Extracting prog: 14m46.970543521s
Minimizing prog: 31m19.658214731s
Simplifying prog options: 0s
Extracting C: 55.950321051s
Simplifying C: 12m37.673592616s
extracting reproducer from 34 programs
testing a last program of every proc
single: executing 9 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): open-open-mkdirat-renameat2-renameat2
detailed listing:
executing program 0:
r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0)
mkdirat(r1, &(0x7f0000000200)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x0)
renameat2(r1, &(0x7f0000000100)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r0, &(0x7f0000000180)='./file1\x00', 0x4)
renameat2(r0, &(0x7f0000000480)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', r1, &(0x7f0000000500)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38/\x00', 0x2)
program did not crash
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0xd07, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x20945, 0x6c101}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x10}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x6}, 0x0)
program crashed: WARNING in print_bfs_bug
single: successfully extracted reproducer
found reproducer with 2 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_route
detailed listing:
executing program 0:
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0xd07, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x20945, 0x6c101}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x10}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x6}, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x6}, 0x0)
program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={0x0}, 0x1, 0x0, 0x0, 0x6}, 0x0)
program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
program crashed: WARNING in print_bfs_bug
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
program crashed: WARNING in print_bfs_bug
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
program crashed: WARNING in print_bfs_bug
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
program crashed: WARNING in print_bfs_bug
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
program crashed: WARNING in print_bfs_bug
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
program crashed: WARNING in print_bfs_bug
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
program crashed: WARNING in print_bfs_bug
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
program crashed: WARNING in print_bfs_bug
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0xd07, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x20945, 0x6c101}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x10}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x6}, 0x0)
program crashed: WARNING in print_bfs_bug
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0xd07, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x20945, 0x6c101}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x10}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x6}, 0x0)
program crashed: WARNING in print_bfs_bug
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000080)=@newlink={0x40, 0x10, 0xd07, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x20945, 0x6c101}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @bond={{0x9}, {0x10, 0x2, 0x0, 0x1, [@IFLA_BOND_ARP_INTERVAL={0x8, 0x7, 0x10}, @IFLA_BOND_ARP_IP_TARGET={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x6}, 0x0)
program crashed: WARNING in print_bfs_bug
validation run: crashed=true
reproducing took 1h4m32.644023008s
repro crashed as (corrupted=false):
Increase LOCKDEP_CIRCULAR_QUEUE_BITS to avoid this warning:
------------[ cut here ]------------
