BUG: soft lockup in ext4_ioctl

Status: moderation: reported on 2026/10/25 21:16
Subsystems: fs
[Documentation on labels]
Reported-by: syzbot+bad2a6fa730d556f0f44@syzkaller.appspotmail.com
First crash: 4d03h, last: 4d03h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
7821be50 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ FuzzingArtifact: ✅ MemoryCorruption: ❌ NetworkNeedsSetup: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: soft lockup in ext4_ioctl 2026/10/23 01:07 2026/10/23 01:07 2026/10/23 01:15 33f73a1b
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: rcu detected stall in ext4_ioctl 1 1 1128d 1128d 0/3 auto-obsoleted due to no activity on 2024/01/01 17:19
linux-6.1 INFO: rcu detected stall in ext4_ioctl 1 1 1223d 1223d 0/3 auto-obsoleted due to no activity on 2023/09/28 10:18

Sample crash report:
watchdog: BUG: soft lockup - CPU#1 stuck for 47s! [syz.4.976:10108]
Modules linked in:
irq event stamp: 6321
hardirqs last  enabled at (6321): [<ffff8000868a18d4>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:210 [inline]
hardirqs last  enabled at (6321): [<ffff8000868a18d4>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:221
hardirqs last disabled at (6320): [<ffff8000868a15d4>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:153 [inline]
hardirqs last disabled at (6320): [<ffff8000868a15d4>] _raw_spin_lock_irqsave+0x2c/0x7c kernel/locking/spinlock.c:181
softirqs last  enabled at (6316): [<ffff80008013b764>] local_bh_enable include/linux/bottom_half.h:33 [inline]
softirqs last  enabled at (6316): [<ffff80008013b764>] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline]
softirqs last  enabled at (6316): [<ffff80008013b764>] kernel_neon_begin+0x294/0x400 arch/arm64/kernel/fpsimd.c:1924
softirqs last disabled at (6314): [<ffff80008013b5ec>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (6314): [<ffff80008013b5ec>] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline]
softirqs last disabled at (6314): [<ffff80008013b5ec>] kernel_neon_begin+0x11c/0x400 arch/arm64/kernel/fpsimd.c:1883
CPU: 1 UID: 0 PID: 10108 Comm: syz.4.976 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
pstate: 63400005 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : lock_acquire+0x168/0x320 arch/arm64/include/asm/irqflags.h:-1
lr : lockdep_recursion_finish kernel/locking/lockdep.c:470 [inline]
lr : lock_acquire+0x148/0x320 kernel/locking/lockdep.c:5945
sp : ffff800097446a00
x29: ffff800097446a50 x28: 0000000000000000 x27: ffff0000c9429d80
x26: ffff8000897422f8 x25: 0000000000000000 x24: 0000000000000001
x23: 0000000000000000 x22: ffff800089a9ca20 x21: ffff800080acf738
x20: 0000000000000000 x19: 0000000000000000 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 00000000000fe624 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000003 x9 : 0000000000000000
x8 : 00000000000000c0 x7 : 0000000000000000 x6 : ffff800080483084
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff800080492fe4
x2 : 0000000100000000 x1 : ffff0000c9429d80 x0 : 0000000000000001
dump_backtrace(regs = 000000000e997391 tsk = 0000000000000000)
Call trace:
 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
 lock_acquire+0x168/0x320 kernel/locking/lockdep.c:5946 (P)
 fs_reclaim_acquire+0xb8/0x110 mm/page_alloc.c:4392
 might_alloc include/linux/sched/mm.h:316 [inline]
 slab_pre_alloc_hook mm/slub.c:4636 [inline]
 slab_alloc_node mm/slub.c:4974 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kmalloc_noprof+0xd4/0x6c8 mm/slub.c:5439
 _kmalloc_noprof include/linux/slab.h:995 [inline]
 find_tree_dqentry+0x6c/0x84c fs/quota/quota_tree.c:663
 find_dqentry fs/quota/quota_tree.c:716 [inline]
 qtree_read_dquot+0x45c/0x748 fs/quota/quota_tree.c:736
 v2_read_dquot+0xe4/0x198 fs/quota/quota_v2.c:344
 dquot_acquire+0x120/0x570 fs/quota/dquot.c:489
 ext4_acquire_dquot+0x274/0x420 fs/ext4/super.c:7066
 dqget+0x658/0xa90 fs/quota/dquot.c:1002
 __dquot_initialize+0x3ac/0xa5c fs/quota/dquot.c:1462
 dquot_initialize+0x24/0x34 fs/quota/dquot.c:1524
 ext4_begin_enable_verity+0x12c/0x2d4 fs/ext4/verity.c:125
 enable_verity+0x59c/0x148c fs/verity/enable.c:236
 fsverity_ioctl_enable+0x3a0/0x410 fs/verity/enable.c:386
 __ext4_ioctl fs/ext4/ioctl.c:1892 [inline]
 ext4_ioctl+0x174c/0x4430 fs/ext4/ioctl.c:1931
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:597 [inline]
 __se_sys_ioctl fs/ioctl.c:583 [inline]
 __arm64_sys_ioctl+0x154/0x1cc fs/ioctl.c:583
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x60/0x1d8 arch/arm64/kernel/entry-common.c:796
 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:815
