panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM) (3)

Status: fixed on 2026/01/14 10:50
Fix commit: 2f5377660b6f netstack: Use ctx.BlockWithTimeout() directly while releasing socket.
First crash: 242d, last: 242d
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
gvisor panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM) 2 1 754d 754d 26/26 fixed on 2024/08/07 22:01
gvisor panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM) (2) 2 syz, C 9 623d 623d 26/26 fixed on 2024/12/16 21:08

Sample crash report:
panic: running on goroutine 556 (task goroutine for kernel.Task 0xc0011d5208 is 601)

goroutine 556 gp=0xc000da01c0 m=4 mp=0xc000153808 [running]:
panic({0x22cb060?, 0xc0001a5b10?})
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/go/src/runtime/panic.go:802 +0x168 fp=0xc000e2f738 sp=0xc000e2f688 pc=0x4bc308
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).assertTaskGoroutine(0xc0011d5208)
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_run.go:378 +0x1ee fp=0xc000e2f7b8 sp=0xc000e2f738 pc=0x13961ce
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).block(0xc0011d5208, 0xc000f2b2d0, 0xc0010de4d0)
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_block.go:169 +0xbd fp=0xc000e2f8d0 sp=0xc000e2f7b8 pc=0x135793d
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).blockWithDeadlineFromSampledClock(0xc0011d5208, 0xc000f2b2d0, {0x2812a58, 0xc00039fc00}, {0xc00039fc08?})
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_block.go:134 +0xfb fp=0xc000e2f938 sp=0xc000e2f8d0 pc=0x135723b
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).BlockWithDeadline(0xc0011d5208, 0xc000f2b2d0, 0x1, {0x0?})
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/task_block.go:87 +0x1ba fp=0xc000e2f998 sp=0xc000e2f938 pc=0x1356b1a
gvisor.dev/gvisor/pkg/sentry/socket/netstack.(*sock).Release(0xc000c00500, {0x281f6a8, 0xc00114dc80})
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/socket/netstack/netstack.go:497 +0x929 fp=0xc000e2faf0 sp=0xc000e2f998 pc=0x164f349
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef.func1()
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/vfs/file_description.go:205 +0x798 fp=0xc000e2fc48 sp=0xc000e2faf0 pc=0xcef838
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescriptionRefs).DecRef(0xc000c00500, 0xc001474ce8)
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/vfs/file_description_refs.go:133 +0x104 fp=0xc000e2fcd8 sp=0xc000e2fc48 pc=0xcfe644
gvisor.dev/gvisor/pkg/sentry/vfs.(*FileDescription).DecRef(0xc000c00500, {0x281f6a8, 0xc00114dc80})
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/vfs/file_description.go:161 +0xe5 fp=0xc000e2fd18 sp=0xc000e2fcd8 pc=0xcef065
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.submitCallback.getAIOCallback.func1.deferwrap1()
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/syscalls/linux/sys_aio.go:344 +0x50 fp=0xc000e2fd58 sp=0xc000e2fd18 pc=0x170c5f0
runtime.deferreturn()
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/go/src/runtime/panic.go:589 +0x5e fp=0xc000e2fde8 sp=0xc000e2fd58 pc=0x47fd3e
gvisor.dev/gvisor/pkg/sentry/syscalls/linux.submitCallback.getAIOCallback.func1({0x281f6a8, 0xc00114dc80})
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/syscalls/linux/sys_aio.go:383 +0x6bb fp=0xc000e2ffa0 sp=0xc000e2fde8 pc=0x170c47b
gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).QueueAIO.func1()
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/aio.go:30 +0x62 fp=0xc000e2ffe0 sp=0xc000e2ffa0 pc=0x12c5562
runtime.goexit({})
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc000e2ffe8 sp=0xc000e2ffe0 pc=0x4c5b61
created by gvisor.dev/gvisor/pkg/sentry/kernel.(*Task).QueueAIO in goroutine 601
	/syzkaller/.cache/bazel/_bazel_root/a13edd57d9dad04937e1fb5843ea1532/sandbox/linux-sandbox/3/execroot/_main/gopath/src/gvisor.dev/gvisor/pkg/sentry/kernel/aio.go:29 +0x2dd

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/30 00:43 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-systrap-1-race-cover panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/30 00:41 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-ptrace-1-race-cover panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/30 00:37 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-ptrace-2-race-cover panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/29 23:46 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-ptrace-1-race panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/29 23:43 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-ptrace-2-race panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/29 23:42 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-systrap-1-race panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/30 00:06 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-arm64-systrap-1-race-cover panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/29 23:57 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-arm64-ptrace-1-race-cover panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/29 23:44 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-arm64-ptrace-1-race panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/29 23:26 gvisor 3ad5b57e0557 d1b870e1 .config console log report syz / log C ci-gvisor-arm64-systrap-1-race panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
2025/12/29 23:10 gvisor 3ad5b57e0557 d1b870e1 .config console log report info ci-gvisor-arm64-systrap-1-race panic: running on goroutine NUM (task goroutine for kernel.Task ADDR is NUM)
* Struck through repros no longer work on HEAD.