BUG: soft lockup in dummy_timer

Status: premoderation: reported on 2026/11/07 16:16
Reported-by: syzbot+108d7a09bc8584b632df@syzkaller.appspotmail.com
First crash: 5h47m, last: 5h47m
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in dummy_timer (4) usb driver-core 1 syz, C inconclusive done 25 421d 1582d 29/29 fixed on 2025/11/14 12:00
upstream BUG: soft lockup in dummy_timer (2) prio:normal usb 1 1 59d 55d 0/29 moderation: reported on 2026/09/13 06:30
upstream BUG: soft lockup in dummy_timer usb 1 344 262d 331d 0/29 auto-obsoleted due to no activity on 2026/04/29 01:58
linux-5.15 INFO: rcu detected stall in dummy_timer 1 syz, C error 6 387d 1294d 0/3 auto-obsoleted due to no activity on 2026/01/24 13:15
upstream INFO: rcu detected stall in dummy_timer (3) usb 1 syz, C error 132 1719d 2307d 20/29 fixed on 2022/03/08 16:11

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 6s! [syz.1.1003:4485]
Modules linked in:
CPU: 0 PID: 4485 Comm: syz.1.1003 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x51/0x80 kernel/locking/spinlock.c:191
Code: 89 fe 48 c7 c7 70 73 4c 86 e8 0b 3b 1c fd 4c 89 f7 48 83 3d d0 69 c9 01 00 74 34 e8 fd ce c8 fc 66 90 48 89 5d e8 ff 75 e8 9d <bf> 01 00 00 00 e8 c5 c7 c1 fc 65 8b 05 ca 63 7f 7b 85 c0 74 09 48
RSP: 0000:ffffc90000007a78 EFLAGS: 00000a06
RAX: 0000000000000001 RBX: 0000000000000a06 RCX: dffffc0000000000
RDX: 0000000080000102 RSI: 0000000000000a06 RDI: ffff88810b7bc000
RBP: ffffc90000007a90 R08: ffff888111bae0db R09: 1ffff11022375c1b
R10: dffffc0000000000 R11: ffffed1022375c1c R12: ffff88810b86c340
R13: dffffc0000000000 R14: ffff88810b86c338 R15: 1ffff1102170d867
FS:  00007f321d2916c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000157030 CR3: 0000000144df3000 CR4: 00000000003526b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 spin_unlock_irqrestore include/linux/spinlock.h:410 [inline]
 dummy_timer+0x2fe1/0x32d0 drivers/usb/gadget/udc/dummy_hcd.c:-1
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1450
 expire_timers kernel/time/timer.c:1495 [inline]
 __run_timers+0x637/0x9a0 kernel/time/timer.c:1789
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1802
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x51/0x80 kernel/locking/spinlock.c:191
Code: 89 fe 48 c7 c7 70 73 4c 86 e8 0b 3b 1c fd 4c 89 f7 48 83 3d d0 69 c9 01 00 74 34 e8 fd ce c8 fc 66 90 48 89 5d e8 ff 75 e8 9d <bf> 01 00 00 00 e8 c5 c7 c1 fc 65 8b 05 ca 63 7f 7b 85 c0 74 09 48
RSP: 0000:ffffc90000ec7658 EFLAGS: 00000a06
RAX: 0000000000000001 RBX: 0000000000000a06 RCX: dffffc0000000000
RDX: ffffc900012576d8 RSI: 0000000000000a06 RDI: ffff888120882700
RBP: ffffc90000ec7670 R08: ffff888125d6e407 R09: 1ffff11024badc80
R10: dffffc0000000000 R11: ffffed1024badc81 R12: ffff888120882700
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
 spin_unlock_irqrestore include/linux/spinlock.h:410 [inline]
 __wake_up_common_lock kernel/sched/wait.c:126 [inline]
 __wake_up_sync_key+0x17b/0x2b0 kernel/sched/wait.c:194
 unix_dgram_recvmsg+0x49d/0xd30 net/unix/af_unix.c:2180
 ____sys_recvmsg+0x2ca/0x5b0 net/socket.c:-1
 ___sys_recvmsg+0x213/0x5c0 net/socket.c:2638
 do_recvmmsg+0x358/0x7a0 net/socket.c:2732
 __sys_recvmmsg net/socket.c:2811 [inline]
 __do_sys_recvmmsg net/socket.c:2834 [inline]
 __se_sys_recvmmsg net/socket.c:2827 [inline]
 __x64_sys_recvmmsg+0x195/0x250 net/socket.c:2827
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f321e85ab19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f321d291028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f321eae1090 RCX: 00007f321e85ab19
RDX: 0000000000010106 RSI: 00002000000004c0 RDI: 0000000000000004
RBP: 00007f321e8f2b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f321eae1128 R14: 00007f321eae1090 R15: 00007fff2f4d1628
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 300 Comm: kworker/u4:3 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:229 [inline]
RIP: 0010:smp_call_function_single+0x209/0x490 kernel/smp.c:517
Code: 48 44 89 f6 83 e6 01 31 ff e8 63 90 0a 00 41 83 e6 01 49 bc 00 00 00 00 00 fc ff df 75 0a e8 9e 8c 0a 00 e9 a4 00 00 00 f3 90 <f7> 44 24 48 01 00 00 00 0f 84 8f 00 00 00 e8 84 8c 0a 00 eb e9 e8
RSP: 0018:ffffc90000d37700 EFLAGS: 00000293
RAX: ffffffff815a2a3c RBX: 0000000000000000 RCX: ffff88812729a800
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90000d377f0 R08: ffff8881f7057687 R09: 1ffff1103ee0aed0
R10: dffffc0000000000 R11: ffffed103ee0aed1 R12: dffffc0000000000
R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff920001a6ee4
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f79838cd000 CR3: 000000000640f000 CR4: 00000000003526a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 smp_call_function_many_cond+0x8f5/0x9d0 kernel/smp.c:653
 smp_call_function_many kernel/smp.c:716 [inline]
 smp_call_function kernel/smp.c:738 [inline]
 on_each_cpu+0xab/0x180 kernel/smp.c:837
 text_poke_sync arch/x86/kernel/alternative.c:1568 [inline]
 text_poke_bp_batch+0x40e/0x5f0 arch/x86/kernel/alternative.c:1830
 text_poke_flush arch/x86/kernel/alternative.c:1959 [inline]
 text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:1966
 arch_jump_label_transform_apply+0x15/0x30 arch/x86/kernel/jump_label.c:126
 __jump_label_update+0x38f/0x3b0 kernel/jump_label.c:459
 jump_label_update+0x34c/0x3e0 kernel/jump_label.c:825
 static_key_enable_cpuslocked+0x126/0x240 kernel/jump_label.c:177
 static_key_enable+0x1a/0x30 kernel/jump_label.c:190
 toggle_allocation_gate+0xba/0x440 mm/kfence/core.c:624
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/11/07 16:15 android13-5.10-lts f61a392235e0 5cecaf1f .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: soft lockup in dummy_timer
* Struck through repros no longer work on HEAD.