syzbot
BUG: soft lockup in syscall_exit_to_user_mode (3)
Status:
upstream: reported C repro on 2026/10/05 05:52
Reported-by: syzbot+53bd9504cbf2b21e827b@syzkaller.appspotmail.com
First crash: 34d, last: 1d06h
Sample crash report:
hrtimer: interrupt took 73320 ns
watchdog: BUG: soft lockup - CPU#0 stuck for 184s! [syz-executor177:304]
Modules linked in:
CPU: 0 PID: 304 Comm: syz-executor177 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:ffs arch/x86/include/asm/bitops.h:297 [inline]
RIP: 0010:handle_softirqs+0x10d/0x560 kernel/softirq.c:571
Code: 08 85 e8 96 2c 70 03 65 66 c7 05 9c 36 c4 7e 00 00 48 c7 c7 20 2c 08 85 e8 80 2c 70 03 65 44 89 35 e0 38 c3 7e fb 44 89 75 a4 <b8> ff ff ff ff 0f bc 45 a4 41 89 c5 41 ff c5 0f 85 c0 00 00 00 48
RSP: 0018:ffffc90000007f38 EFLAGS: 00000282
RAX: 0000000000000000 RBX: ffff88810b0d0002 RCX: 4c59160a1e39fa00
RDX: 1ffffffff0e18c00 RSI: ffffffff85082c20 RDI: ffffffff85639540
RBP: ffffc90000007fc0 R08: ffffffff870c6008 R09: ffffffff870c6018
R10: ffffffff870c6003 R11: 1ffffffff0e18c00 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 000000000000000a
FS: 0000555555c5b3c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000008000000002 CR3: 000000011e5ee000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
__do_softirq kernel/softirq.c:621 [inline]
invoke_softirq kernel/softirq.c:443 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:finish_task_switch+0x173/0x790 kernel/sched/core.c:5050
Code: 80 3c 2b 00 74 08 4c 89 f7 e8 19 c3 60 00 4d 8b 2e 4d 85 ed 0f 85 cd 00 00 00 4c 89 e7 e8 f5 6e 6c 03 fb 49 8d 9f 38 0b 00 00 <48> 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df 42 0f b6 04 28
RSP: 0018:ffffc90000997988 EFLAGS: 00000282
RAX: 0000000080000001 RBX: ffff88810b0d1f38 RCX: 0000000000000000
RDX: 0000000040000000 RSI: 0000000000000000 RDI: 00000000ffffffff
RBP: ffffc900009979d0 R08: ffffffff86e96613 R09: 1ffffffff0dd2cc2
R10: dffffc0000000000 R11: fffffbfff0dd2cc3 R12: ffff8881f7037880
R13: 0000000000000000 R14: ffff8881f70383c8 R15: ffff88810b0d1400
context_switch kernel/sched/core.c:5181 [inline]
__schedule+0xbd7/0x14a0 kernel/sched/core.c:6538
schedule+0x11e/0x1e0 kernel/sched/core.c:6621
freezable_schedule include/linux/freezer.h:197 [inline]
ptrace_stop+0x4c7/0xa70 kernel/signal.c:2344
ptrace_signal+0x6e/0x470 kernel/signal.c:2627
get_signal+0xc5b/0x1430 kernel/signal.c:2808
arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867
handle_signal_work kernel/entry/common.c:157 [inline]
exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:181
exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:217
__syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:310
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f38ee32f9c9
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc85f17028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 0000000000000011 RBX: 0000000000000036 RCX: 00007f38ee32f9c9
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000200000000300
RBP: 0000200000000300 R08: 0000000000000000 R09: 0000000000000006
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f38ee3c2c40 R15: 0000000000000002
</TASK>
* Struck through repros no longer work on HEAD.