possible deadlock in kernfs_remove_by_name_ns (2)

Status: upstream: reported on 2026/07/19 10:02
Subsystems: kernfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+b50eba6bf6cd3f8ba7d0@syzkaller.appspotmail.com
First crash: 69d, last: 26m
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
c1f62667 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ✅ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ possible deadlock in kernfs_remove_by_name_ns (2) 2026/07/17 00:00 2026/07/17 00:00 2026/07/17 00:08 49f47391
Discussions (3)
Title Replies (including bot) Last reply
[syzbot] Monthly kernfs report (Sep 2026) 0 (1) 2026/09/01 20:33
[syzbot] Monthly kernfs report (Aug 2026) 0 (1) 2026/08/02 00:00
[syzbot] [kernfs?] possible deadlock in kernfs_remove_by_name_ns (2) 0 (1) 2026/07/19 10:02
Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 possible deadlock in kernfs_remove_by_name_ns 4 syz, C 165 2h34m 43d 0/3 upstream: reported C repro on 2026/08/09 23:31

Sample crash report:
======================================================
WARNING: possible circular locking dependency detected
syzkaller #0 Tainted: G             L     
------------------------------------------------------
syz-executor/17295 is trying to acquire lock:
ffff88813ff77238 (&root->kernfs_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x4e/0x140 fs/kernfs/dir.c:1792

but task is already holding lock:
ffff88813ff77348 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 fs/kernfs/dir.c:1791

which lock already depends on the new lock.


the existing dependency chain (in reverse order) is:

-> #10 (&root->kernfs_supers_rwsem){++++}-{4:4}:
       down_read+0x97/0x200 kernel/locking/rwsem.c:1574
       kernfs_remove_by_name_ns+0x3f/0x140 fs/kernfs/dir.c:1791
       kernfs_remove_by_name include/linux/kernfs.h:644 [inline]
       remove_files fs/sysfs/group.c:28 [inline]
       sysfs_remove_group+0x101/0x2e0 fs/sysfs/group.c:328
       sysfs_remove_groups+0x54/0xb0 fs/sysfs/group.c:352
       __kobject_del+0x83/0x320 lib/kobject.c:595
       kobject_del+0x45/0x60 lib/kobject.c:627
       irq_sysfs_del kernel/irq/irqdesc.c:380 [inline]
       free_desc+0x10d/0x3d0 kernel/irq/irqdesc.c:493
       irq_free_descs+0x7e/0xb0 kernel/irq/irqdesc.c:874
       __msi_domain_free_irqs kernel/irq/msi.c:1619 [inline]
       msi_domain_free_locked+0x779/0xc90 kernel/irq/msi.c:1645
       msi_domain_free_irqs_range_locked kernel/irq/msi.c:1668 [inline]
       msi_domain_free_irqs_all_locked+0xaa/0xf0 kernel/irq/msi.c:1700
       pci_free_msi_irqs+0x25/0x90 drivers/pci/msi/msi.c:931
       pci_disable_msix drivers/pci/msi/api.c:200 [inline]
       pci_free_irq_vectors+0xa9/0x1e0 drivers/pci/msi/api.c:381
       vp_del_vqs+0x719/0x960 drivers/virtio/virtio_pci_common.c:308
       remove_common drivers/char/hw_random/virtio-rng.c:208 [inline]
       virtrng_remove+0x138/0x200 drivers/char/hw_random/virtio-rng.c:220
       virtio_dev_remove+0x9f/0x1b0 drivers/virtio/virtio.c:375
       device_remove drivers/base/dd.c:616 [inline]
       __device_release_driver drivers/base/dd.c:1349 [inline]
       device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
       bus_remove_device+0x449/0x560 drivers/base/bus.c:664
       device_del+0x528/0x8f0 drivers/base/core.c:3965
       device_unregister+0x21/0xf0 drivers/base/core.c:4006
       unregister_virtio_device+0x37/0x60 drivers/virtio/virtio.c:608
       virtio_pci_remove+0x7f/0xf0 drivers/virtio/virtio_pci_common.c:760
       pci_device_remove+0x99/0x1c0 drivers/pci/pci-driver.c:535
       device_remove drivers/base/dd.c:616 [inline]
       __device_release_driver drivers/base/dd.c:1349 [inline]
       device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
       pci_stop_dev drivers/pci/remove.c:27 [inline]
       pci_stop_bus_device+0xf6/0x120 drivers/pci/remove.c:94
       pci_stop_and_remove_bus_device drivers/pci/remove.c:129 [inline]
       pci_stop_and_remove_bus_device_locked+0x77/0xb0 drivers/pci/remove.c:137
       remove_store+0xe5/0x150 drivers/pci/pci-sysfs.c:524
       kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
       new_sync_write fs/read_write.c:595 [inline]
       vfs_write+0x61e/0xbb0 fs/read_write.c:687
       ksys_write+0x156/0x270 fs/read_write.c:739
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #9 (sparse_irq_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/rtmutex_api.c:561 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:580
       cpuhp_bringup_ap+0x70/0x360 kernel/cpu.c:841
       cpuhp_invoke_callback+0x434/0x810 kernel/cpu.c:194
       __cpuhp_invoke_callback_range kernel/cpu.c:972 [inline]
       cpuhp_invoke_callback_range kernel/cpu.c:996 [inline]
       cpuhp_up_callbacks kernel/cpu.c:1027 [inline]
       _cpu_up+0x2ce/0x5b0 kernel/cpu.c:1674
       cpu_up+0x1d2/0x220 kernel/cpu.c:1706
       cpuhp_bringup_mask+0xb2/0x1a0 kernel/cpu.c:1772
       cpuhp_bringup_cpus_parallel+0x118/0x120 kernel/cpu.c:1863
       bringup_nonboot_cpus+0x17/0x30 kernel/cpu.c:1876
       smp_init+0x32/0x110 kernel/smp.c:1125
       kernel_init_freeable+0x27f/0x3e0 init/main.c:1667
       kernel_init+0x22/0x1d0 init/main.c:1565
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #8 (cpu_hotplug_lock){++++}-{0:0}:
       percpu_down_read_internal include/linux/percpu-rwsem.h:53 [inline]
       percpu_down_read include/linux/percpu-rwsem.h:77 [inline]
       cpus_read_lock+0x42/0x160 kernel/cpu.c:490
       static_key_slow_inc+0x12/0x30 kernel/jump_label.c:190
       udp_tunnel_encap_enable include/net/udp_tunnel.h:234 [inline]
       setup_udp_tunnel_sock+0x2eb/0x4f0 net/ipv4/udp_tunnel_core.c:90
       gtp_encap_enable_socket+0x3d3/0x5c0 drivers/net/gtp.c:1708
       gtp_encap_enable drivers/net/gtp.c:1739 [inline]
       gtp_newlink+0x7df/0x16e0 drivers/net/gtp.c:1528
       rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3974
       __rtnl_newlink net/core/rtnetlink.c:4103 [inline]
       rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4220
       rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7137
       netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2575
       netlink_unicast_kernel net/netlink/af_netlink.c:1338 [inline]
       netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1364
       netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1919
       sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
       __sock_sendmsg net/socket.c:815 [inline]
       ____sys_sendmsg+0x565/0x870 net/socket.c:2713
       ___sys_sendmsg+0x2a5/0x360 net/socket.c:2767
       __sys_sendmsg net/socket.c:2799 [inline]
       __do_sys_sendmsg net/socket.c:2804 [inline]
       __se_sys_sendmsg net/socket.c:2802 [inline]
       __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2802
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #7 (sk_lock-AF_INET){+.+.}-{0:0}:
       lock_sock_nested+0x41/0x130 net/core/sock.c:3837
       lock_sock include/net/sock.h:1713 [inline]
       inet_shutdown+0x6a/0x390 net/ipv4/af_inet.c:913
       nbd_mark_nsock_dead+0x2cb/0x550 drivers/block/nbd.c:319
       recv_work+0x1d0c/0x1e40 drivers/block/nbd.c:1030
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #6 (&nsock->tx_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/rtmutex_api.c:561 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:580
       nbd_handle_cmd drivers/block/nbd.c:1143 [inline]
       nbd_queue_rq+0x373/0x1000 drivers/block/nbd.c:1207
       blk_mq_dispatch_rq_list+0x4af/0x1a00 block/blk-mq.c:2117
       __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
       blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
       __blk_mq_sched_dispatch_requests+0xd45/0x1590 block/blk-mq-sched.c:307
       blk_mq_sched_dispatch_requests+0xda/0x1a0 block/blk-mq-sched.c:329
       blk_mq_run_work_fn+0x16f/0x300 block/blk-mq.c:2532
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #5 (&cmd->lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/rtmutex_api.c:561 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:580
       nbd_queue_rq+0xc1/0x1000 drivers/block/nbd.c:1199
       blk_mq_dispatch_rq_list+0x4af/0x1a00 block/blk-mq.c:2117
       __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline]
       blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline]
       __blk_mq_sched_dispatch_requests+0xd45/0x1590 block/blk-mq-sched.c:307
       blk_mq_sched_dispatch_requests+0xda/0x1a0 block/blk-mq-sched.c:329
       blk_mq_run_work_fn+0x16f/0x300 block/blk-mq.c:2532
       process_one_work kernel/workqueue.c:3396 [inline]
       process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
       worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
       kthread+0x38b/0x470 kernel/kthread.c:436
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #4 (set->srcu){.+.+}-{0:0}:
       srcu_lock_sync include/linux/srcu.h:210 [inline]
       __synchronize_srcu+0xc9/0x2f0 kernel/rcu/srcutree.c:1462
       elevator_switch+0x1e8/0x7b0 block/elevator.c:576
       elevator_change+0x2fa/0x480 block/elevator.c:681
       elevator_set_default+0x375/0x440 block/elevator.c:754
       blk_register_queue+0x3f3/0x4e0 block/blk-sysfs.c:992
       __add_disk+0x6b8/0xdb0 block/genhd.c:531
       add_disk_fwnode+0x100/0x3a0 block/genhd.c:600
       add_disk include/linux/blkdev.h:798 [inline]
       nbd_dev_add+0x733/0xb60 drivers/block/nbd.c:2026
       nbd_init+0x168/0x1f0 drivers/block/nbd.c:2743
       do_one_initcall+0x250/0x870 init/main.c:1362
       do_initcall_level+0x10a/0x1a0 init/main.c:1424
       do_initcalls+0x59/0xa0 init/main.c:1440
       kernel_init_freeable+0x29d/0x3e0 init/main.c:1675
       kernel_init+0x22/0x1d0 init/main.c:1565
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #3 (&q->elevator_lock){+.+.}-{4:4}:
       __mutex_lock_common kernel/locking/rtmutex_api.c:561 [inline]
       mutex_lock_nested+0x5a/0x1d0 kernel/locking/rtmutex_api.c:580
       elevator_change+0x1af/0x480 block/elevator.c:679
       elv_iosched_store+0x504/0x630 block/elevator.c:826
       queue_attr_store+0x207/0x2b0 block/blk-sysfs.c:906
       kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
       new_sync_write fs/read_write.c:595 [inline]
       vfs_write+0x61e/0xbb0 fs/read_write.c:687
       ksys_write+0x156/0x270 fs/read_write.c:739
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #2 (&q->q_usage_counter(io)#66){++++}-{0:0}:
       blk_alloc_queue+0x54c/0x690 block/blk-core.c:504
       blk_mq_alloc_queue block/blk-mq.c:4420 [inline]
       __blk_mq_alloc_disk+0x194/0x390 block/blk-mq.c:4467
       null_add_dev+0xe8a/0x1d70 drivers/block/null_blk/main.c:2017
       null_create_dev drivers/block/null_blk/main.c:2114 [inline]
       null_init+0x1e3/0x390 drivers/block/null_blk/main.c:2178
       do_one_initcall+0x250/0x870 init/main.c:1362
       do_initcall_level+0x10a/0x1a0 init/main.c:1424
       do_initcalls+0x59/0xa0 init/main.c:1440
       kernel_init_freeable+0x29d/0x3e0 init/main.c:1675
       kernel_init+0x22/0x1d0 init/main.c:1565
       ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
       ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

