syzbot


INFO: task hung in __static_key_slow_dec_cpuslocked

Status: auto-obsoleted due to no activity on 2026/02/28 17:04
Subsystems: kernel
[Documentation on labels]
First crash: 93d, last: 93d

Sample crash report:
INFO: task kworker/0:3:26639 blocked for more than 150 seconds.
      Tainted: G     U  W I  L XTNJ syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:3     state:D stack:26248 pid:26639 tgid:26639 ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events jump_label_update_timeout
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5325 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6929
 __schedule_loop kernel/sched/core.c:7011 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:7026
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7083
 __mutex_lock_common kernel/locking/mutex.c:676 [inline]
 __mutex_lock+0x818/0x1060 kernel/locking/mutex.c:760
 class_mutex_constructor include/linux/mutex.h:228 [inline]
 __static_key_slow_dec_cpuslocked+0x41/0x150 kernel/jump_label.c:300
 __static_key_slow_dec kernel/jump_label.c:321 [inline]
 jump_label_update_timeout+0x1b/0x30 kernel/jump_label.c:329
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
3 locks held by kworker/0:1/10:
1 lock held by kworker/R-mm_pe/14:
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2678
1 lock held by khungtaskd/31:
 #0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8e3c45e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 kernel/locking/lockdep.c:6775
1 lock held by khugepaged/38:
 #0: ffffffff8e4fc3e8 (lock#5){+.+.}-{4:4}, at: __lru_add_drain_all+0x6e/0x6f0 mm/swap.c:840
4 locks held by kworker/1:1/43:
 #0: ffff88813ff16948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc90000b37d00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0x91/0x11f0 net/wireless/reg.c:2453
 #3: ffff888071ee0788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: class_wiphy_constructor include/net/cfg80211.h:6358 [inline]
 #3: ffff888071ee0788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_leave_invalid_chans net/wireless/reg.c:2441 [inline]
 #3: ffff888071ee0788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: reg_check_chans_work+0x11b/0x11f0 net/wireless/reg.c:2456
4 locks held by kworker/1:3/5828:
 #0: ffff88802525b948 ((wq_completion)wg-kex-wg2#14){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc9000417fd00 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffff88805144d308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x880 drivers/net/wireguard/noise.c:598
 #3: ffff888032ac5c60 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x880 drivers/net/wireguard/noise.c:632
3 locks held by kworker/1:6/5893:
 #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc9000457fd00 ((work_completion)(&(&ovs_net->masks_rebalance)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffffffff9060f168 (ovs_mutex){+.+.}-{4:4}, at: ovs_lock net/openvswitch/datapath.c:108 [inline]
 #2: ffffffff9060f168 (ovs_mutex){+.+.}-{4:4}, at: ovs_dp_masks_rebalance+0x24/0xf0 net/openvswitch/datapath.c:2561
2 locks held by kworker/0:4/5916:
4 locks held by kworker/0:2/14669:
3 locks held by kworker/0:0/26416:
1 lock held by kworker/R-wg-cr/26533:
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline]
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556
4 locks held by kworker/0:3/26639:
 #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc900001e7d00 (((apic_sw_disabled).work).work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffffffff8e265450 (cpu_hotplug_lock){++++}-{0:0}, at: __static_key_slow_dec kernel/jump_label.c:320 [inline]
 #2: ffffffff8e265450 (cpu_hotplug_lock){++++}-{0:0}, at: jump_label_update_timeout+0x12/0x30 kernel/jump_label.c:329
 #3: ffffffff8e4e8888 (jump_label_mutex){+.+.}-{4:4}, at: class_mutex_constructor include/linux/mutex.h:228 [inline]
 #3: ffffffff8e4e8888 (jump_label_mutex){+.+.}-{4:4}, at: __static_key_slow_dec_cpuslocked+0x41/0x150 kernel/jump_label.c:300
3 locks held by kworker/u10:0/27418:
3 locks held by kworker/u11:0/27419:
 #0: ffff88805f5f6948 ((wq_completion)hci5){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc90003bcfd00 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffff88803013cdc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0x90 net/bluetooth/hci_core.c:428
6 locks held by kworker/u10:1/27420:
3 locks held by kworker/u10:2/27421:
 #0: ffff88814c92b948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc900041ffd00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x12/0x30 net/ipv6/addrconf.c:4734
4 locks held by kworker/u10:3/27427:
3 locks held by kworker/u10:4/27446:
3 locks held by kworker/u11:1/27447:
 #0: ffff88805f5f7948 ((wq_completion)hci6){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc900034c7d00 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffff888077bfcdc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0x90 net/bluetooth/hci_core.c:428
4 locks held by kworker/u10:5/27583:
 #0: ffff88801ba9f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc9000469fd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffffffff900d52b0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x8b0 net/core/net_namespace.c:669
 #3: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: ops_exit_rtnl_list net/core/net_namespace.c:173 [inline]
 #3: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x7e9/0xab0 net/core/net_namespace.c:248
3 locks held by kworker/u10:6/27588:
4 locks held by kworker/u10:7/27654:
3 locks held by kworker/u11:2/27846:
2 locks held by getty/27912:
 #0: ffff8880346150a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000333b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 drivers/tty/n_tty.c:2222
3 locks held by kworker/u10:8/28272:
4 locks held by kworker/u10:9/28273:
3 locks held by kworker/u10:10/28274:
4 locks held by kworker/u10:11/28275:
3 locks held by kworker/u10:12/28276:
3 locks held by kworker/u10:13/28277:
7 locks held by kworker/u10:14/28278:
3 locks held by kworker/u10:15/28279:
3 locks held by kworker/u10:16/28280:
2 locks held by kworker/u10:17/28281:
5 locks held by kworker/u10:18/28282:
4 locks held by kworker/u10:19/28283:
1 lock held by kworker/R-wg-cr/29202:
3 locks held by kworker/1:0/29475:
 #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc90003a17d00 ((work_completion)(&(&ovs_net->masks_rebalance)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffffffff9060f168 (ovs_mutex){+.+.}-{4:4}, at: ovs_lock net/openvswitch/datapath.c:108 [inline]
 #2: ffffffff9060f168 (ovs_mutex){+.+.}-{4:4}, at: ovs_dp_masks_rebalance+0x24/0xf0 net/openvswitch/datapath.c:2561
1 lock held by kworker/R-wg-cr/30399:
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline]
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556
1 lock held by kworker/R-wg-cr/30614:
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2736 [inline]
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x839/0xea0 kernel/workqueue.c:3556
1 lock held by kworker/R-wg-cr/30618:
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x27/0x420 kernel/workqueue.c:2678
2 locks held by syz.0.5093/31512:
 #0: ffffffff900d52b0 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x2d6/0x690 net/core/net_namespace.c:576
 #1: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1b/0x230 drivers/net/wireguard/device.c:419
1 lock held by syz.4.5095/31517:
 #0: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: tap_put_queue drivers/net/tap.c:163 [inline]
 #0: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: tap_release+0x3e/0x450 drivers/net/tap.c:516
4 locks held by kworker/1:4/31524:
 #0: ffff8880a36fe548 ((wq_completion)wg-kex-wg0#20){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc900043bfd00 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffff888034601308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x1c2/0x880 drivers/net/wireguard/noise.c:598
 #3: ffff88807c4120f0 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_initiation+0x5ac/0x880 drivers/net/wireguard/noise.c:632