lockdep bfs error:-1
WARNING: kernel/locking/lockdep.c:2059 at print_bfs_bug+0x20/0x40 kernel/locking/lockdep.c:2059, CPU#1: kworker/u8:2/42
Modules linked in:
CPU: 1 UID: 0 PID: 42 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events_unbound linkwatch_event
RIP: 0010:print_bfs_bug+0x22/0x40 kernel/locking/lockdep.c:2059
Code: 90 90 90 90 90 90 90 90 55 53 89 fb e8 67 b4 f1 02 89 c5 e8 10 8a ff ff 85 ed 74 13 83 fb ff 74 16 48 8d 3d 80 df ac 0d 89 de <67> 48 0f b9 3a 5b 5d e9 42 a8 76 09 cc 48 c7 c7 3f cb 4b 8d e8 75
RSP: 0018:ffffc90000b471a8 EFLAGS: 00010046
RAX: 000000000000003b RBX: 00000000ffffffff RCX: b8ceeaae09d4fa00
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffff8f4c4810
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000168de5 R12: ffffffff95d7df98
R13: ffffffff92e3b618 R14: ffff88801f2f8000 R15: 0000000000000026
FS: 0000000000000000(0000) GS:ffff888126695000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f151dfcda08 CR3: 00000000345f2000 CR4: 00000000003526f0
Call Trace:
check_irq_usage kernel/locking/lockdep.c:-1 [inline]
check_prev_add kernel/locking/lockdep.c:3169 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x2550/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868
_raw_spin_lock_nested+0x32/0x50 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:647
raw_spin_rq_lock kernel/sched/sched.h:1615 [inline]
_task_rq_lock+0xbc/0x470 kernel/sched/core.c:747
class_task_rq_lock_constructor kernel/sched/sched.h:1917 [inline]
migrate_disable_switch kernel/sched/core.c:2366 [inline]
__schedule+0x16b0/0x5210 kernel/sched/core.c:6792
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7234
irqentry_exit+0x599/0x620 kernel/entry/common.c:239
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x221/0x330 kernel/locking/lockdep.c:5872
Code: ff ff ff e8 71 44 73 09 f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 db a1 89 10 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 80 02 77 09 cc 48 8d 3d b8 33 ad
RSP: 0018:ffffc90000b47780 EFLAGS: 00000282
RAX: b8ceeaae09d4fa00 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 0000000000000004 RSI: ffffffff8d5a1617 RDI: ffffffff8b861580
RBP: ffffffff890aa650 R08: 0000000000000002 R09: ffffffff954d9bb8
R10: 000000003e9d0964 R11: 0000000006981662 R12: 0000000000000000
R13: ffff888031009230 R14: 0000000000000001 R15: 0000000000000246
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
dev_reset_queue+0x110/0x1f0 net/sched/sch_generic.c:1308
netdev_for_each_tx_queue include/linux/netdevice.h:2680 [inline]
dev_deactivate_many+0x71f/0xd40 net/sched/sch_generic.c:1374
dev_deactivate+0x120/0x1c0 net/sched/sch_generic.c:1397
linkwatch_do_dev+0xd7/0x110 net/core/link_watch.c:184
__linkwatch_run_queue+0x575/0x850 net/core/link_watch.c:240
linkwatch_event+0x4c/0x60 net/core/link_watch.c:314
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 55 push %rbp
9: 53 push %rbx
a: 89 fb mov %edi,%ebx
c: e8 67 b4 f1 02 call 0x2f1b478
11: 89 c5 mov %eax,%ebp
13: e8 10 8a ff ff call 0xffff8a28
18: 85 ed test %ebp,%ebp
1a: 74 13 je 0x2f
1c: 83 fb ff cmp $0xffffffff,%ebx
1f: 74 16 je 0x37
21: 48 8d 3d 80 df ac 0d lea 0xdacdf80(%rip),%rdi # 0xdacdfa8
28: 89 de mov %ebx,%esi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 5b pop %rbx
30: 5d pop %rbp
31: e9 42 a8 76 09 jmp 0x976a878
36: cc int3
37: 48 c7 c7 3f cb 4b 8d mov $0xffffffff8d4bcb3f,%rdi
3e: e8 .byte 0xe8
3f: 75 .byte 0x75
final repro crashed as (corrupted=false):
Increase LOCKDEP_CIRCULAR_QUEUE_BITS to avoid this warning:
------------[ cut here ]------------
lockdep bfs error:-1
WARNING: kernel/locking/lockdep.c:2059 at print_bfs_bug+0x20/0x40 kernel/locking/lockdep.c:2059, CPU#1: kworker/u8:2/42