-> #1 (fs_reclaim){+.+.}-{0:0}:
       __fs_reclaim_acquire mm/page_alloc.c:4375 [inline]
       fs_reclaim_acquire+0x71/0x100 mm/page_alloc.c:4389
       might_alloc include/linux/sched/mm.h:316 [inline]
       slab_pre_alloc_hook mm/slub.c:4636 [inline]
       slab_alloc_node mm/slub.c:4974 [inline]
       kmem_cache_alloc_lru_noprof+0x60/0x680 mm/slub.c:5029
       alloc_inode+0xb8/0x1b0 fs/inode.c:340
       iget_locked+0x131/0x6a0 fs/inode.c:1473
       kernfs_get_inode+0x4f/0x770 fs/kernfs/inode.c:250
       kernfs_fill_super fs/kernfs/mount.c:308 [inline]
       kernfs_get_tree+0x5cd/0x980 fs/kernfs/mount.c:392
       vfs_get_tree+0x92/0x2a0 fs/super.c:1933
       fc_mount fs/namespace.c:1198 [inline]
       do_new_mount_fc fs/namespace.c:3772 [inline]
       do_new_mount+0x319/0xdc0 fs/namespace.c:3848
       do_mount fs/namespace.c:4181 [inline]
       __do_sys_mount fs/namespace.c:4397 [inline]
       __se_sys_mount+0x31d/0x420 fs/namespace.c:4374
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

