syzbot


INFO: task hung in cfg80211_event_work (4)

Status: upstream: reported syz repro on 2024/10/10 15:19
Subsystems: wireless
[Documentation on labels]
Reported-by: syzbot+5506b2556159a1ab6923@syzkaller.appspotmail.com
First crash: 178d, last: 6d01h
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [wireless?] INFO: task hung in cfg80211_event_work (4) 3 (5) 2024/10/14 14:38
Similar bugs (4)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in cfg80211_event_work (2) wireless C done error 3 382d 624d 0/28 auto-obsoleted due to no activity on 2024/06/18 14:16
upstream INFO: task hung in cfg80211_event_work (3) wireless 1 270d 270d 0/28 auto-obsoleted due to no activity on 2024/09/28 13:35
upstream INFO: task hung in cfg80211_event_work wireless C unreliable error 4 1531d 1564d 0/28 closed as invalid on 2022/02/08 10:49
linux-4.19 INFO: task hung in cfg80211_event_work 1 797d 797d 0/1 upstream: reported on 2023/01/21 03:03
Last patch testing requests (11)
Created Duration User Patch Repo Result
2025/03/22 05:32 19m retest repro upstream report log
2025/03/22 05:32 20m retest repro upstream report log
2025/03/15 12:36 20m retest repro upstream report log
2025/03/15 12:36 19m retest repro upstream report log
2025/02/22 22:47 22m retest repro upstream report log
2025/02/17 05:15 22m retest repro upstream report log
2025/02/17 05:15 23m retest repro upstream report log
2025/01/11 04:54 16m retest repro upstream report log
2025/01/11 04:54 17m retest repro upstream report log
2024/12/14 22:21 17m retest repro upstream report log
2024/10/14 02:53 20m lizhi.xu@windriver.com patch upstream report log

Sample crash report:
INFO: task kworker/R-cfg80:54 blocked for more than 143 seconds.
      Not tainted 6.14.0-rc4-syzkaller-00212-g276f98efb64a #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/R-cfg80 state:D stack:27992 pid:54    tgid:54    ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: cfg80211 cfg80211_event_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0x190e/0x4c90 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6857
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:6914
 __mutex_lock_common kernel/locking/mutex.c:662 [inline]
 __mutex_lock+0x817/0x1010 kernel/locking/mutex.c:730
 class_wiphy_constructor include/net/cfg80211.h:6061 [inline]
 cfg80211_event_work+0x24/0x60 net/wireless/core.c:329
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3319
 rescuer_thread+0x650/0xf90 kernel/workqueue.c:3496
 kthread+0x7a9/0x920 kernel/kthread.c:464
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/u4:1/12:
3 locks held by kworker/u4:2/24:
1 lock held by khungtaskd/26:
 #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline]
 #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline]
 #0: ffffffff8eb38fa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x55/0x2a0 kernel/locking/lockdep.c:6746
3 locks held by kworker/u4:3/41:
3 locks held by kworker/R-cfg80/54:
 #0: ffff888032d9f948 ((wq_completion)cfg80211){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff888032d9f948 ((wq_completion)cfg80211){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319
 #1: ffffc9000102fbe0 ((work_completion)(&rdev->event_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc9000102fbe0 ((work_completion)(&rdev->event_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319
 #2: ffff8880442b0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6061 [inline]
 #2: ffff8880442b0768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_event_work+0x24/0x60 net/wireless/core.c:329
3 locks held by kworker/u4:4/65:
3 locks held by kworker/u4:5/130:
3 locks held by kworker/u4:6/1033:
3 locks held by kworker/u4:8/1043:
2 locks held by kworker/u4:9/1134:
1 lock held by klogd/4713:
 #0: ffff88801fc3e958 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2a/0x140 kernel/sched/core.c:598
2 locks held by getty/5101:
 #0: ffff888000b310a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000019b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x616/0x1770 drivers/tty/n_tty.c:2211
2 locks held by kworker/0:4/5438:
1 lock held by syz-executor/5445:
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:698 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3b/0x1b0 drivers/net/tun.c:3517
2 locks held by syz-executor/5446:
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_detach drivers/net/tun.c:698 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3b/0x1b0 drivers/net/tun.c:3517
 #1: ffffffff8eb3e478 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:302 [inline]
 #1: ffffffff8eb3e478 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x381/0x820 kernel/rcu/tree_exp.h:996
1 lock held by syz-executor/5448:
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnetlink_rcv_msg+0x6e6/0xcf0 net/core/rtnetlink.c:6918
2 locks held by kworker/0:5/5450:
1 lock held by syz-executor/5458:
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:79 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:335 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0xc55/0x1d30 net/core/rtnetlink.c:4021
1 lock held by syz-executor/5464:
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x47e/0x1bc0 net/ipv4/devinet.c:987
1 lock held by syz-executor/5466:
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: inet6_rtm_newaddr+0x7bf/0xf10 net/ipv6/addrconf.c:5023
2 locks held by kworker/0:8/5632:
3 locks held by kworker/u4:10/5647:
 #0: ffff88801b079148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88801b079148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319
 #1: ffffc9000cd87c60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc9000cd87c60 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319
 #2: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:285
3 locks held by kworker/u4:13/5650:
3 locks held by kworker/u4:16/5653:
 #0: ffff88803f67e148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88803f67e148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319
 #1: ffffc90001ab7c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc90001ab7c60 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319
 #2: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline]
 #2: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x10e/0x16a0 net/ipv6/addrconf.c:4190
3 locks held by kworker/u4:17/5654:
3 locks held by kworker/u4:19/5656:
3 locks held by kworker/u4:21/5659:
1 lock held by syz-executor/5664:
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x47e/0x1bc0 net/ipv4/devinet.c:987
3 locks held by kworker/0:11/5667:
 #0: ffff88801b075d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3213 [inline]
 #0: ffff88801b075d48 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x98b/0x18e0 kernel/workqueue.c:3319
 #1: ffffc9000cf27c60 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3214 [inline]
 #1: ffffc9000cf27c60 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x9c6/0x18e0 kernel/workqueue.c:3319
 #2: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x99/0xfb0 net/wireless/reg.c:2480
1 lock held by syz-executor/5679:
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:129 [inline]
 #0: ffffffff8fed55c8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x47e/0x1bc0 net/ipv4/devinet.c:987

Crashes (10):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/03/01 12:33 upstream 276f98efb64a 67cf5345 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in cfg80211_event_work
2025/02/26 22:21 upstream ac9c34d1e45a 6a8fcbc4 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in cfg80211_event_work
2025/02/03 04:58 upstream 69e858e0b8b2 568559e4 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in cfg80211_event_work
2024/11/30 22:11 upstream d8b78066f4c9 68914665 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in cfg80211_event_work
2024/11/11 15:50 upstream 2d5404caa8c7 0c4b1325 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in cfg80211_event_work
2024/10/19 04:10 upstream b04ae0f45168 cd6fc0a3 .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in cfg80211_event_work
2024/10/07 01:30 upstream 2a130b7e1fcd d7906eff .config console log report syz / log [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in cfg80211_event_work
2024/10/11 01:51 upstream d3d1556696c1 8fbfc0c8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in cfg80211_event_work
2024/10/11 00:34 upstream d3d1556696c1 8fbfc0c8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 INFO: task hung in cfg80211_event_work
2024/09/30 08:34 upstream 9852d85ec9d4 ba29ff75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 INFO: task hung in cfg80211_event_work
* Struck through repros no longer work on HEAD.