syzbot
BUG: workqueue lockup in batadv_tt_purge
Status:
moderation: reported on 2026/09/14 09:46
Subsystems:
netfilter
Labels:
prio:high
[Documentation on labels]
Reported-by: syzbot+647fe9d2888ca12b315d@syzkaller.appspotmail.com
First crash: 4d20h, last: 2h29m
▶
▼
Last patch testing requests (1)
Sample crash report:
BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=0 stuck for 42s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x100
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=16 refcnt=17
in-flight: 865:reg_todo for 53s
pending: 5*nsim_dev_hwstats_traffic_work, 5*psi_avgs_work, xfrm_state_gc_task, 3*ovs_dp_masks_rebalance, rt6_probe_deferred
workqueue events_unbound: flags=0x2
pwq 8: cpus=0-1 flags=0x6 nice=0 active=8 refcnt=9
in-flight: 1755:nsim_dev_trap_report_work for 3s ,5211:nsim_dev_trap_report_work for 4s ,5207:cfg80211_wiphy_work for 9s ,5193:toggle_allocation_gate for 2s ,1054:nsim_dev_trap_report_work for 4s
pending: 3*nsim_dev_trap_report_work
pwq 8: cpus=0-1 flags=0x6 nice=0 active=11 refcnt=12
in-flight: 13:cfg80211_wiphy_work for 53s cfg80211_wiphy_work ,5185:cfg80211_wiphy_work for 48s cfg80211_wiphy_work ,40:cfg80211_wiphy_work for 49s cfg80211_wiphy_work ,1187:cfg80211_wiphy_work for 53s cfg80211_wiphy_work ,54:cfg80211_wiphy_work for 45s cfg80211_wiphy_work ,7040:nsim_dev_trap_report_work for 1s
workqueue events_power_efficient: flags=0x82
pwq 8: cpus=0-1 flags=0x6 nice=0 active=2 refcnt=3
in-flight: 5202:gc_worker for 5s
pending: fb_flashcursor
pwq 8: cpus=0-1 flags=0x6 nice=0 active=2 refcnt=3
in-flight: 256:neigh_periodic_work for 50s ,5210:crda_timeout_work for 49s
workqueue events_dfl_long: flags=0x2
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
in-flight: 5215:defense_work_handler for 0s
workqueue mm_percpu_wq: flags=0x108
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: vmstat_update
workqueue writeback: flags=0x4a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
in-flight: 5205:wb_workfn for 53s
workqueue iou_exit: flags=0x2
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
in-flight: 12:io_ring_exit_work for 54s
workqueue bat_events: flags=0x6000a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=43 MAYDAY
in-flight: 2853(RESCUER):batadv_tt_purge for 20s
inactive: 2*batadv_tt_purge, batadv_mcast_mla_update, batadv_tt_purge, batadv_dat_purge, batadv_bla_periodic_work, 2*batadv_mcast_mla_update, batadv_bla_periodic_work, 2*batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, 2*batadv_mcast_mla_update, 3*batadv_purge_orig, 11*batadv_iv_send_outstanding_bat_ogm_packet, 2*batadv_purge_orig, 2*batadv_iv_send_outstanding_bat_ogm_packet, batadv_tt_purge
workqueue wg-crypt-wg0: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_tx_worker, wg_packet_decrypt_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x124
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x124
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker
pool 6: cpus=1 node=0 flags=0x0 nice=0 hung=42s workers=8 idle: 5701 5703 4708 26 24 4469 4556
pool 8: cpus=0-1 flags=0x6 nice=0 hung=0s workers=18 manager: 7041
Showing backtraces of busy workers in stalled worker pools:
pool 6: no worker in running state, cpu=1 is busy (nr_workers=8 nr_idle=7)
The pool might have trouble waking an idle worker.
Backtrace of last woken worker:
task:kworker/1:6 state:R running task stack:0 pid:5701 tgid:5701 ppid:2 task_flags:0x4208060 flags:0x00000010
Workqueue: 0x0 (events)
Call trace:
__switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T)
context_switch kernel/sched/core.c:5520 [inline]
__schedule+0x1370/0x2d80 kernel/sched/core.c:7270
__schedule_loop kernel/sched/core.c:7347 [inline]
schedule+0x13c/0x20c kernel/sched/core.c:7362
worker_thread+0x924/0xbd0 kernel/workqueue.c:3566
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 2853 Comm: kworker/R-bat_e Tainted: G L syzkaller #0 PREEMPT
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: bat_events batadv_tt_purge
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : should_resched arch/arm64/include/asm/preempt.h:98 [inline]
pc : __local_bh_enable_ip+0x1f0/0x35c kernel/softirq.c:480
lr : __local_bh_enable_ip+0x1ec/0x35c kernel/softirq.c:478
sp : ffff80008ec47550
x29: ffff80008ec47560 x28: ffff0000db184840 x27: 1fffe0001b630925
x26: ffff0000d4b08120 x25: ffff000103b18780 x24: 0000000000000001
x23: dfff800000000000 x22: 1fffe000199b63b1 x21: ffff8000856802e0
x20: 0000000000000200 x19: ffff0000ccdb1d88 x18: 000000005a04234d
x17: ffff80012517a000 x16: ffff80008ec40000 x15: 0000000039402882
x14: 00000000ffff8000 x13: 0000000000000004 x12: 0000000000000003
x11: ffff80008a6a6e28 x10: 0000000000000003 x9 : 0000000000000000
x8 : 0000000002a191d6 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000008 x3 : ffff8000801561b4
x2 : 0000000000000002 x1 : ffff0000ccdb1d80 x0 : ffff80012517a000
Call trace:
__daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
__local_bh_enable_ip+0x1f0/0x35c kernel/softirq.c:478 (P)
local_bh_enable include/linux/bottom_half.h:33 [inline]
ipt_do_table+0x103c/0x1288 net/ipv4/netfilter/ip_tables.c:357
iptable_mangle_hook+0x13c/0x3f4 net/ipv4/netfilter/iptable_mangle.c:80
nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
nf_hook_slow+0xc8/0x224 net/netfilter/core.c:619
nf_hook include/linux/netfilter.h:280 [inline]
NF_HOOK+0x1f0/0x398 include/linux/netfilter.h:323
ip_local_deliver+0x128/0x188 net/ipv4/ip_input.c:262
dst_input include/net/dst.h:480 [inline]
ip_rcv_finish+0x20c/0x230 net/ipv4/ip_input.c:492
NF_HOOK+0x308/0x398 include/linux/netfilter.h:325
ip_rcv+0x7c/0x9c net/ipv4/ip_input.c:612
__netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6264
__netif_receive_skb+0x34/0x128 net/core/dev.c:6377
process_backlog+0x5f4/0x16f8 net/core/dev.c:6728
__napi_poll+0xb4/0x328 net/core/dev.c:7787
napi_poll net/core/dev.c:7850 [inline]
net_rx_action+0x5b0/0xc14 net/core/dev.c:8007
handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645
__do_softirq+0x14/0x20 kernel/softirq.c:679
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
do_softirq+0x90/0xf8 kernel/softirq.c:546
__local_bh_enable_ip+0x240/0x35c kernel/softirq.c:473
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
_raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245
spin_unlock_bh include/linux/spinlock.h:407 [inline]
batadv_tt_global_purge net/batman-adv/translation-table.c:2390 [inline]
batadv_tt_purge+0x3e4/0x7b4 net/batman-adv/translation-table.c:3754
process_one_work kernel/workqueue.c:3387 [inline]
process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
rescuer_thread+0x68c/0xd90 kernel/workqueue.c:3694
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
* Struck through repros no longer work on HEAD.