-> #0 (&root->kernfs_rwsem){++++}-{4:4}:
       check_prev_add kernel/locking/lockdep.c:3209 [inline]
       check_prevs_add kernel/locking/lockdep.c:3328 [inline]
       validate_chain kernel/locking/lockdep.c:3952 [inline]
       __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
       lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
       down_write+0x3a/0x50 kernel/locking/rwsem.c:1631
       kernfs_remove_by_name_ns+0x4e/0x140 fs/kernfs/dir.c:1792
       kernfs_remove_by_name include/linux/kernfs.h:644 [inline]
       remove_files fs/sysfs/group.c:28 [inline]
       sysfs_remove_group+0x101/0x2e0 fs/sysfs/group.c:328
       sysfs_remove_groups+0x54/0xb0 fs/sysfs/group.c:352
       net_rx_queue_update_kobjects+0x6b7/0x780 net/core/net-sysfs.c:1316
       remove_queue_kobjects net/core/net-sysfs.c:2148 [inline]
       netdev_unregister_kobject+0xff/0x450 net/core/net-sysfs.c:2304
       unregister_netdevice_many_notify+0x1bcd/0x2130 net/core/dev.c:12551
       unregister_netdevice_many net/core/dev.c:12589 [inline]
       unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12390
       unregister_netdevice include/linux/netdevice.h:3487 [inline]
       nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1198
       __nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1472
       nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline]
       nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1710
       nsim_drv_remove+0x58/0x160 drivers/net/netdevsim/dev.c:1725
       device_remove drivers/base/dd.c:616 [inline]
       __device_release_driver drivers/base/dd.c:1349 [inline]
       device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
       bus_remove_device+0x449/0x560 drivers/base/bus.c:664
       device_del+0x528/0x8f0 drivers/base/core.c:3965
       device_unregister+0x21/0xf0 drivers/base/core.c:4006
       nsim_bus_dev_del drivers/net/netdevsim/bus.c:488 [inline]
       del_device_store+0x2b5/0x370 drivers/net/netdevsim/bus.c:244
       kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
       new_sync_write fs/read_write.c:595 [inline]
       vfs_write+0x61e/0xbb0 fs/read_write.c:687
       ksys_write+0x156/0x270 fs/read_write.c:739
       do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
       do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
       entry_SYSCALL_64_after_hwframe+0x77/0x7f

other info that might help us debug this:

Chain exists of:
  &root->kernfs_rwsem --> sparse_irq_lock --> &root->kernfs_supers_rwsem

 Possible unsafe locking scenario:

       CPU0                    CPU1
       ----                    ----
  rlock(&root->kernfs_supers_rwsem);
                               lock(sparse_irq_lock);
                               lock(&root->kernfs_supers_rwsem);
  lock(&root->kernfs_rwsem);

 *** DEADLOCK ***

locks held by syz-executor/17295: 8, last CPU#1:
 #0: ffff888035fb2510 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2753 [inline]
 #0: ffff888035fb2510 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x231/0xbb0 fs/read_write.c:683
 #1: ffff88803b724478 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1d9/0x540 fs/kernfs/file.c:336
 #2: ffff88802929cf08 (kn->active#51){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:73 [inline]
 #2: ffff88802929cf08 (kn->active#51){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x22c/0x540 fs/kernfs/file.c:337
 #3: ffffffff8ee45438 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: del_device_store+0xd6/0x370 drivers/net/netdevsim/bus.c:234
 #4: ffff888029884160 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1104 [inline]
 #4: ffff888029884160 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1171 [inline]
 #4: ffff888029884160 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb9/0x880 drivers/base/dd.c:1369
 #5: ffff88807c25e310 (&devlink->lock_key#12){+.+.}-{4:4}, at: nsim_drv_remove+0x50/0x160 drivers/net/netdevsim/dev.c:1724
 #6: ffffffff8f5d4db8 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x173/0x800 drivers/net/netdevsim/netdev.c:1193
 #7: ffff88813ff77348 (&root->kernfs_supers_rwsem){++++}-{4:4}, at: kernfs_remove_by_name_ns+0x3f/0x140 fs/kernfs/dir.c:1791

stack backtrace:
CPU: 1 UID: 0 PID: 17295 Comm: syz-executor Tainted: G             L      syzkaller #0 PREEMPT_{RT,(full)} 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_circular_bug+0x2e2/0x300 kernel/locking/lockdep.c:2087
 check_noncircular+0x12f/0x150 kernel/locking/lockdep.c:2219
 check_prev_add kernel/locking/lockdep.c:3209 [inline]
 check_prevs_add kernel/locking/lockdep.c:3328 [inline]
 validate_chain kernel/locking/lockdep.c:3952 [inline]
 __lock_acquire+0x164c/0x2de0 kernel/locking/lockdep.c:5288
 lock_acquire+0x115/0x350 kernel/locking/lockdep.c:5942
 down_write+0x3a/0x50 kernel/locking/rwsem.c:1631
 kernfs_remove_by_name_ns+0x4e/0x140 fs/kernfs/dir.c:1792
 kernfs_remove_by_name include/linux/kernfs.h:644 [inline]
 remove_files fs/sysfs/group.c:28 [inline]
 sysfs_remove_group+0x101/0x2e0 fs/sysfs/group.c:328
 sysfs_remove_groups+0x54/0xb0 fs/sysfs/group.c:352
 net_rx_queue_update_kobjects+0x6b7/0x780 net/core/net-sysfs.c:1316
 remove_queue_kobjects net/core/net-sysfs.c:2148 [inline]
 netdev_unregister_kobject+0xff/0x450 net/core/net-sysfs.c:2304
 unregister_netdevice_many_notify+0x1bcd/0x2130 net/core/dev.c:12551
 unregister_netdevice_many net/core/dev.c:12589 [inline]
 unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12390
 unregister_netdevice include/linux/netdevice.h:3487 [inline]
 nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1198
 __nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1472
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1486 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1710
 nsim_drv_remove+0x58/0x160 drivers/net/netdevsim/dev.c:1725
 device_remove drivers/base/dd.c:616 [inline]
 __device_release_driver drivers/base/dd.c:1349 [inline]
 device_release_driver_internal+0x48b/0x880 drivers/base/dd.c:1372
 bus_remove_device+0x449/0x560 drivers/base/bus.c:664
 device_del+0x528/0x8f0 drivers/base/core.c:3965
 device_unregister+0x21/0xf0 drivers/base/core.c:4006
 nsim_bus_dev_del drivers/net/netdevsim/bus.c:488 [inline]
 del_device_store+0x2b5/0x370 drivers/net/netdevsim/bus.c:244
 kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
 new_sync_write fs/read_write.c:595 [inline]
 vfs_write+0x61e/0xbb0 fs/read_write.c:687
 ksys_write+0x156/0x270 fs/read_write.c:739
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f086965e98e
Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
RSP: 002b:00007fff5e9b7558 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000055555e32c500 RCX: 00007f086965e98e
RDX: 0000000000000001 RSI: 00007fff5e9b75e0 RDI: 0000000000000005
RBP: 00007f08697358ee R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fff5e9b75e0 R14: 00007f086a454620 R15: 0000000000000003
 </TASK>

