syzbot


WARNING: locking bug in finish_task_switch (2)

Status: upstream: reported on 2025/12/29 14:09
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+fa2e2b8fd1b3f689d484@syzkaller.appspotmail.com
First crash: 19d, last: 19d
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] WARNING: locking bug in finish_task_switch (2) 0 (1) 2025/12/29 14:09
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING: locking bug in finish_task_switch bluetooth net 4 C done inconclusive 131 1081d 2192d 0/29 auto-obsoleted due to no activity on 2023/05/29 00:22

Sample crash report:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(1)
WARNING: kernel/locking/lockdep.c:238 at hlock_class kernel/locking/lockdep.c:238 [inline], CPU#0: ktimers/0/16
WARNING: kernel/locking/lockdep.c:238 at check_wait_context kernel/locking/lockdep.c:4879 [inline], CPU#0: ktimers/0/16
WARNING: kernel/locking/lockdep.c:238 at __lock_acquire+0x55a/0x2cf0 kernel/locking/lockdep.c:5187, CPU#0: ktimers/0/16
Modules linked in:
CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:hlock_class kernel/locking/lockdep.c:238 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4879 [inline]
RIP: 0010:__lock_acquire+0x561/0x2cf0 kernel/locking/lockdep.c:5187
Code: 83 3d a2 bd 21 17 00 75 27 90 e8 ba 99 dd 02 85 c0 74 1c 83 3d c3 bd 3e 0d 00 75 13 48 8d 3d d6 c1 41 0d 48 c7 c6 ca 31 ee 8c <67> 48 0f b9 3a 90 31 c9 0f b6 81 c4 00 00 00 84 c0 0f 84 77 ff ff
RSP: 0018:ffffc900001571b0 EFLAGS: 00010046
RAX: 0000000000000001 RBX: ffff88801b6de760 RCX: ffff88801b6ddac0
RDX: 0000000000000100 RSI: ffffffff8cee31ca RDI: ffffffff8ede4890
RBP: ffff88801b6de768 R08: 0000000000000000 R09: 0000000000000100
R10: dffffc0000000000 R11: fffffbfff1db688f R12: 0000000000000003
R13: ffff88801b6de768 R14: ffff88801b6ddac0 R15: 0000000000000006
FS:  0000000000000000(0000) GS:ffff888126cef000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f617ff8 CR3: 0000000033f24000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 lock_acquire+0x107/0x340 kernel/locking/lockdep.c:5868
 finish_lock_switch kernel/sched/core.c:4993 [inline]
 finish_task_switch+0x177/0x940 kernel/sched/core.c:5112
 context_switch kernel/sched/core.c:5259 [inline]
 __schedule+0x1467/0x5070 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule_rtlock+0x30/0x70 kernel/sched/core.c:7024
 rtlock_slowlock_locked+0x3819/0x4010 kernel/locking/rtmutex.c:1868
 rtlock_slowlock kernel/locking/rtmutex.c:1895 [inline]
 rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]
 __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]
 rt_spin_lock+0x158/0x3e0 kernel/locking/spinlock_rt.c:57
 spin_lock include/linux/spinlock_rt.h:44 [inline]
 fq_pie_timer+0x190/0x5b0 net/sched/sch_fq_pie.c:397
 call_timer_fn+0x16e/0x590 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2373 [inline]
 __run_timer_base+0x648/0x970 kernel/time/timer.c:2385
 run_timer_base kernel/time/timer.c:2394 [inline]
 run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2404
 handle_softirqs+0x1df/0x650 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 run_ktimerd+0x69/0x100 kernel/softirq.c:1138
 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
----------------
Code disassembly (best guess):
   0:	83 3d a2 bd 21 17 00 	cmpl   $0x0,0x1721bda2(%rip)        # 0x1721bda9
   7:	75 27                	jne    0x30
   9:	90                   	nop
   a:	e8 ba 99 dd 02       	call   0x2dd99c9
   f:	85 c0                	test   %eax,%eax
  11:	74 1c                	je     0x2f
  13:	83 3d c3 bd 3e 0d 00 	cmpl   $0x0,0xd3ebdc3(%rip)        # 0xd3ebddd
  1a:	75 13                	jne    0x2f
  1c:	48 8d 3d d6 c1 41 0d 	lea    0xd41c1d6(%rip),%rdi        # 0xd41c1f9
  23:	48 c7 c6 ca 31 ee 8c 	mov    $0xffffffff8cee31ca,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	90                   	nop
  30:	31 c9                	xor    %ecx,%ecx
  32:	0f b6 81 c4 00 00 00 	movzbl 0xc4(%rcx),%eax
  39:	84 c0                	test   %al,%al
  3b:	0f                   	.byte 0xf
  3c:	84 77 ff             	test   %dh,-0x1(%rdi)
  3f:	ff                   	.byte 0xff

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/25 14:02 upstream ccd1cdca5cd4 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root WARNING: locking bug in finish_task_switch
* Struck through repros no longer work on HEAD.