syzbot

 sign-in | mailing list | source | docs
🐞 Open [681]
🐞 Fixed [69]
🐞 Invalid [841]
⬇ Missing Backports [102]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

INFO: task hung in rtnetlink_rcv_msg (3)

Status: upstream: reported on 2025/04/17 04:34
Reported-by: syzbot+f1859596f74a2a65985f@syzkaller.appspotmail.com
First crash: 4d20h, last: 4d20h
▶ ▼ Similar bugs (12)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in rtnetlink_rcv_msg 1 647d 647d 0/3 auto-obsoleted due to no activity on 2023/10/22 21:13
linux-4.19 INFO: task hung in rtnetlink_rcv_msg (2) 14 1189d 1368d 0/1 auto-closed as invalid on 2022/05/18 11:30
linux-4.19 INFO: task hung in rtnetlink_rcv_msg (3) 8 802d 1036d 0/1 upstream: reported on 2022/06/20 23:55
linux-4.19 INFO: task hung in rtnetlink_rcv_msg 11 1621d 1943d 0/1 auto-closed as invalid on 2021/03/12 19:03
upstream INFO: task hung in rtnetlink_rcv_msg (2) net C inconclusive 548 28d 236d 0/28 closed as invalid on 2025/04/18 16:40
linux-6.1 INFO: task hung in rtnetlink_rcv_msg (3) origin:lts-only syz error 9 13d 214d 0/3 upstream: reported syz repro on 2024/09/19 14:16
upstream INFO: task hung in rtnetlink_rcv_msg net C inconclusive inconclusive 1970 286d 2250d 26/28 fixed on 2024/07/09 19:14
linux-4.14 INFO: task hung in rtnetlink_rcv_msg 1 782d 782d 0/1 upstream: reported on 2023/03/01 21:15
linux-5.15 INFO: task hung in rtnetlink_rcv_msg (2) 70 157d 448d 0/3 auto-obsoleted due to no activity on 2025/01/24 13:11
linux-6.1 INFO: task hung in rtnetlink_rcv_msg (2) 67 286d 451d 0/3 auto-obsoleted due to no activity on 2024/09/17 07:45
linux-6.1 INFO: task hung in rtnetlink_rcv_msg 1 571d 571d 0/3 auto-obsoleted due to no activity on 2024/01/09 18:18
upstream INFO: task hung in cangw_pernet_exit (3) can syz unreliable 290 1211d 1317d 0/28 closed as invalid on 2022/02/08 10:22

Sample crash report:
INFO: task dhcpcd:3839 blocked for more than 143 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:20384 pid: 3839 ppid:  3838 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6518
 __mutex_lock_common+0xe34/0x25a0 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 rtnl_lock net/core/rtnetlink.c:72 [inline]
 rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2489
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x7c0/0x990 net/netlink/af_netlink.c:1337
 netlink_sendmsg+0xa30/0xd60 net/netlink/af_netlink.c:1905
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2436
 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2490
 __sys_sendmsg net/socket.c:2519 [inline]
 __do_sys_sendmsg net/socket.c:2528 [inline]
 __se_sys_sendmsg+0x19a/0x260 net/socket.c:2526
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7ff8a2b3aa4b
RSP: 002b:00007ffc95bddfe8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ff8a2a626c0 RCX: 00007ff8a2b3aa4b
RDX: 0000000000000000 RSI: 00007ffc95bf2198 RDI: 000000000000001b
RBP: 000000000000001b R08: 0000000000000000 R09: 00007ffc95bf2198
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 00007ffc95bf2198 R14: 0000000000000044 R15: 0000000000000001
 </TASK>
INFO: task kworker/0:6:4214 blocked for more than 143 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:6     state:D stack:23136 pid: 4214 ppid:     2 flags:0x00004000
Workqueue: events pwq_unbound_release_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline]
 synchronize_rcu_expedited+0x671/0x740 kernel/rcu/tree_exp.h:845
 synchronize_rcu+0x107/0x1a0 kernel/rcu/tree.c:3798
 lockdep_unregister_key+0x4ed/0x5c0 kernel/locking/lockdep.c:6335
 wq_unregister_lockdep kernel/workqueue.c:3518 [inline]
 pwq_unbound_release_workfn+0x23d/0x290 kernel/workqueue.c:3756
 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/0:7:4215 blocked for more than 144 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:7     state:D stack:23552 pid: 4215 ppid:     2 flags:0x00004000
Workqueue: events pwq_unbound_release_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline]
 synchronize_rcu_expedited+0x671/0x740 kernel/rcu/tree_exp.h:845
 synchronize_rcu+0x107/0x1a0 kernel/rcu/tree.c:3798
 lockdep_unregister_key+0x4ed/0x5c0 kernel/locking/lockdep.c:6335
 wq_unregister_lockdep kernel/workqueue.c:3518 [inline]
 pwq_unbound_release_workfn+0x23d/0x290 kernel/workqueue.c:3756
 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/0:8:4216 blocked for more than 144 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:8     state:D stack:24184 pid: 4216 ppid:     2 flags:0x00004000
Workqueue: events pwq_unbound_release_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline]
 synchronize_rcu_expedited+0x671/0x740 kernel/rcu/tree_exp.h:845
 synchronize_rcu+0x107/0x1a0 kernel/rcu/tree.c:3798