Modules linked in:
CPU: 1 UID: 0 PID: 42 Comm: kworker/u8:2 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events_unbound linkwatch_event
RIP: 0010:print_bfs_bug+0x22/0x40 kernel/locking/lockdep.c:2059
Code: 90 90 90 90 90 90 90 90 55 53 89 fb e8 67 b4 f1 02 89 c5 e8 10 8a ff ff 85 ed 74 13 83 fb ff 74 16 48 8d 3d 80 df ac 0d 89 de <67> 48 0f b9 3a 5b 5d e9 42 a8 76 09 cc 48 c7 c7 3f cb 4b 8d e8 75
RSP: 0018:ffffc90000b471a8 EFLAGS: 00010046
RAX: 000000000000003b RBX: 00000000ffffffff RCX: b8ceeaae09d4fa00
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffffffff8f4c4810
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: fffff52000168de5 R12: ffffffff95d7df98
R13: ffffffff92e3b618 R14: ffff88801f2f8000 R15: 0000000000000026
FS: 0000000000000000(0000) GS:ffff888126695000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f151dfcda08 CR3: 00000000345f2000 CR4: 00000000003526f0
Call Trace:
check_irq_usage kernel/locking/lockdep.c:-1 [inline]
check_prev_add kernel/locking/lockdep.c:3169 [inline]
check_prevs_add kernel/locking/lockdep.c:3284 [inline]
validate_chain kernel/locking/lockdep.c:3908 [inline]
__lock_acquire+0x2550/0x2cf0 kernel/locking/lockdep.c:5237
lock_acquire+0x106/0x330 kernel/locking/lockdep.c:5868
_raw_spin_lock_nested+0x32/0x50 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:647
raw_spin_rq_lock kernel/sched/sched.h:1615 [inline]
_task_rq_lock+0xbc/0x470 kernel/sched/core.c:747
class_task_rq_lock_constructor kernel/sched/sched.h:1917 [inline]
migrate_disable_switch kernel/sched/core.c:2366 [inline]
__schedule+0x16b0/0x5210 kernel/sched/core.c:6792
preempt_schedule_irq+0x4d/0xa0 kernel/sched/core.c:7234
irqentry_exit+0x599/0x620 kernel/entry/common.c:239
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x221/0x330 kernel/locking/lockdep.c:5872
Code: ff ff ff e8 71 44 73 09 f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 db a1 89 10 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 80 02 77 09 cc 48 8d 3d b8 33 ad
RSP: 0018:ffffc90000b47780 EFLAGS: 00000282
RAX: b8ceeaae09d4fa00 RBX: 0000000000000000 RCX: 0000000000000046
RDX: 0000000000000004 RSI: ffffffff8d5a1617 RDI: ffffffff8b861580
RBP: ffffffff890aa650 R08: 0000000000000002 R09: ffffffff954d9bb8
R10: 000000003e9d0964 R11: 0000000006981662 R12: 0000000000000000
R13: ffff888031009230 R14: 0000000000000001 R15: 0000000000000246
rt_spin_lock+0x83/0x400 kernel/locking/spinlock_rt.c:56
spin_lock_bh include/linux/spinlock_rt.h:90 [inline]
dev_reset_queue+0x110/0x1f0 net/sched/sch_generic.c:1308
netdev_for_each_tx_queue include/linux/netdevice.h:2680 [inline]
dev_deactivate_many+0x71f/0xd40 net/sched/sch_generic.c:1374
dev_deactivate+0x120/0x1c0 net/sched/sch_generic.c:1397
linkwatch_do_dev+0xd7/0x110 net/core/link_watch.c:184
__linkwatch_run_queue+0x575/0x850 net/core/link_watch.c:240
linkwatch_event+0x4c/0x60 net/core/link_watch.c:314
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3358
worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
kthread+0x388/0x470 kernel/kthread.c:467
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 55 push %rbp
9: 53 push %rbx
a: 89 fb mov %edi,%ebx
c: e8 67 b4 f1 02 call 0x2f1b478
11: 89 c5 mov %eax,%ebp
13: e8 10 8a ff ff call 0xffff8a28
18: 85 ed test %ebp,%ebp
1a: 74 13 je 0x2f
1c: 83 fb ff cmp $0xffffffff,%ebx
1f: 74 16 je 0x37
21: 48 8d 3d 80 df ac 0d lea 0xdacdf80(%rip),%rdi # 0xdacdfa8
28: 89 de mov %ebx,%esi
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: 5b pop %rbx
30: 5d pop %rbp
31: e9 42 a8 76 09 jmp 0x976a878
36: cc int3
37: 48 c7 c7 3f cb 4b 8d mov $0xffffffff8d4bcb3f,%rdi
3e: e8 .byte 0xe8
3f: 75 .byte 0x75