3 locks held by kworker/u11:3/31525:
 #0: ffff888037eda948 ((wq_completion)hci3){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc90003a07d00 ((work_completion)(&hdev->power_on)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffff888025e70dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_open+0x22/0x90 net/bluetooth/hci_core.c:428
3 locks held by kworker/1:5/31536:
 #0: ffff88802525bd48 ((wq_completion)wg-kex-wg1#18){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc90003f3fd00 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffff888032ac4090 (&cookie->lock){++++}-{4:4}, at: wg_cookie_add_mac_to_packet+0x37/0x1c0 drivers/net/wireguard/cookie.c:162
3 locks held by kworker/1:8/31538:
 #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc900043afd00 (deferred_process_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffffffff900eb6c8 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 net/switchdev/switchdev.c:104
4 locks held by kworker/1:9/31539:
 #0: ffff888057499948 ((wq_completion)wg-kex-wg0#24){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 kernel/workqueue.c:3238
 #1: ffffc90003f4fd00 ((work_completion)(&({ do { const void *__vpp_verify = (typeof((worker) + 0))((void *)0); (void)__vpp_verify; } while (0); ({ unsigned long __ptr; __asm__ ("" : "=r"(__ptr) : "0"((__typeof__(*((worker))) *)(( unsigned long)((worker))))); (typeof((__typeof__(*((worker))) *)(( unsigned long)((worker))))) (__ptr + (((__per_cpu_offset[(cpu)])))); }); })->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 kernel/workqueue.c:3239
 #2: ffff88807afc5308 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x22b/0x950 drivers/net/wireguard/noise.c:742
 #3: ffff88807c785278 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_consume_response+0x2f7/0x950 drivers/net/wireguard/noise.c:753
1 lock held by kworker/u11:4/31552:
1 lock held by kworker/u10:22/31553:
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: set_pf_worker kernel/workqueue.c:3352 [inline]
 #0: ffffffff8e27a268 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_thread+0x6c/0xf10 kernel/workqueue.c:3378

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G     U  W I  L XTNJ syzkaller #0 PREEMPT(full) 
Tainted: [U]=USER, [W]=WARN, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x27b/0x390 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x29c/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:332 [inline]
 watchdog+0xf3f/0x1170 kernel/hung_task.c:495
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 28278 Comm: kworker/u10:14 Tainted: G     U  W I  L XTNJ syzkaller #0 PREEMPT(full) 
Tainted: [U]=USER, [W]=WARN, [I]=FIRMWARE_WORKAROUND, [L]=SOFTLOCKUP, [X]=AUX, [T]=RANDSTRUCT, [N]=TEST, [J]=FWCTL
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
RIP: 0010:check_slab_allocation+0x0/0x110 mm/kasan/common.c:223
Code: 5d c3 cc cc cc cc 44 89 e2 48 89 de 48 89 ef e8 66 35 00 00 eb cb 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 54 49 89 fc 48 89 f7 55 48 89 d5 53 48 89 f3 e8 1b c3 49 ff 48
RSP: 0018:ffffc90000006ec8 EFLAGS: 00000292
RAX: ffff88823be00000 RBX: ffff8880a9498000 RCX: fffffffe6d698000
RDX: ffffffff8927e0d2 RSI: ffff8880a9498000 RDI: ffff88801ea87dc0
RBP: ffffc90000006f20 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff908253d7 R11: 0000000000000001 R12: ffffea0002a52600
R13: 0000000000212110 R14: 0000000000000000 R15: ffff88801ea87dc0
FS:  0000000000000000(0000) GS:ffff888124a0d000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d6edff8 CR3: 000000000e182000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 kasan_slab_pre_free include/linux/kasan.h:198 [inline]
 slab_free_hook mm/slub.c:2488 [inline]
 slab_free mm/slub.c:6642 [inline]
 kmem_cache_free+0x11b/0x6c0 mm/slub.c:6752
 __skb_ext_put+0x102/0x2c0 net/core/skbuff.c:7160
 skb_ext_put include/linux/skbuff.h:4947 [inline]
 skb_ext_put include/linux/skbuff.h:4944 [inline]