Crashes (2750):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/20 07:06 upstream 518e5b794c06 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root possible deadlock in kernfs_remove_by_name_ns
2026/09/19 05:53 upstream ef31d04b6d8a 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root possible deadlock in kernfs_remove_by_name_ns
2026/09/14 00:22 upstream 2f0c1cf72f46 70a60e12 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root possible deadlock in kernfs_remove_by_name_ns
2026/07/24 16:57 upstream 48a5a7ab8d6a 4a865b71 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream possible deadlock in kernfs_remove_by_name_ns
2026/09/04 01:53 upstream 8ab1afb2eb24 801f0966 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 possible deadlock in kernfs_remove_by_name_ns
2026/09/22 11:26 net 12fec40907fa e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/22 04:24 net 12fec40907fa e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 23:42 net 12fec40907fa e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 22:30 net 1e24c4f2ee44 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 21:29 net 1e24c4f2ee44 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 13:13 net 1e24c4f2ee44 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 12:11 net 1e24c4f2ee44 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 08:54 net 1e24c4f2ee44 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 07:45 net 1e24c4f2ee44 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 06:10 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 05:05 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 03:10 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 21:45 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 16:49 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 15:27 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 12:25 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 10:47 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 09:29 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 06:16 net c82b797abe66 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/07/19 03:56 net 56d96fededd6 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/07/15 21:21 net 3f1f75536668 209f0369 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/22 12:28 net-next 2fba93180872 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/22 09:15 net-next 2fba93180872 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/22 08:31 net-next 2fba93180872 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/22 06:34 net-next 2fba93180872 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/22 05:26 net-next 2fba93180872 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/22 03:02 net-next 2fba93180872 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/22 01:40 net-next 2fba93180872 e12281bd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 20:51 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 19:38 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 18:33 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 17:06 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 16:03 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 14:37 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 13:34 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 11:03 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 09:55 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 06:19 net-next 8830e65ed46d 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 02:01 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/21 00:31 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 22:55 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 20:36 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 19:05 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 17:23 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 13:43 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 08:26 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/20 05:01 net-next a4e22e9253e7 853b104b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/07/15 09:50 net-next f6f3b36c15ed 209f0369 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce possible deadlock in kernfs_remove_by_name_ns
2026/09/04 15:32 linux-next 9d80aa4617b3 3f042c7b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root possible deadlock in kernfs_remove_by_name_ns
* Struck through repros no longer work on HEAD.