syzbot


INFO: task hung in drm_atomic_get_plane_state (3)

Status: auto-obsoleted due to no activity on 2026/06/25 12:18
Subsystems: dri
Labels: prio:high
[Documentation on labels]
First crash: 146d, last: 90d
✨ AI Jobs (3)
ID Workflow Result Correct Bug Created Started Finished Revision Error
4eee0439-c478-43c5-9a32-d0a4c87e2d93 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ✅ VMHostTrigger: ❌ INFO: task hung in drm_atomic_get_plane_state (3) 2026/05/30 20:50 2026/05/30 20:50 2026/05/30 21:38 6b4a844333e83556da95d61d7f207e7ef5cd4bc6

			
		
16c933fe-6f3f-4ffe-afce-da1de502f536 assessment-security 💥 INFO: task hung in drm_atomic_get_plane_state (3) 2026/05/14 11:47 2026/05/14 11:47 2026/05/14 11:49 6ccb967e465e832a7bfd7a116ad00d52a0923a5d
failed to run ["make" "KERNELVERSION=syzkaller" "KERNELRELEASE=syzkaller" "LOCALVERSION=-syzkaller" "-j" "32" "ARCH=x86_64" "CC=ccache clang" "LD=ld.lld" "O=/app/workdir/cache/build/f79e4eb005e0303d57...
truncated to first 200 bytes; open job for full error
8a48f67a-8db0-45f3-b300-fd0cbf53d5a0 repro INFO: task hung in drm_atomic_get_plane_state (3) 2026/03/06 15:34 2026/03/06 15:34 2026/03/06 15:46 31e9c887f7dc24e04b3ca70d0d54fc34141844b0

			
		
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in drm_atomic_get_plane_state (2) dri 1 2 304d 345d 0/29 auto-obsoleted due to no activity on 2025/11/23 07:53
upstream INFO: task hung in drm_atomic_get_plane_state dri 1 75 432d 634d 0/29 auto-obsoleted due to no activity on 2025/06/27 19:25

