BUG: soft lockup in gate_timer_func

Status: upstream: reported on 2026/11/15 07:04
Reported-by: syzbot+32c7eb39a89acce94307@syzkaller.appspotmail.com
First crash: 13h35m, last: 13h35m
▶ ▼ Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: soft lockup in gate_timer_func prio:normal kernel 1 syz, C 6 30d 90d 0/29 upstream: reported C repro on 2026/08/17 16:04
linux-5.15 INFO: rcu detected stall in gate_timer_func 1 6 10d 84d 0/3 upstream: reported on 2026/08/23 13:40

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [syz.1.415:6780]
Modules linked in:
irq event stamp: 49010181
hardirqs last  enabled at (49010180): [<ffff8000083cb2d8>] seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
hardirqs last  enabled at (49010180): [<ffff8000083cb2d8>] ktime_mono_to_any+0x14c/0x228 kernel/time/timekeeping.c:932
hardirqs last disabled at (49010181): [<ffff800011b9d900>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (49010181): [<ffff800011b9d900>] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:486
softirqs last  enabled at (19128): [<ffff8000081aec5c>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (19128): [<ffff8000081aec5c>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (26343): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
CPU: 0 PID: 6780 Comm: syz.1.415 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026
pstate: 42400005 (nZcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : ktime_mono_to_any+0x16c/0x228 kernel/time/timekeeping.c:932
lr : seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
lr : ktime_mono_to_any+0x168/0x228 kernel/time/timekeeping.c:932
sp : ffff800008007c80
x29: ffff800008007c80 x28: ffff0000f24fa948 x27: 0000000000000000
x26: ffff8000165d0000 x25: 1ffff00002cba203 x24: dfff800000000000
x23: 0000000000000080 x22: ffff8000165d0f48 x21: ffff8000165d1018
x20: 399e8000100f4700 x19: 0000001dd3f376fc x18: 0000000000000000
x17: 3004320000020601 x16: ffff8000082de324 x15: 0000000000000000
x14: 1ffff00002c7c073 x13: dfff800000000000 x12: 00000000e1c277bb
x11: ff008000083cb2f4 x10: 0000000000000000 x9 : ffff8000083cb2f4
x8 : ffff0000c66fd400 x7 : ffff8000100f4700 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : 0000000000000080 x0 : 0000000000000000
Call trace:
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
 seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
 ktime_mono_to_any+0x16c/0x228 kernel/time/timekeeping.c:932
 gate_get_time net/sched/act_gate.c:28 [inline]
 gate_timer_func+0x1ec/0x3f0 net/sched/act_gate.c:100
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x444/0xc58 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x164/0x408 kernel/time/hrtimer.c:1832
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:585
 trace_lock_release include/trace/events/lock.h:69 [inline]
 lock_release+0x64/0x90c kernel/locking/lockdep.c:5801
 __might_fault+0xf0/0x124 mm/memory.c:5850
 do_recvmmsg+0x3ac/0x9d8 net/socket.c:2880
 __sys_recvmmsg net/socket.c:2953 [inline]
 __do_sys_recvmmsg net/socket.c:2976 [inline]
 __se_sys_recvmmsg net/socket.c:2969 [inline]
 __arm64_sys_recvmmsg+0x184/0x244 net/socket.c:2969
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x12c arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:589

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/15 07:03 linux-6.1.y c75b0cf0982c 819ebe34 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: soft lockup in gate_timer_func
* Struck through repros no longer work on HEAD.