee7138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc90004137d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc90004137d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4737
3 locks held by kworker/u4:54/11911:
 #0: ffff888018871938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888018871938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc90004167d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc90004167d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
4 locks held by kworker/u4:56/11913:
 #0: ffff88801ae5d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff88801ae5d138 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc90004187d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc90004187d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8f1c5810 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x140/0xb00 net/core/net_namespace.c:610
 #3: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: default_device_exit_batch+0xf2/0xa00 net/core/dev.c:11788
7 locks held by syz-executor/12163:
 #0: ffff8880313ee418 (sb_writers#8){.+.+}-{0:0}, at: vfs_write+0x21e/0x9a0 fs/read_write.c:580
 #1: ffff88805ddbd888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1dc/0x520 fs/kernfs/file.c:343
 #2: ffff88802508c1f8 (kn->active#54){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
 #2: ffff88802508c1f8 (kn->active#54){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x236/0x520 fs/kernfs/file.c:344
 #3: ffffffff8eab8268 (nsim_bus_dev_list_lock){+.+.}-{3:3}, at: new_device_store+0x13d/0x690 drivers/net/netdevsim/bus.c:160
 #4: ffff8880602ac130 (&dev->mutex){....}-{3:3}, at: device_lock include/linux/device.h:1094 [inline]
 #4: ffff8880602ac130 (&dev->mutex){....}-{3:3}, at: __device_attach+0x89/0x420 drivers/base/dd.c:1084
 #5: ffff8880602af250 (&devlink->lock_key#5){+.+.}-{3:3}, at: nsim_drv_probe+0xc8/0xb90 drivers/net/netdevsim/dev.c:1537
 #6: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: nsim_init_netdevsim drivers/net/netdevsim/netdev.c:335 [inline]
 #6: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: nsim_create+0x378/0x4a0 drivers/net/netdevsim/netdev.c:401
1 lock held by syz.1.2327/12295:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3525
1 lock held by syz.1.2327/12296:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
2 locks held by syz.0.2331/12306:
 #0: ffff88807962d690 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0xf4/0x7a0 net/netlink/af_netlink.c:2341
 #1: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0x77c/0xec0 net/netlink/af_netlink.c:2268
1 lock held by syz.0.2331/12313:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz.2.2333/12310:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3525
1 lock held by syz-executor/12315:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12321:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12323:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12326:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12331:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12337:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12339:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12342:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12347:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12352:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/12354:
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8f1d2888 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 11912 Comm: kworker/u4:55 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: bat_events batadv_nc_worker
RIP: 0010:__lock_acquire+0x2f9/0x7eb0 kernel/locking/lockdep.c:-1
Code: 00 00 4c 89 7c 24 68 41 83 ff 30 0f 93 c0 83 3d 2c e3 a6 16 00 74 02 31 c0 84 c0 0f 85 c7 15 00 00 4c 89 74 24 38 44 8b 6d 30 <44> 8b 75 20 48 c7 c0 c0 93 95 91 48 29 c3 48 c1 fb 04 48 ba c5 4e
RSP: 0018:ffffc900041777c0 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffffffff9195ae90 RCX: ffffffff980f8403
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8df320e0
RBP: ffffc90004177a08 R08: dffffc0000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffffbfff1ed8b5e R12: 0000000000000000
R13: 0000000000000000 R14: ffff8880331328e0 R15: 0000000000000002
FS:  0000000000000000(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005584d8262000 CR3: 000000000dd32000 CR4: 00000000003506f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 lock_acquire+0x19e/0x420 kernel/locking/lockdep.c:5790
 rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 rcu_read_lock include/linux/rcupdate.h:786 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
 batadv_nc_worker+0xef/0x600 net/batman-adv/network-coding.c:719
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/08 15:17 linux-6.6.y a91a6aa9253c 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in rtnetlink_rcv_msg
2026/09/29 07:11 linux-6.6.y 79643295eba1 7bf4ea23 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in rtnetlink_rcv_msg
2026/09/10 21:55 linux-6.6.y 8b73de7da85f 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in rtnetlink_rcv_msg
2026/08/09 17:45 linux-6.6.y 6436c12a2ced 5d63f80b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in rtnetlink_rcv_msg
2026/07/07 23:07 linux-6.6.y da47cbc25466 76cdc0c0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in rtnetlink_rcv_msg
2026/05/16 14:20 linux-6.6.y 4d922539ad7d a15a64a6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in rtnetlink_rcv_msg
* Struck through repros no longer work on HEAD.