 lockdep_unregister_key+0x4ed/0x5c0 kernel/locking/lockdep.c:6335
 wq_unregister_lockdep kernel/workqueue.c:3518 [inline]
 pwq_unbound_release_workfn+0x23d/0x290 kernel/workqueue.c:3756
 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/u4:8:4269 blocked for more than 144 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:8    state:D stack:24792 pid: 4269 ppid:     2 flags:0x00004000
Workqueue: events_unbound fsnotify_connector_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1890
 do_wait_for_common+0x2d9/0x480 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
 __synchronize_srcu+0x2b9/0x360 kernel/rcu/srcutree.c:930
 fsnotify_connector_destroy_workfn+0x40/0xa0 fs/notify/mark.c:234
 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/u4:14:4285 blocked for more than 145 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:14   state:D stack:22848 pid: 4285 ppid:     2 flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1890
 do_wait_for_common+0x2d9/0x480 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
 __synchronize_srcu+0x2b9/0x360 kernel/rcu/srcutree.c:930
 fsnotify_mark_destroy_workfn+0x142/0x340 fs/notify/mark.c:924
 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/0:9:4478 blocked for more than 145 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:9     state:D stack:24120 pid: 4478 ppid:     2 flags:0x00004000
Workqueue: events key_garbage_collector
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 exp_funnel_lock kernel/rcu/tree_exp.h:313 [inline]
 synchronize_rcu_expedited+0x671/0x740 kernel/rcu/tree_exp.h:845
 synchronize_rcu+0x107/0x1a0 kernel/rcu/tree.c:3798
 key_garbage_collector+0x893/0xa00 security/keys/gc.c:303
 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task syz.0.183:5188 blocked for more than 145 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.0.183       state:D stack:24536 pid: 5188 ppid:  4174 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1890
 do_wait_for_common+0x2d9/0x480 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
 flush_workqueue+0x737/0x1610 kernel/workqueue.c:2882
 rxrpc_release_sock net/rxrpc/af_rxrpc.c:887 [inline]
 rxrpc_release+0x274/0x430 net/rxrpc/af_rxrpc.c:917
 __sock_release net/socket.c:649 [inline]
 sock_close+0xcd/0x230 net/socket.c:1336
 __fput+0x3fe/0x8e0 fs/file_table.c:311
 task_work_run+0x129/0x1a0 kernel/task_work.c:188
 get_signal+0x143a/0x14e0 kernel/signal.c:2672
 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f0c841ab169
RSP: 002b:00007f0c82013038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 000000000000f000 RBX: 00007f0c843d2fa0 RCX: 00007f0c841ab169
RDX: 000000000000f000 RSI: 0000200000000d00 RDI: 0000000000000003
RBP: 00007f0c8422da68 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000010002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f0c843d2fa0 R15: 00007ffcfe6a5dd8
 </TASK>
INFO: task syz.1.184:5193 blocked for more than 146 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.184       state:D stack:24536 pid: 5193 ppid:  4168 flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 schedule_timeout+0xac/0x300 kernel/time/timer.c:1890
 do_wait_for_common+0x2d9/0x480 kernel/sched/completion.c:85
 __wait_for_common kernel/sched/completion.c:106 [inline]
 wait_for_common kernel/sched/completion.c:117 [inline]
 wait_for_completion+0x48/0x60 kernel/sched/completion.c:138
 flush_workqueue+0x737/0x1610 kernel/workqueue.c:2882
 rxrpc_release_sock net/rxrpc/af_rxrpc.c:887 [inline]
 rxrpc_release+0x274/0x430 net/rxrpc/af_rxrpc.c:917
 __sock_release net/socket.c:649 [inline]
 sock_close+0xcd/0x230 net/socket.c:1336
 __fput+0x3fe/0x8e0 fs/file_table.c:311
 task_work_run+0x129/0x1a0 kernel/task_work.c:188
 get_signal+0x143a/0x14e0 kernel/signal.c:2672
 arch_do_signal_or_restart+0xc3/0x1890 arch/x86/kernel/signal.c:867
 handle_signal_work kernel/entry/common.c:154 [inline]
 exit_to_user_mode_loop+0x97/0x130 kernel/entry/common.c:178
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:214
 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline]
 syscall_exit_to_user_mode+0x5d/0x240 kernel/entry/common.c:307
 do_syscall_64+0x47/0xb0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7feee0389169
RSP: 002b:00007feede1f1038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 000000000000f000 RBX: 00007feee05b0fa0 RCX: 00007feee0389169
RDX: 000000000000f000 RSI: 0000200000000d00 RDI: 0000000000000003
RBP: 00007feee040ba68 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000010002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007feee05b0fa0 R15: 00007fffa9c16ca8
 </TASK>
INFO: task syz.2.199:5253 blocked for more than 146 seconds.