Sample crash report:
INFO: task swapper/0:1 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:swapper/0       state:D stack:20040 pid:1     tgid:1     ppid:0      task_flags:0x0140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
 __schedule_loop kernel/sched/core.c:6993 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7008
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __ww_mutex_lock+0x11f4/0x2a20 kernel/locking/mutex.c:783
 ww_mutex_lock+0x3f/0x1c0 kernel/locking/mutex.c:901
 modeset_lock+0x2be/0x640 drivers/gpu/drm/drm_modeset_lock.c:316
 drm_atomic_get_plane_state+0x1e5/0x670 drivers/gpu/drm/drm_atomic.c:564
 drm_client_modeset_commit_atomic+0x227/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1056
 drm_client_modeset_commit_locked+0xcb/0x4d0 drivers/gpu/drm/drm_client_modeset.c:1207
 pan_display_atomic drivers/gpu/drm/drm_fb_helper.c:1207 [inline]
 drm_fb_helper_pan_display+0x3e7/0xbd0 drivers/gpu/drm/drm_fb_helper.c:1267
 fb_pan_display+0x39e/0x680 drivers/video/fbdev/core/fbmem.c:193
 bit_update_start+0x4c/0x1e0 drivers/video/fbdev/core/bitblit.c:405
 fbcon_switch+0x127e/0x2040 drivers/video/fbdev/core/fbcon.c:2211
 redraw_screen+0x586/0xec0 drivers/tty/vt/vt.c:960
 fbcon_prepare_logo+0xa31/0xe00 drivers/video/fbdev/core/fbcon.c:665
 con2fb_init_display drivers/video/fbdev/core/fbcon.c:851 [inline]
 set_con2fb_map+0xa32/0xfc0 drivers/video/fbdev/core/fbcon.c:918
 do_fb_registered drivers/video/fbdev/core/fbcon.c:3023 [inline]
 fbcon_fb_registered+0x24e/0x610 drivers/video/fbdev/core/fbcon.c:3043
 do_register_framebuffer drivers/video/fbdev/core/fbmem.c:512 [inline]
 register_framebuffer+0x738/0x8d0 drivers/video/fbdev/core/fbmem.c:579
 __drm_fb_helper_initial_config_and_unlock+0x14f1/0x1b90 drivers/gpu/drm/drm_fb_helper.c:1668
 drm_fbdev_client_hotplug+0x16c/0x230 drivers/gpu/drm/clients/drm_fbdev_client.c:66
 drm_client_register+0x172/0x210 drivers/gpu/drm/drm_client.c:143
 drm_fbdev_client_setup+0x1a0/0x3f0 drivers/gpu/drm/clients/drm_fbdev_client.c:168
 drm_client_setup+0x107/0x220 drivers/gpu/drm/clients/drm_client_setup.c:46
 virtio_gpu_probe+0x23a/0x2a0 drivers/gpu/drm/virtio/virtgpu_drv.c:111
 virtio_dev_probe+0xd93/0x1050 drivers/virtio/virtio.c:347
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x267/0xaf0 drivers/base/dd.c:721
 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863
 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893
 __driver_attach+0x34c/0x640 drivers/base/dd.c:1287
 bus_for_each_dev+0x23b/0x2c0 drivers/base/bus.c:383
 bus_add_driver+0x345/0x670 drivers/base/bus.c:756
 driver_register+0x23a/0x320 drivers/base/driver.c:249
 virtio_gpu_driver_init+0x96/0x110 drivers/gpu/drm/virtio/virtgpu_drv.c:195
 do_one_initcall+0x250/0x8d0 init/main.c:1382
 do_initcall_level+0x104/0x190 init/main.c:1444
 do_initcalls+0x59/0xa0 init/main.c:1460
 kernel_init_freeable+0x2a6/0x3e0 init/main.c:1692
 kernel_init+0x1d/0x1d0 init/main.c:1582
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/0:0:9 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:0     state:D stack:27336 pid:9     tgid:9     ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events virtio_gpu_dequeue_ctrl_func
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
 __schedule_loop kernel/sched/core.c:6993 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7008
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7065
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 drm_client_dev_hotplug+0xdc/0x4f0 drivers/gpu/drm/drm_client_event.c:98
 virtio_gpu_dequeue_ctrl_func+0x506/0x8c0 drivers/gpu/drm/virtio/virtgpu_vq.c:265
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/0:1:10 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:1     state:D stack:26208 pid:10    tgid:10    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events drm_fb_helper_damage_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5298 [inline]
 __schedule+0x15dd/0x52d0 kernel/sched/core.c:6911
 __schedule_loop kernel/sched/core.c:6993 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7008
 virtio_gpu_queue_ctrl_sgs drivers/gpu/drm/virtio/virtgpu_vq.c:399 [inline]
 virtio_gpu_queue_fenced_ctrl_buffer+0x760/0x1090 drivers/gpu/drm/virtio/virtgpu_vq.c:500
 virtio_gpu_resource_flush drivers/gpu/drm/virtio/virtgpu_plane.c:226 [inline]
 virtio_gpu_primary_plane_update+0xcff/0x13a0 drivers/gpu/drm/virtio/virtgpu_plane.c:301
 drm_atomic_helper_commit_planes+0x60f/0xec0 drivers/gpu/drm/drm_atomic_helper.c:3038
 drm_atomic_helper_commit_tail+0x5f/0x500 drivers/gpu/drm/drm_atomic_helper.c:1989
 commit_tail+0x29a/0x3a0 drivers/gpu/drm/drm_atomic_helper.c:2074
 drm_atomic_helper_commit+0xa6e/0xb10 drivers/gpu/drm/drm_atomic_helper.c:2312
 drm_atomic_commit+0x246/0x2b0 drivers/gpu/drm/drm_atomic.c:1775
 drm_atomic_helper_dirtyfb+0xdec/0xf80 drivers/gpu/drm/drm_damage_helper.c:183