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:606
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 866 Comm: kworker/0:2 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: events bpf_prog_free_deferred
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : csd_lock_wait kernel/smp.c:363 [inline]
pc : csd_lock kernel/smp.c:396 [inline]
pc : smp_call_function_many_cond+0x65c/0x14e0 kernel/smp.c:944
lr : csd_lock_wait kernel/smp.c:363 [inline]
lr : csd_lock kernel/smp.c:396 [inline]
lr : smp_call_function_many_cond+0x674/0x14e0 kernel/smp.c:944
sp : ffff8000949477a0
x29: ffff8000949478e0 x28: dfff800000000000 x27: 0000000000000011
x26: 0000000000000000 x25: ffff80008979a968 x24: 0000000000000001
x23: 1ffff000112f352d x22: ffff0001a4ff9ae8 x21: ffff0001a4ff9ae0
x20: ffff0000c77a9538 x19: ffff0001a4fcf400 x18: ffff80011b876000
x17: ffff80011b876000 x16: ffff80008f7e0000 x15: 009898ffffec0000
x14: 00000000003cf728 x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: ffff6000349ff35e x9 : 0000000000000000
x8 : 0000000000000011 x7 : 0000000000000000 x6 : ffff8000801693f8
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008059e360
x2 : 0000000000000000 x1 : ffff0000c77a8000 x0 : 0000000000000000
dump_backtrace(regs = 00000000c61f4978 tsk = 0000000000000000)
Call trace:
 __cmpwait_case_32 arch/arm64/include/asm/cmpxchg.h:233 [inline] (P)
 __cmpwait arch/arm64/include/asm/cmpxchg.h:259 [inline] (P)
 csd_lock_wait kernel/smp.c:363 [inline] (P)
 csd_lock kernel/smp.c:396 [inline] (P)
 smp_call_function_many_cond+0x65c/0x14e0 kernel/smp.c:944 (P)
 smp_call_function kernel/smp.c:1043 [inline]
 kick_all_cpus_sync+0x34/0x40 kernel/smp.c:1192
 flush_icache_range arch/arm64/include/asm/cacheflush.h:105 [inline]
 __text_poke+0xd8/0xf8 arch/arm64/kernel/patching.c:129
 aarch64_insn_set+0x50/0x80 arch/arm64/kernel/patching.c:176
 bpf_arch_text_invalidate+0x30/0x4c arch/arm64/net/bpf_jit_comp.c:275
 bpf_prog_pack_free+0x1b8/0x418 kernel/bpf/core.c:1068
 bpf_jit_binary_pack_free+0x44/0x84 kernel/bpf/core.c:1270
 bpf_jit_free+0x118/0x440 arch/arm64/net/bpf_jit_comp.c:3374
 bpf_prog_free_deferred+0x36c/0x438 kernel/bpf/core.c:3113
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
net_ratelimit: 60 callbacks suppressed
wireguard: wg0: Sending keepalive packet to peer 31 ([::1]:20002/0%0)
wireguard: wg0: Sending keepalive packet to peer 73 (127.0.0.1:20002)
wireguard: wg0: Sending keepalive packet to peer 67 ([::1]:20002/0%0)
wireguard: wg0: Sending keepalive packet to peer 61 (127.0.0.1:20002)
wireguard: wg2: Handshake for peer 11 ([::1]:20001/0%0) did not complete after 5 seconds, retrying (try 11)
wireguard: wg0: Handshake for peer 7 ([::1]:20002/0%0) did not complete after 5 seconds, retrying (try 2)
bridge0: port 1(syz_tun) forward delay timer
bridge0: port 1(syz_tun) event 16
bridge0: br_fill_ifinfo event 16 port syz_tun master bridge0
wireguard: wg0: Handshake for peer 8 ([::1]:20003/0%0) did not complete after 5 seconds, retrying (try 2)
wireguard: wg1: Handshake for peer 34 (127.0.0.1:20003) did not complete after 5 seconds, retrying (try 3)
wireguard: wg1: Sending keepalive packet to peer 63 (127.0.0.1:20001)
wireguard: wg1: Sending keepalive packet to peer 33 ([::1]:20001/0%0)
wireguard: wg1: Sending keepalive packet to peer 69 ([::1]:20001/0%0)
wireguard: wg1: Sending keepalive packet to peer 75 (127.0.0.1:20001)
bridge0: port 1(bridge_slave_0) forward delay timer
bridge0: port 1(bridge_slave_0) event 16
bridge0: br_fill_ifinfo event 16 port bridge_slave_0 master bridge0
bridge0: port 2(bridge_slave_1) forward delay timer
bridge0: port 2(bridge_slave_1) event 16
bridge0: br_fill_ifinfo event 16 port bridge_slave_1 master bridge0
wireguard: wg1: Sending keepalive packet to peer 34 (127.0.0.1:20003)
wireguard: wg1: Sending keepalive packet to peer 10 (127.0.0.1:20003)
geneve1: no route to fc00:0000:0000:0000:0000:0000:0000:0001
virtqueue callback for 00000000e6415267 (0000000073f62e71)
kobject: 'brport': free name
kobject: 'brport' (00000000568152d0): kobject_cleanup, parent 0000000000000000
kobject: 'brport' (00000000568152d0): calling ktype release
kobject: 'brport': free name
kobject: 'brport' (0000000026be9bf0): kobject_cleanup, parent 0000000000000000
kobject: 'brport' (0000000026be9bf0): calling ktype release
kobject: 'brport': free name

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/21 21:04 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 61c200c7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: soft lockup in ext4_ioctl
* Struck through repros no longer work on HEAD.