syzbot
WARNING in __ethtool_get_link_ksettings (2)
Status: internal: reported on 2026/08/21 05:58
Subsystems:
net
Labels:
prio:high
[Documentation on labels]
Fix commit:
ef9fbe1b93f3
RDMA/core: Reject unregistering netdevs in ib_get_eth_speed
Patched on: [ci-qemu-gce-upstream-auto ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu-native-arm64-kvm ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root]
First crash: 47d, last: 47d
Sample crash report:
------------[ cut here ]------------
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: kernel/locking/mutex.c:625 at __mutex_lock_common kernel/locking/mutex.c:625 [inline], CPU#0: kworker/0:3/5616
WARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12e6/0x1550 kernel/locking/mutex.c:821, CPU#0: kworker/0:3/5616
Modules linked in:
CPU: 0 UID: 0 PID: 5616 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: infiniband ib_cache_event_task
RIP: 0010:__mutex_lock_common kernel/locking/mutex.c:625 [inline]
RIP: 0010:__mutex_lock+0x12ed/0x1550 kernel/locking/mutex.c:821
Code: c3 58 90 48 c1 e8 03 0f b6 04 18 84 c0 0f 85 47 02 00 00 83 3d a7 c1 7e 04 00 75 13 48 8d 3d ba b7 81 04 48 c7 c6 a0 fc ec 8b <67> 48 0f b9 3a 90 e9 67 ee ff ff 90 0f 0b 90 e9 3a f2 ff ff 90 0f
RSP: 0018:ffffc9000426f540 EFLAGS: 00010246
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffff88807f603e80
RDX: 0000000000000000 RSI: ffffffff8becfca0 RDI: ffffffff905bb960
RBP: ffffc9000426f6d0 R08: ffffffff9058c343 R09: 1ffffffff20b1868
R10: dffffc0000000000 R11: fffffbfff20b1869 R12: ffff888029238e10
R13: 0000000000000000 R14: 1ffff9200084debc R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888124f24000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffc72cbc8e8 CR3: 0000000078eda000 CR4: 00000000003526f0
Call Trace:
<TASK>
netdev_lock include/linux/netdevice.h:2861 [inline]
netdev_lock_ops include/net/netdev_lock.h:42 [inline]
__ethtool_get_link_ksettings+0x109/0x250 net/ethtool/ioctl.c:463
__ethtool_get_link_ksettings+0x11f/0x250 net/ethtool/ioctl.c:464
ib_get_eth_speed+0x180/0x7f0 drivers/infiniband/core/verbs.c:2052
rxe_query_port+0x93/0x3d0 drivers/infiniband/sw/rxe/rxe_verbs.c:56
__ib_query_port drivers/infiniband/core/device.c:2129 [inline]
ib_query_port+0x16e/0x830 drivers/infiniband/core/device.c:2161
ib_cache_update+0x1ba/0xc50 drivers/infiniband/core/cache.c:1456
ib_cache_event_task+0xd3/0x1c0 drivers/infiniband/core/cache.c:1535
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa88/0x14c0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x38b/0x480 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
----------------
Code disassembly (best guess):
0: c3 ret
1: 58 pop %rax
2: 90 nop
3: 48 c1 e8 03 shr $0x3,%rax
7: 0f b6 04 18 movzbl (%rax,%rbx,1),%eax
b: 84 c0 test %al,%al
d: 0f 85 47 02 00 00 jne 0x25a
13: 83 3d a7 c1 7e 04 00 cmpl $0x0,0x47ec1a7(%rip) # 0x47ec1c1
1a: 75 13 jne 0x2f
1c: 48 8d 3d ba b7 81 04 lea 0x481b7ba(%rip),%rdi # 0x481b7dd
23: 48 c7 c6 a0 fc ec 8b mov $0xffffffff8becfca0,%rsi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 90 nop
30: e9 67 ee ff ff jmp 0xffffee9c
35: 90 nop
36: 0f 0b ud2
38: 90 nop
39: e9 3a f2 ff ff jmp 0xfffff278
3e: 90 nop
3f: 0f .byte 0xf
* Struck through repros no longer work on HEAD.