INFO: task hung in linkwatch_event (3)

Status: upstream: reported syz repro on 2025/09/20 20:03
Reported-by: syzbot+42d5561bdaee9b3a7582@syzkaller.appspotmail.com
First crash: 403d, last: 2d01h
▶ ▼ Similar bugs (21)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in linkwatch_event (2) 1 1 627d 627d 0/3 auto-obsoleted due to no activity on 2025/05/19 15:08
linux-6.1 INFO: task hung in linkwatch_event (5) 1 syz error 8 196d 368d 0/3 auto-obsoleted due to no activity on 2026/07/24 12:40
linux-6.1 INFO: task hung in linkwatch_event (6) origin:lts-only 1 syz 3 5d10h 72d 0/3 upstream: reported syz repro on 2026/08/17 14:48
linux-6.1 INFO: task hung in linkwatch_event (4) 1 syz 7 503d 594d 0/3 auto-obsoleted due to no activity on 2025/09/20 14:43
android-414 INFO: task hung in linkwatch_event 1 syz, C 7 2538d 2758d 0/1 public: reported C repro on 2019/04/10 16:14
linux-6.6 INFO: task hung in linkwatch_event origin:lts-only 1 syz, C inconclusive 36 6d22h 481d 0/2 upstream: reported C repro on 2025/07/04 13:16
linux-4.14 INFO: task hung in linkwatch_event (2) 1 1 1559d 1559d 0/1 auto-obsoleted due to no activity on 2022/11/19 11:58
android-44 INFO: task hung in linkwatch_event 1 6 2974d 3119d 0/2 auto-closed as invalid on 2019/03/05 13:11
linux-5.15 INFO: task hung in linkwatch_event 1 84 725d 1021d 0/3 auto-obsoleted due to no activity on 2025/01/11 00:55
upstream INFO: task hung in linkwatch_event (4) prio:low net 1 syz, C done 6022 1h38m 823d 0/29 upstream: reported C repro on 2024/07/27 06:21
upstream INFO: task hung in linkwatch_event net 1 syz, C 82 2566d 3178d 0/29 closed as dup on 2018/02/14 15:33
linux-4.14 INFO: task hung in linkwatch_event 1 5 2242d 2369d 0/1 auto-closed as invalid on 2021/01/05 01:42
linux-4.19 INFO: task hung in linkwatch_event (2) 1 syz, C error 217 1333d 2422d 0/1 upstream: reported C repro on 2020/03/11 20:12
upstream INFO: task hung in linkwatch_event (2) net 1 syz, C done done 1033 1647d 2373d 20/29 fixed on 2022/05/13 11:13
linux-4.19 INFO: task hung in linkwatch_event 1 3 2575d 2689d 0/1 auto-closed as invalid on 2020/02/07 01:11
upstream INFO: task hung in linkwatch_event (3) net 1 1634 841d 1436d 26/29 fixed on 2024/07/09 19:14
linux-4.14 INFO: task hung in linkwatch_event (3) 1 2 1393d 1394d 0/1 upstream: reported on 2023/01/03 10:49
android-49 INFO: task hung in linkwatch_event 1 13 2737d 2754d 0/3 auto-closed as invalid on 2019/10/25 08:50
linux-6.1 INFO: task hung in linkwatch_event (2) 1 32 776d 891d 0/3 auto-obsoleted due to no activity on 2024/11/21 00:32
linux-6.1 INFO: task hung in linkwatch_event 1 2 1179d 1295d 0/3 auto-obsoleted due to no activity on 2023/11/14 00:59
linux-6.1 INFO: task hung in linkwatch_event (3) 1 1 702d 702d 0/3 auto-obsoleted due to no activity on 2025/03/05 15:51

Sample crash report:
INFO: task kworker/u4:3:1208 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:3    state:D stack:21584 pid: 1208 ppid:     2 flags:0x00004000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 linkwatch_event+0xa/0x50 net/core/link_watch.c:251
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/u4:4:1238 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:4    state:D stack:23952 pid: 1238 ppid:     2 flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 netdev_run_todo+0x8dd/0xac0 net/core/dev.c:10723
 default_device_exit_batch+0x369/0x3c0 net/core/dev.c:11695
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x78e/0xba0 net/core/net_namespace.c:635
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/0:19:4343 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:19    state:D stack:25552 pid: 4343 ppid:     2 flags:0x00004000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task syz.2.56:4626 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.56        state:D stack:27408 pid: 4626 ppid:  4372 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 tun_detach drivers/net/tun.c:699 [inline]
 tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
 __fput+0x212/0x8c0 fs/file_table.c:311
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217
 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f1835981559
RSP: 002b:00007ffed5cd3588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f1835c09da0 RCX: 00007f1835981559
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f1835c09da0 R08: 00007f1835c08128 R09: 0000000000000000
R10: 000000000003fd50 R11: 0000000000000246 R12: 000000000002e966
R13: 00007f1835c0809c R14: 000000000002e7f1 R15: 00007ffed5cd3690
 </TASK>
INFO: task syz.1.55:4627 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.55        state:D stack:27408 pid: 4627 ppid:  4371 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 tun_detach drivers/net/tun.c:699 [inline]
 tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
 __fput+0x212/0x8c0 fs/file_table.c:311
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217
 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f66021d5559
RSP: 002b:00007ffd692718a8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f660245dda0 RCX: 00007f66021d5559
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f660245dda0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007f660245dcb0 R11: 0000000000000246 R12: 000000000002e938
R13: 00007f660245bfac R14: 000000000002e7f0 R15: 00007ffd692719b0