 drm_fbdev_shmem_helper_fb_dirty+0x160/0x2d0 drivers/gpu/drm/drm_fbdev_shmem.c:117
 drm_fb_helper_fb_dirty drivers/gpu/drm/drm_fb_helper.c:248 [inline]
 drm_fb_helper_damage_work+0x2b3/0x750 drivers/gpu/drm/drm_fb_helper.c:274
 process_one_work kernel/workqueue.c:3276 [inline]
 process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
9 locks held by swapper/0/1:
 #0: ffff888032da21b8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:949 [inline]
 #0: ffff888032da21b8 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1166 [inline]
 #0: ffff888032da21b8 (&dev->mutex){....}-{4:4}, at: __driver_attach+0x341/0x640 drivers/base/dd.c:1286
 #1: ffff88801f7f6278 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_register+0x4f/0x210 drivers/gpu/drm/drm_client.c:129
 #2: ffffffff8ef5dc28 (registration_lock){+.+.}-{4:4}, at: register_framebuffer+0x8d/0x8d0 drivers/video/fbdev/core/fbmem.c:578
 #3: ffffffff8e750a00 (console_lock){+.+.}-{0:0}, at: fbcon_fb_registered+0x49/0x610 drivers/video/fbdev/core/fbcon.c:3039
 #4: ffff8880352a7a80 (&helper->lock){+.+.}-{4:4}, at: drm_fb_helper_pan_display+0xbe/0xbd0 drivers/gpu/drm/drm_fb_helper.c:1260
 #5: ffff88801f7f6130 (&dev->master_mutex){+.+.}-{4:4}, at: drm_master_internal_acquire+0x20/0x80 drivers/gpu/drm/drm_auth.c:435
 #6: ffff8880352a7898 (&client->modeset_mutex){+.+.}-{4:4}, at: drm_client_modeset_commit_locked+0x4c/0x4d0 drivers/gpu/drm/drm_client_modeset.c:1205
 #7: ffffc900001aea70 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_client_modeset_commit_atomic+0x11a/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1043
 #8: ffffc900001aea98 (crtc_ww_class_mutex){+.+.}-{4:4}, at: drm_client_modeset_commit_atomic+0x11a/0x7e0 drivers/gpu/drm/drm_client_modeset.c:1043
3 locks held by kworker/0:0/9:
 #0: ffff88801aca6948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #0: ffff88801aca6948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
 #1: ffffc9000022fc40 ((work_completion)(&vgvq->dequeue_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
 #1: ffffc9000022fc40 ((work_completion)(&vgvq->dequeue_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
 #2: ffff88801f7f6278 (&dev->clientlist_mutex){+.+.}-{4:4}, at: drm_client_dev_hotplug+0xdc/0x4f0 drivers/gpu/drm/drm_client_event.c:98
5 locks held by kworker/0:1/10:
 #0: ffff88801aca6948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #0: ffff88801aca6948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
 #1: ffffc9000023fc40 ((work_completion)(&helper->damage_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
 #1: ffffc9000023fc40 ((work_completion)(&helper->damage_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359
 #2: ffffc9000023f870 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_atomic_helper_dirtyfb+0x106/0xf80 drivers/gpu/drm/drm_damage_helper.c:125
 #3: ffffc9000023f898 (crtc_ww_class_mutex){+.+.}-{4:4}, at: drm_atomic_helper_dirtyfb+0x106/0xf80 drivers/gpu/drm/drm_damage_helper.c:125
 #4: ffffffff8f062b18 (drm_unplug_srcu){.+.+}-{0:0}, at: srcu_lock_acquire include/linux/srcu.h:187 [inline]
 #4: ffffffff8f062b18 (drm_unplug_srcu){.+.+}-{0:0}, at: srcu_read_lock include/linux/srcu.h:294 [inline]
 #4: ffffffff8f062b18 (drm_unplug_srcu){.+.+}-{0:0}, at: drm_dev_enter+0x49/0x150 drivers/gpu/drm/drm_drv.c:451
1 lock held by khungtaskd/25:
 #0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8e75e5e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by kworker/u4:3/42:
 #0: ffff88801ac94148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #0: ffff88801ac94148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 kernel/workqueue.c:3359
 #1: ffffc90000447c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3252 [inline]
 #1: ffffc90000447c40 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 kernel/workqueue.c:3359

=============================================


Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/03/27 12:08 upstream 46b513250491 f9ef2ec1 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in drm_atomic_get_plane_state
2026/03/22 19:02 upstream 8d8bd2a5aa98 5b92003d .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in drm_atomic_get_plane_state
2026/03/19 17:01 upstream e9825d1c7957 0291cd06 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in drm_atomic_get_plane_state
2026/02/09 10:16 upstream 05f7e89ab973 df949cd9 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in drm_atomic_get_plane_state
2026/02/04 03:18 upstream de0674d9bc69 42b01fab .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in drm_atomic_get_plane_state
2026/01/29 22:56 upstream 8dfce8991b95 bfa73b7b .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root INFO: task hung in drm_atomic_get_plane_state
* Struck through repros no longer work on HEAD.