WARNING in __ethtool_get_link_ksettings (2)

Status: internal: reported on 2026/08/21 05:58
Subsystems: net
Labels: prio:high
[Documentation on labels]
Fix commit: ef9fbe1b93f3 RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root]
First crash: 47d, last: 47d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
beeb89b2 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ WARNING in __ethtool_get_link_ksettings (2) 2026/08/23 01:05 2026/08/23 01:05 2026/08/23 02:27 1e72964b
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream WARNING in __ethtool_get_link_ksettings net prio:high -1 5 107d 108d 29/29 fixed on 2026/07/15 08:27

Sample crash report:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: kernel/locking/mutex.c:625 at __mutex_lock_common kernel/locking/mutex.c:625 [inline], CPU#0: kworker/0:3/5616
WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e6/0x1550 kernel/locking/mutex.c:821, CPU#0: kworker/0:3/5616
Modules linked in:
CPU: 0 UID: 0 PID: 5616 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: infiniband ib_cache_event_task
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:625 [inline]
RIP: 0010:__mutex_lock+0x12ed/0x1550 kernel/locking/mutex.c:821
Code: c3 58 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d a7 c1 7e 04 00 75 13 48 8d 3d ba b7 81 04 48 c7 c6 a0 fc ec 8b <67> 48 0f b9 3a 90 e9 67 ee ff ff 90 0f 0b 90 e9 3a f2 ff ff 90 0f
RSP: 0018:ffffc9000426f540 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88807f603e80
RDX: 0000000000000000 RSI: ffffffff8becfca0 RDI: ffffffff905bb960
RBP: ffffc9000426f6d0 R08: ffffffff9058c343 R09: 1ffffffff20b1868
R10: dffffc0000000000 R11: fffffbfff20b1869 R12: ffff888029238e10
R13: 0000000000000000 R14: 1ffff9200084debc R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff888124f24000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc72cbc8e8 CR3: 0000000078eda000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 netdev_lock include/linux/netdevice.h:2861 [inline]
 netdev_lock_ops include/net/netdev_lock.h:42 [inline]
 __ethtool_get_link_ksettings+0x109/0x250 net/ethtool/ioctl.c:463
 __ethtool_get_link_ksettings+0x11f/0x250 net/ethtool/ioctl.c:464
 ib_get_eth_speed+0x180/0x7f0 drivers/infiniband/core/verbs.c:2052
 rxe_query_port+0x93/0x3d0 drivers/infiniband/sw/rxe/rxe_verbs.c:56
 __ib_query_port drivers/infiniband/core/device.c:2129 [inline]
 ib_query_port+0x16e/0x830 drivers/infiniband/core/device.c:2161
 ib_cache_update+0x1ba/0xc50 drivers/infiniband/core/cache.c:1456
 ib_cache_event_task+0xd3/0x1c0 drivers/infiniband/core/cache.c:1535
 process_one_work kernel/workqueue.c:3322 [inline]
 process_scheduled_works+0xa88/0x14c0 kernel/workqueue.c:3405
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
----------------
Code disassembly (best guess):
   0:	c3                   	ret
   1:	58                   	pop    %rax
   2:	90                   	nop
   3:	48 c1 e8 03          	shr    $0x3,%rax
   7:	0f b6 04 18          	movzbl (%rax,%rbx,1),%eax
   b:	84 c0                	test   %al,%al
   d:	0f 85 47 02 00 00    	jne    0x25a
  13:	83 3d a7 c1 7e 04 00 	cmpl   $0x0,0x47ec1a7(%rip)        # 0x47ec1c1
  1a:	75 13                	jne    0x2f
  1c:	48 8d 3d ba b7 81 04 	lea    0x481b7ba(%rip),%rdi        # 0x481b7dd
  23:	48 c7 c6 a0 fc ec 8b 	mov    $0xffffffff8becfca0,%rsi
* 2a:	67 48 0f b9 3a       	ud1    (%edx),%rdi <-- trapping instruction
  2f:	90                   	nop
  30:	e9 67 ee ff ff       	jmp    0xffffee9c
  35:	90                   	nop
  36:	0f 0b                	ud2
  38:	90                   	nop
  39:	e9 3a f2 ff ff       	jmp    0xfffff278
  3e:	90                   	nop
  3f:	0f                   	.byte 0xf

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/21 05:57 net 91ec20351349 1e72964b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce WARNING in __ethtool_get_link_ksettings
* Struck through repros no longer work on HEAD.