 skb_release_head_state+0x1c2/0x290 net/core/skbuff.c:1144
 skb_release_all net/core/skbuff.c:1150 [inline]
 __kfree_skb net/core/skbuff.c:1166 [inline]
 sk_skb_reason_drop+0xeb/0x1a0 net/core/skbuff.c:1204
 kfree_skb_reason include/linux/skbuff.h:1322 [inline]
 kfree_skb include/linux/skbuff.h:1331 [inline]
 ip6_mc_input+0x82c/0xf60 net/ipv6/ip6_input.c:593
 dst_input include/net/dst.h:474 [inline]
 dst_input include/net/dst.h:472 [inline]
 ip6_rcv_finish+0x3df/0x580 net/ipv6/ip6_input.c:79
 ip_sabotage_in+0x21e/0x290 net/bridge/br_netfilter_hooks.c:990
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_slow+0xbe/0x200 net/netfilter/core.c:623
 nf_hook.constprop.0+0x424/0x750 include/linux/netfilter.h:273
 NF_HOOK include/linux/netfilter.h:316 [inline]
 ipv6_rcv+0xa4/0x650 net/ipv6/ip6_input.c:311
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6079
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6192
 netif_receive_skb_internal net/core/dev.c:6278 [inline]
 netif_receive_skb+0x137/0x7b0 net/core/dev.c:6337
 NF_HOOK include/linux/netfilter.h:318 [inline]
 NF_HOOK include/linux/netfilter.h:312 [inline]
 br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70
 br_handle_frame_finish+0x10e8/0x1f00 net/bridge/br_input.c:235
 br_nf_hook_thresh+0x307/0x410 net/bridge/br_netfilter_hooks.c:1167
 br_nf_pre_routing_finish_ipv6+0x76a/0xfc0 net/bridge/br_netfilter_ipv6.c:154
 NF_HOOK include/linux/netfilter.h:318 [inline]
 br_nf_pre_routing_ipv6+0x3cd/0x8c0 net/bridge/br_netfilter_ipv6.c:184
 br_nf_pre_routing+0x860/0x15b0 net/bridge/br_netfilter_hooks.c:508
 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xb28/0x14e0 net/bridge/br_input.c:442
 __netif_receive_skb_core.constprop.0+0xa25/0x4bd0 net/core/dev.c:5966
 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6077
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6192
 process_backlog+0x439/0x15e0 net/core/dev.c:6544
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7594
 napi_poll net/core/dev.c:7657 [inline]
 net_rx_action+0x97f/0xef0 net/core/dev.c:7784
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xb2/0xf0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 fpregs_unlock arch/x86/include/asm/fpu/api.h:77 [inline]
 kernel_fpu_end+0x5e/0x70 arch/x86/kernel/fpu/core.c:479
 blake2s_compress+0x7b/0xe0 lib/crypto/x86/blake2s.h:44
 blake2s_final+0xc9/0x150 lib/crypto/blake2s.c:148
 hmac.constprop.0+0x335/0x420 drivers/net/wireguard/noise.c:333
 kdf.constprop.0+0x1a1/0x280 drivers/net/wireguard/noise.c:375
 mix_precomputed_dh drivers/net/wireguard/noise.c:426 [inline]
 wg_noise_handshake_create_initiation+0x406/0x610 drivers/net/wireguard/noise.c:560
 wg_packet_send_handshake_initiation+0x19a/0x360 drivers/net/wireguard/send.c:34
 wg_packet_handshake_send_worker+0x1c/0x30 drivers/net/wireguard/send.c:51
 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3263
 process_scheduled_works kernel/workqueue.c:3346 [inline]
 worker_thread+0x6c8/0xf10 kernel/workqueue.c:3427
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x675/0x7d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
net_ratelimit: 7157 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:1a:46:3a:72:8c:55, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:1a:46:3a:72:8c:55, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:1a:46:3a:72:8c:55, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:1a:46:3a:72:8c:55, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 10748 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:1a:46:3a:72:8c:55, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:1a:46:3a:72:8c:55, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:1a:46:3a:72:8c:55, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:1a:46:3a:72:8c:55, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/11/30 16:54 upstream 6bda50f4333f d1b870e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto INFO: task hung in __static_key_slow_dec_cpuslocked
* Struck through repros no longer work on HEAD.