BUG: soft lockup in gate_timer_func

Status: moderation: reported on 2026/08/11 00:13
Subsystems: kernel
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+e147b03c8b9be07d744c@syzkaller.appspotmail.com
First crash: 7d04h, last: 7d04h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
fc1838a9 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: soft lockup in gate_timer_func 2026/08/08 22:05 2026/08/08 22:05 2026/08/08 22:50 5d63f80b

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [syz.4.1491:10102]
Modules linked in:
irq event stamp: 33885853
hardirqs last  enabled at (33885852): [<ffff800080559824>] seqcount_lockdep_reader_access+0x7c/0xf8 include/linux/seqlock.h:75
hardirqs last disabled at (33885853): [<ffff8000868e627c>] __el1_irq arch/arm64/kernel/entry-common.c:506 [inline]
hardirqs last disabled at (33885853): [<ffff8000868e627c>] el1_interrupt+0x28/0x60 arch/arm64/kernel/entry-common.c:522
softirqs last  enabled at (49606): [<ffff800084c14ca8>] __alloc_skb+0x1c0/0x610 net/core/skbuff.c:698
softirqs last disabled at (49607): [<ffff8000800204c0>] __do_softirq+0x14/0x20 kernel/softirq.c:656
CPU: 0 UID: 0 PID: 10102 Comm: syz.4.1491 Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : seqcount_lockdep_reader_access+0xd8/0xf8 include/linux/seqlock.h:76
lr : seqcount_lockdep_reader_access+0xd4/0xf8 include/linux/seqlock.h:75
sp : ffff80008eb27ce0
x29: ffff80008eb27ce0 x28: 1fffe00035bc5c3a x27: ffff80008e80e110
x26: dfff800000000000 x25: ffff0000cdab8f80 x24: 1fffe0001bac7226
x23: dfff800000000000 x22: ffff0000cdab8fb0 x21: 0000000000000000
x20: ffff800080559c88 x19: 00000000000000c0 x18: 00000000ffffffff
x17: ffff80008a791000 x16: 0000000000000005 x15: ffff80008a31ada0
x14: 000000008030f608 x13: 0000000000000001 x12: ffff0000c7011d40
x11: ffff80008a590e28 x10: 0000000000000003 x9 : 0000000000000102
x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff800080559874
x2 : 0000000000000080 x1 : ffff0000c7011d40 x0 : 0000000000000000
Call trace:
 __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P)
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P)
 seqcount_lockdep_reader_access+0xd8/0xf8 include/linux/seqlock.h:75 (P)
 ktime_get+0x68/0x218 kernel/time/timekeeping.c:971
 gate_get_time+0x1c/0xa4 net/sched/act_gate.c:23
 gate_timer_func+0x1a8/0x390 net/sched/act_gate.c:101
 __run_hrtimer kernel/time/hrtimer.c:2032 [inline]
 __hrtimer_run_queues+0x314/0xbe0 kernel/time/hrtimer.c:2096
 hrtimer_run_softirq+0x15c/0x21c kernel/time/hrtimer.c:2113
 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:622
 __do_softirq+0x14/0x20 kernel/softirq.c:656
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
 do_softirq+0x90/0xf8 kernel/softirq.c:523
 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 __alloc_skb+0x1c8/0x610 net/core/skbuff.c:699
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_skb_with_frags+0xb8/0x690 net/core/skbuff.c:6769
 sock_alloc_send_pskb+0x740/0x850 net/core/sock.c:3013
 unix_dgram_sendmsg+0x434/0x1078 net/unix/af_unix.c:2136
 sock_sendmsg_nosec net/socket.c:775 [inline]
 __sock_sendmsg+0xc8/0x17c net/socket.c:790
 ____sys_sendmsg+0x3f8/0x6c8 net/socket.c:2684
 ___sys_sendmsg+0x198/0x224 net/socket.c:2738
 __sys_sendmmsg+0x204/0x580 net/socket.c:2827
 __do_sys_sendmmsg net/socket.c:2854 [inline]
 __se_sys_sendmmsg net/socket.c:2851 [inline]
 __arm64_sys_sendmmsg+0xac/0xc8 net/socket.c:2851
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 4696 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:-1 [inline]
pc : arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline]
pc : handle_softirqs+0x1cc/0xd98 kernel/softirq.c:606
lr : handle_softirqs+0x1c8/0xd98 kernel/softirq.c:606
sp : ffff80008eb37ef0
x29: ffff80008eb37f80 x28: ffff0000d2fa3a88 x27: ffff0000d2fa3a90
x26: dfff800000000000 x25: 0000000000000008 x24: dfff800000000000
x23: ffff0001ade63640 x22: ffff0000d2fa3a80 x21: 000000000000000a
x20: ffff800088ac5640 x19: ffff0001ade63640 x18: 1fffe00035bc9e28
x17: ffff80012539e000 x16: ffff80008eb30000 x15: 0000000000000000
x14: 00000000ffff8000 x13: 0000000000000001 x12: 0000000000000000
x11: ffff800080157100 x10: 0000000000000003 x9 : 0000000000000000
x8 : 0000000000164b8c x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff8000801571a8
x2 : 0000000000000000 x1 : ffff0000d2fa3a80 x0 : ffff80012539e000
Call trace:
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 handle_softirqs+0x1cc/0xd98 kernel/softirq.c:606 (P)
 __do_softirq+0x14/0x20 kernel/softirq.c:656
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
 invoke_softirq kernel/softirq.c:503 [inline]
 __irq_exit_rcu+0x1ac/0x428 kernel/softirq.c:735
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:752
 __el1_irq arch/arm64/kernel/entry-common.c:510 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:522
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:527
 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:590
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 __raw_write_unlock_irq include/linux/rwlock_api_smp.h:301 [inline] (P)
 _raw_write_unlock_irq+0x34/0x80 kernel/locking/spinlock.c:362 (P)
 exit_notify kernel/exit.c:806 [inline]
 do_exit+0x1044/0x1a74 kernel/exit.c:1021
 do_group_exit+0x198/0x238 kernel/exit.c:1152
 __do_sys_exit_group kernel/exit.c:1163 [inline]
 __se_sys_exit_group kernel/exit.c:1161 [inline]
 pid_child_should_wake+0x0/0x104 kernel/exit.c:1161
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/05 23:09 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7235a3e71949 cd5b1963 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: soft lockup in gate_timer_func
* Struck through repros no longer work on HEAD.