      Not tainted 5.15.180-syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.199       state:D stack:27352 pid: 5253 ppid:  4167 flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5030 [inline]
 __schedule+0x12c4/0x45b0 kernel/sched/core.c:6376
 schedule+0x11b/0x1f0 kernel/sched/core.c:6459
 synchronize_rcu_expedited+0x5c6/0x740 kernel/rcu/tree_exp.h:861
 synchronize_rcu+0x107/0x1a0 kernel/rcu/tree.c:3798
 __sched_core_enable kernel/sched/core.c:312 [inline]
 sched_core_get+0x76/0x1d0 kernel/sched/core.c:331
 sched_core_alloc_cookie+0x71/0xa0 kernel/sched/core_sched.c:21
 sched_core_share_pid+0x30d/0x740 kernel/sched/core_sched.c:178
 __do_sys_prctl kernel/sys.c:2564 [inline]
 __se_sys_prctl+0x230/0x2ab0 kernel/sys.c:2298
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fce78c3c169
RSP: 002b:00007fce76aa4038 EFLAGS: 00000246 ORIG_RAX: 000000000000009d
RAX: ffffffffffffffda RBX: 00007fce78e63fa0 RCX: 00007fce78c3c169
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 000000000000003e
RBP: 00007fce78cbea68 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fce78e63fa0 R15: 00007fffd371f6e8
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/27:
 #0: ffffffff8cb1f560 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
3 locks held by kworker/0:2/1108:
 #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc900045f7d20 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
 #2: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: switchdev_deferred_process_work+0xa/0x20 net/switchdev/switchdev.c:74
3 locks held by kworker/0:3/1325:
 #0: ffff888017471938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc90004977d20 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
 #2: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x7f/0xb70 net/wireless/reg.c:2437
1 lock held by dhcpcd/3839:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
2 locks held by getty/3928:
 #0: ffff88814cafd098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc900025c62e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x6af/0x1db0 drivers/tty/n_tty.c:2158
2 locks held by kworker/0:6/4214:
 #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc9000306fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
2 locks held by kworker/0:7/4215:
 #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc9000316fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
2 locks held by kworker/0:8/4216:
 #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc9000317fd20 ((work_completion)(&pwq->unbound_release_work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
2 locks held by kworker/u4:8/4269:
 #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc900033afd20 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
4 locks held by kworker/u4:11/4278:
 #0: ffff88807c6f3138 ((wq_completion)phy10){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc9000333fd20 ((work_completion)(&sdata->work)){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
 #2: ffff88805e034d40 (&wdev->mtx){+.+.}-{3:3}, at: sdata_lock net/mac80211/ieee80211_i.h:1036 [inline]
 #2: ffff88805e034d40 (&wdev->mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0xa0/0x1480 net/mac80211/ibss.c:1685
 #3: ffff88807d7397b0 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_sta_expire net/mac80211/ibss.c:1259 [inline]
 #3: ffff88807d7397b0 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_sta_merge_ibss net/mac80211/ibss.c:1302 [inline]
 #3: ffff88807d7397b0 (&local->sta_mtx){+.+.}-{3:3}, at: ieee80211_ibss_work+0x4be/0x1480 net/mac80211/ibss.c:1713
3 locks held by kworker/1:10/4280:
2 locks held by kworker/u4:14/4285:
 #0: ffff888017479138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc9000343fd20 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
2 locks held by kworker/0:9/4478:
 #0: ffff888017470938 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x78a/0x10c0 kernel/workqueue.c:2283
 #1: ffffc900031ffd20 (key_gc_work){+.+.}-{0:0}, at: process_one_work+0x7d0/0x10c0 kernel/workqueue.c:2285
1 lock held by syz.0.183/5188:
 #0: ffff888075713210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
 #0: ffff888075713210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:648 [inline]
 #0: ffff888075713210 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x98/0x230 net/socket.c:1336
1 lock held by syz.1.184/5193:
 #0: ffff888070b3dc10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: inode_lock include/linux/fs.h:787 [inline]
 #0: ffff888070b3dc10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: __sock_release net/socket.c:648 [inline]
 #0: ffff888070b3dc10 (&sb->s_type->i_mutex_key#11){+.+.}-{3:3}, at: sock_close+0x98/0x230 net/socket.c:1336
2 locks held by syz.2.199/5253:
 #0: ffffffff8c9df128 (sched_core_mutex){+.+.}-{3:3}, at: sched_core_get+0x47/0x1d0 kernel/sched/core.c:329
 #1: ffffffff8cb23b28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:290 [inline]
 #1: ffffffff8cb23b28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x280/0x740 kernel/rcu/tree_exp.h:845
2 locks held by syz.2.199/5255:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
 #1: ffffffff8cb23b28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: exp_funnel_lock kernel/rcu/tree_exp.h:322 [inline]
 #1: ffffffff8cb23b28 (rcu_state.exp_mutex){+.+.}-{3:3}, at: synchronize_rcu_expedited+0x350/0x740 kernel/rcu/tree_exp.h:845
1 lock held by syz.2.199/5257:
 #0: ffffffff8c9df128 (sched_core_mutex){+.+.}-{3:3}, at: sched_core_get+0x47/0x1d0 kernel/sched/core.c:329
1 lock held by syz.4.203/5271:
 #0: ffffffff8c9df128 (sched_core_mutex){+.+.}-{3:3}, at: sched_core_get+0x47/0x1d0 kernel/sched/core.c:329
1 lock held by syz.4.203/5273:
 #0: ffff88801b1846b8 (&nft_net->commit_mutex){+.+.}-{3:3}, at: nf_tables_valid_genid+0x2e/0x100 net/netfilter/nf_tables_api.c:9980
1 lock held by syz.5.205/5282:
 #0: ffffffff8cbb6c88 (lock#4){+.+.}-{3:3}, at: __lru_add_drain_all+0x67/0x9e0 mm/swap.c:782
1 lock held by syz-executor/5289:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5294:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5297:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5302:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5305:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5308:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5312:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5315:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5319:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5322:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5325:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5329:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5332:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5336:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647
1 lock held by syz-executor/5339:
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8dc44148 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x956/0xef0 net/core/rtnetlink.c:5647

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 27 Comm: khungtaskd Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x46a/0x4a0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x181/0x2a0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xe72/0xeb0 kernel/hung_task.c:369
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 4283 Comm: kworker/u4:13 Not tainted 5.15.180-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: phy12 ieee80211_iface_work
RIP: 0010:__read_once_word_nocheck+0x3/0x10 include/asm-generic/rwonce.h:67
Code: c1 0f 8c dc fc ff ff 48 89 df e8 e8 b0 91 00 48 ba 00 00 00 00 00 fc ff df e9 c5 fc ff ff 66 0f 1f 84 00 00 00 00 00 48 8b 07 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 31 c0 81 ff 03 00 00 40 0f
RSP: 0018:ffffc9000326f0e0 EFLAGS: 00000287
RAX: ffffffff89ce91cf RBX: ffffc9000326fbe0 RCX: ffffffff8e73c9b4
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffffc9000326fbe0
RBP: ffffc90003270000 R08: 0000000000000001 R09: ffffc9000326f290
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffffffff1e142ad
R13: 1ffffffff1e142ad R14: ffffc90003268000 R15: ffffc9000326f1a0
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005566f5b44088 CR3: 000000002ad0b000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 deref_stack_reg arch/x86/kernel/unwind_orc.c:360 [inline]
 unwind_next_frame+0xb35/0x1fa0 arch/x86/kernel/unwind_orc.c:539
 arch_stack_walk+0x10d/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x113/0x1c0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc+0xba/0xf0 mm/kasan/common.c:513
 kasan_kmalloc include/linux/kasan.h:264 [inline]
 __kmalloc+0x168/0x300 mm/slub.c:4407
 kmalloc include/linux/slab.h:609 [inline]
 kzalloc include/linux/slab.h:735 [inline]
 cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2526 [inline]
 cfg80211_inform_bss_frame_data+0x4f8/0x20f0 net/wireless/scan.c:2587
 ieee80211_bss_info_update+0x7a6/0xc80 net/mac80211/scan.c:190
 ieee80211_rx_bss_info net/mac80211/ibss.c:1123 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1614 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x175e/0x2af0 net/mac80211/ibss.c:1643
 ieee80211_iface_process_skb net/mac80211/iface.c:1456 [inline]
 ieee80211_iface_work+0x78f/0xcc0 net/mac80211/iface.c:1510
 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/04/17 04:33 linux-5.15.y f7347f400572 a95239b1 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in rtnetlink_rcv_msg
* Struck through repros no longer work on HEAD.