 </TASK>
INFO: task syz.1.55:4628 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.55        state:D stack:25744 pid: 4628 ppid:  4371 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571
 sock_do_ioctl+0x245/0x320 net/socket.c:1162
 sock_ioctl+0x48a/0x700 net/socket.c:1267
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f66021d5559
RSP: 002b:00007f6601834028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f660245bfa0 RCX: 00007f66021d5559
RDX: 0000200000000080 RSI: 0000000000008914 RDI: 0000000000000005
RBP: 00007f660226cb20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f660245c038 R14: 00007f660245bfa0 R15: 00007ffd69271748
 </TASK>
INFO: task syz.4.21:4631 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.21        state:D stack:27664 pid: 4631 ppid:  4378 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 tun_detach drivers/net/tun.c:699 [inline]
 tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
 __fput+0x212/0x8c0 fs/file_table.c:311
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217
 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f327ca8a559
RSP: 002b:00007ffdf45c3008 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007f327cd12da0 RCX: 00007f327ca8a559
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f327cd12da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007f327cd12cb0 R11: 0000000000000246 R12: 000000000002ea14
R13: 00007f327cd1109c R14: 000000000002e7f6 R15: 00007ffdf45c3110
 </TASK>
INFO: task syz.3.57:4634 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.57        state:D stack:27408 pid: 4634 ppid:  4377 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 tun_detach drivers/net/tun.c:699 [inline]
 tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
 __fput+0x212/0x8c0 fs/file_table.c:311
 task_work_run+0x125/0x1a0 kernel/task_work.c:188
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:184
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:217
 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline]
 syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:310
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7efde5621559
RSP: 002b:00007ffc7f7d36e8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007efde58a9da0 RCX: 00007efde5621559
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007efde58a9da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007efde58a9cb0 R11: 0000000000000246 R12: 000000000002ea41
R13: 00007efde58a809c R14: 000000000002e935 R15: 00007ffc7f7d37f0
 </TASK>
INFO: task syz.3.57:4635 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.57        state:D stack:27600 pid: 4635 ppid:  4377 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 dev_ioctl+0x449/0xe30 net/core/dev_ioctl.c:508
 sock_do_ioctl+0x245/0x320 net/socket.c:1162
 sock_ioctl+0x48a/0x700 net/socket.c:1267
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7efde5621559
RSP: 002b:00007efde4c80028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007efde58a7fa0 RCX: 00007efde5621559
RDX: 0000200000000080 RSI: 0000000000008946 RDI: 000000000000002c
RBP: 00007efde4c80090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007efde58a8038 R14: 00007efde58a7fa0 R15: 00007ffc7f7d3588
 </TASK>
INFO: task syz.3.57:4636 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.3.57        state:D stack:25744 pid: 4636 ppid:  4377 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xdf5/0x2400 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571
 sock_do_ioctl+0x245/0x320 net/socket.c:1162
 sock_ioctl+0x48a/0x700 net/socket.c:1267
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:874 [inline]
 __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7efde5621559
RSP: 002b:00007efde4c5f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007efde58a8090 RCX: 00007efde5621559
RDX: 0000200000000080 RSI: 0000000000008914 RDI: 0000000000000004
RBP: 00007efde56b8b20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efde58a8128 R14: 00007efde58a8090 R15: 00007ffc7f7d3588
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
3 locks held by kworker/u4:1/145:
 #0: ffff8880b8f3a358 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x25/0x130 kernel/sched/core.c:475
 #1: ffff8880b8f27888 (&per_cpu_ptr(group->pcpu, cpu)->seq){-.-.}-{0:0}, at: psi_task_switch+0x4c3/0x810 kernel/sched/psi.c:882
 #2: ffffffff8d11efa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x5/0x30 include/linux/rcupdate.h:312
3 locks held by kworker/u4:3/1208:
 #0: ffff888017879138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc90004c27d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251
4 locks held by kworker/u4:4/1238:
 #0: ffff8880179cd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc90004dd7d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffffffff8e25fe10 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x148/0xba0 net/core/net_namespace.c:589
 #3: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: netdev_run_todo+0x8dd/0xac0 net/core/dev.c:10723
2 locks held by getty/3951:
 #0: ffff88814d53d098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc900026562e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x594/0x1a50 drivers/tty/n_tty.c:2158
3 locks held by kworker/0:18/4342:
 #0: ffff888017871938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc9000315fd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x82/0xa90 net/wireless/reg.c:2437
3 locks held by kworker/0:19/4343:
 #0: ffff88802bab2138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x75c/0xff0 kernel/workqueue.c:-1
 #1: ffffc9000317fd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x79e/0xff0 kernel/workqueue.c:2285
 #2: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1530 net/ipv6/addrconf.c:4128
1 lock held by syz.2.56/4626:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
1 lock held by syz.1.55/4627:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
1 lock held by syz.1.55/4628:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571
1 lock held by syz.4.21/4631:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
1 lock held by syz.4.21/4638:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571
1 lock held by syz.3.57/4634:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
1 lock held by syz.3.57/4635:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x449/0xe30 net/core/dev_ioctl.c:508
1 lock held by syz.3.57/4636:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571
1 lock held by syz.0.58/4639:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:699 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x3d/0x1b0 drivers/net/tun.c:3454
1 lock held by syz.0.58/4640:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x534/0xe30 net/core/dev_ioctl.c:571
1 lock held by syz.0.58/4641:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: dev_ioctl+0x449/0xe30 net/core/dev_ioctl.c:508
1 lock held by syz-executor/4647:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4651:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4656:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4657:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4659:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4671:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4676:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4681:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4682:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4684:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4696:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4698:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4704:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4707:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695
1 lock held by syz-executor/4708:
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8e26bd48 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x79f/0xf10 net/core/rtnetlink.c:5695

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xe1b/0xe60 kernel/hung_task.c:369
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4642 Comm: kworker/u4:6 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:91 [inline]
RIP: 0010:lock_acquire+0x126/0x400 kernel/locking/lockdep.c:5713
Code: c0 0f 85 44 01 00 00 65 4c 8b 35 55 80 a5 7e 49 81 c6 ec 0a 00 00 4c 89 f0 48 c1 e8 03 42 0f b6 04 38 84 c0 0f 85 09 02 00 00 <41> 83 3e 00 0f 85 17 01 00 00 43 c6 44 3c 08 00 48 c7 84 24 a0 00
RSP: 0018:ffffc9000131f980 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 74e32f10678a8000
RDX: 0000000000000000 RSI: ffffffff8a7a4ba0 RDI: ffffffff8a7a4b60
RBP: ffffc9000131fa88 R08: ffffffff8e6d22af R09: 1ffffffff1cda455
R10: dffffc0000000000 R11: fffffbfff1cda456 R12: 1ffff92000263f3c
R13: ffff88805ad15808 R14: ffff88806b018aec R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558b6a557168 CR3: 000000002b5b2000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162
 skb_dequeue+0x29/0x150 net/core/skbuff.c:3289
 ieee80211_iface_work+0x16d/0xc50 net/mac80211/iface.c:1515
 cfg80211_wiphy_work+0x224/0x260 net/wireless/core.c:433
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Crashes (12):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/26 19:15 linux-5.15.y 792fbe1537d8 168cb7a2 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in linkwatch_event
2026/10/02 19:23 linux-5.15.y 0248c33e835e 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in linkwatch_event
2026/09/16 08:46 linux-5.15.y 0248c33e835e 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in linkwatch_event
2026/09/16 07:25 linux-5.15.y 0248c33e835e 12a0a44a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in linkwatch_event
2026/07/18 19:25 linux-5.15.y c86c4726e7f0 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in linkwatch_event
2026/05/06 21:18 linux-5.15.y ef251c45f1cd 1dddfd3d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in linkwatch_event
2026/04/27 16:54 linux-5.15.y b9d57c40a767 0f700595 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in linkwatch_event
2026/01/23 13:24 linux-5.15.y 9eec9a14ee10 e2b1b6e6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in linkwatch_event
2025/12/29 18:30 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in linkwatch_event
2025/11/06 21:27 linux-5.15.y cc5ec8769306 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in linkwatch_event
2025/10/13 19:56 linux-5.15.y 29e53a5b1c4f b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in linkwatch_event
2025/09/20 20:03 linux-5.15.y 43bb85222e53 67c37560 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in linkwatch_event
* Struck through repros no longer work on HEAD.