syzbot
BUG: workqueue lockup in mld_ifc_work
Status:
premoderation: reported syz repro on 2026/10/20 13:53
Reported-by: syzbot+73df53c9acd26f9b178b@syzkaller.appspotmail.com
First crash: 10d, last: 10d
Sample crash report:
BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 260s!
BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=0 stuck for 263s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x0
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=6 refcnt=7
pending: psi_avgs_work, vmstat_shepherd, 4*rht_deferred_worker
workqueue events_long: flags=0x0
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: 2*br_multicast_gc_work
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: 2*br_multicast_gc_work
workqueue events_unbound: flags=0x2
pwq 8: cpus=0-1 flags=0x4 nice=0 active=2 refcnt=3
pending: toggle_allocation_gate, flush_memcg_stats_dwork
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: crng_reseed
workqueue events_freezable: flags=0x4
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: update_balloon_stats_func
workqueue events_power_efficient: flags=0x80
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=5 refcnt=6
pending: 2*neigh_managed_work, gc_worker, 2*neigh_periodic_work
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_ratelimiter_gc_entries, check_lifetime
workqueue kvfree_rcu_reclaim: flags=0xa
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: kfree_rcu_monitor
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: kfree_rcu_monitor
workqueue mm_percpu_wq: flags=0x8
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: vmstat_update
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: vmstat_update
workqueue writeback: flags=0x4a
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wb_workfn
workqueue mld: flags=0x40008
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=59
in-flight: 64:mld_ifc_work
inactive: mld_dad_work, mld_ifc_work, 2*mld_dad_work, 2*mld_ifc_work, 16*mld_dad_work, 3*mld_ifc_work, 12*mld_dad_work, 2*mld_ifc_work, mld_dad_work, 3*mld_ifc_work, 14*mld_dad_work
workqueue ipv6_addrconf: flags=0x6000a
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=156
pending: addrconf_dad_work
inactive: 147*addrconf_dad_work, 5*addrconf_verify_work
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-kex-wg1: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x28
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x28
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x28
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-kex-wg1: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
pwq 8: cpus=0-1 flags=0x4 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
pool 2: cpus=0 node=0 flags=0x0 nice=0 hung=260s workers=4 idle: 395 405 10
Showing backtraces of running workers in stalled CPU-bound worker pools:
pool 2:
task:kworker/0:2 state:R running task stack:0 pid:64 tgid:64 ppid:2 flags:0x00004000
Workqueue: mld mld_ifc_work
Call Trace:
<TASK>
context_switch kernel/sched/core.c:6063 [inline]
__schedule+0x16fe/0x23d0 kernel/sched/core.c:7883
preempt_schedule_irq+0xab/0x110 kernel/sched/core.c:8205
raw_irqentry_exit_cond_resched+0x32/0x40 kernel/entry/common.c:311
irqentry_exit+0x4a/0x60 kernel/entry/common.c:354
sysvec_apic_timer_interrupt+0x50/0x90 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1f/0x30 arch/x86/include/asm/idtentry.h:702
RIP: 0010:process_one_work kernel/workqueue.c:3273 [inline]
RIP: 0010:process_scheduled_works+0x7e3/0x1060 kernel/workqueue.c:3354
Code: 1f 44 00 00 e8 9e 53 32 00 48 b8 00 00 00 00 00 fc ff df 41 80 3c 07 00 74 08 4c 89 ef e8 25 ce 8b 00 4d 8b 5d 00 48 8b 7d b8 <41> ba 57 d6 75 cc 45 03 53 f1 74 02 0f 0b 2e e8 11 27 a9 1e 48 b8
RSP: 0018:ffffc90000d4fc98 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffff88810d6dbb40
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8881157780c0
RBP: ffffc90000d4fdb0 R08: ffff8881157780c7 R09: 1ffff11022aef018
R10: dffffc0000000000 R11: ffffffff85066310 R12: 1ffff11021adb818
R13: ffff888107332d18 R14: ffff88810d6dc0c4 R15: 1ffff11020e665a3
worker_thread+0xc99/0x13f0 kernel/workqueue.c:3435
kthread+0x2c7/0x360 kernel/kthread.c:389
ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 44 00 00 add %r8b,(%rax)
3: e8 9e 53 32 00 call 0x3253a6
8: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
f: fc ff df
12: 41 80 3c 07 00 cmpb $0x0,(%r15,%rax,1)
17: 74 08 je 0x21
19: 4c 89 ef mov %r13,%rdi
1c: e8 25 ce 8b 00 call 0x8bce46
21: 4d 8b 5d 00 mov 0x0(%r13),%r11
25: 48 8b 7d b8 mov -0x48(%rbp),%rdi
* 29: 41 ba 57 d6 75 cc mov $0xcc75d657,%r10d <-- trapping instruction
2f: 45 03 53 f1 add -0xf(%r11),%r10d
33: 74 02 je 0x37
35: 0f 0b ud2
37: 2e e8 11 27 a9 1e cs call 0x1ea9274e
3d: 48 rex.W
3e: b8 .byte 0xb8
Struck through repros no longer work on HEAD.