BUG: soft lockup in syscall_exit_to_user_mode (3)

Status: upstream: reported C repro on 2026/10/05 05:52
Reported-by: syzbot+53bd9504cbf2b21e827b@syzkaller.appspotmail.com
First crash: 34d, last: 1d06h
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in syscall_exit_to_user_mode (2) usb 1 syz, C inconclusive error 807 263d 1400d 0/29 upstream: reported C repro on 2022/12/05 19:46
android-5-15 BUG: soft lockup in syscall_exit_to_user_mode (2) 1 1 683d 683d 0/2 auto-obsoleted due to no activity on 2025/02/19 23:24
android-5-15 BUG: soft lockup in syscall_exit_to_user_mode origin:lts 1 syz, C 16 786d 865d 0/2 auto-obsoleted due to no activity on 2024/11/18 18:22
upstream INFO: rcu detected stall in syscall_exit_to_user_mode cgroups mm 1 78 1684d 1865d 20/29 fixed on 2022/03/08 16:11
linux-6.1 INFO: rcu detected stall in syscall_exit_to_user_mode origin:upstream missing-backport 1 syz, C done 374 2d20h 1278d 0/3 upstream: reported C repro on 2023/04/07 08:31
linux-6.6 INFO: rcu detected stall in syscall_exit_to_user_mode origin:lts-only 1 syz, C done 134 1d12h 468d 0/2 upstream: reported C repro on 2025/06/24 16:00
linux-5.15 INFO: rcu detected stall in syscall_exit_to_user_mode missing-backport origin:upstream 1 syz, C done 1681 19h12m 1136d 0/3 upstream: reported C repro on 2023/08/26 22:23

Sample crash report:
hrtimer: interrupt took 73320 ns
watchdog: BUG: soft lockup - CPU#0 stuck for 184s! [syz-executor177:304]
Modules linked in:
CPU: 0 PID: 304 Comm: syz-executor177 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:ffs arch/x86/include/asm/bitops.h:297 [inline]
RIP: 0010:handle_softirqs+0x10d/0x560 kernel/softirq.c:571
Code: 08 85 e8 96 2c 70 03 65 66 c7 05 9c 36 c4 7e 00 00 48 c7 c7 20 2c 08 85 e8 80 2c 70 03 65 44 89 35 e0 38 c3 7e fb 44 89 75 a4 <b8> ff ff ff ff 0f bc 45 a4 41 89 c5 41 ff c5 0f 85 c0 00 00 00 48
RSP: 0018:ffffc90000007f38 EFLAGS: 00000282
RAX: 0000000000000000 RBX: ffff88810b0d0002 RCX: 4c59160a1e39fa00
RDX: 1ffffffff0e18c00 RSI: ffffffff85082c20 RDI: ffffffff85639540
RBP: ffffc90000007fc0 R08: ffffffff870c6008 R09: ffffffff870c6018
R10: ffffffff870c6003 R11: 1ffffffff0e18c00 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 000000000000000a
FS:  0000555555c5b3c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000008000000002 CR3: 000000011e5ee000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __do_softirq kernel/softirq.c:621 [inline]
 invoke_softirq kernel/softirq.c:443 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:670
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:682
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:finish_task_switch+0x173/0x790 kernel/sched/core.c:5050
Code: 80 3c 2b 00 74 08 4c 89 f7 e8 19 c3 60 00 4d 8b 2e 4d 85 ed 0f 85 cd 00 00 00 4c 89 e7 e8 f5 6e 6c 03 fb 49 8d 9f 38 0b 00 00 <48> 89 d8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df 42 0f b6 04 28
RSP: 0018:ffffc90000997988 EFLAGS: 00000282
RAX: 0000000080000001 RBX: ffff88810b0d1f38 RCX: 0000000000000000
RDX: 0000000040000000 RSI: 0000000000000000 RDI: 00000000ffffffff
RBP: ffffc900009979d0 R08: ffffffff86e96613 R09: 1ffffffff0dd2cc2
R10: dffffc0000000000 R11: fffffbfff0dd2cc3 R12: ffff8881f7037880
R13: 0000000000000000 R14: ffff8881f70383c8 R15: ffff88810b0d1400
 context_switch kernel/sched/core.c:5181 [inline]
 __schedule+0xbd7/0x14a0 kernel/sched/core.c:6538
 schedule+0x11e/0x1e0 kernel/sched/core.c:6621
 freezable_schedule include/linux/freezer.h:197 [inline]
 ptrace_stop+0x4c7/0xa70 kernel/signal.c:2344
 ptrace_signal+0x6e/0x470 kernel/signal.c:2627
 get_signal+0xc5b/0x1430 kernel/signal.c:2808
 arch_do_signal_or_restart+0xe2/0x1100 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:157 [inline]
 exit_to_user_mode_loop+0xa7/0xe0 kernel/entry/common.c:181
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:217
 __syscall_exit_to_user_mode_work kernel/entry/common.c:299 [inline]
 syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:310
 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f38ee32f9c9
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc85f17028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 0000000000000011 RBX: 0000000000000036 RCX: 00007f38ee32f9c9
RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000200000000300
RBP: 0000200000000300 R08: 0000000000000000 R09: 0000000000000006
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f38ee3c2c40 R15: 0000000000000002
 </TASK>

Crashes (4):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/05 05:49 android13-5.15-lts f5eaed2bbe33 57bbd979 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-5-15-perf BUG: soft lockup in syscall_exit_to_user_mode
2026/09/23 08:42 android13-5.15-lts 5bfe2b8c1439 5207b90e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15-perf BUG: soft lockup in syscall_exit_to_user_mode
2026/09/10 13:55 android13-5.15-lts 6c35ef5f7a13 1fe56c0a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15-perf BUG: soft lockup in syscall_exit_to_user_mode
2026/09/01 15:12 android13-5.15-lts 656ab6019045 587f6b29 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-15-perf BUG: soft lockup in syscall_exit_to_user_mode
* Struck through repros no longer work on HEAD.