BUG: soft lockup in aoecmd_cfg (4)

Status: moderation: reported on 2026/10/08 20:17
Subsystems: block
Labels: prio:low
[Documentation on labels]
Reported-by: syzbot+3d14c8e2999efd7beb27@syzkaller.appspotmail.com
First crash: 4d17h, last: 1d05h
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
837f668e assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ BUG: soft lockup in aoecmd_cfg (4) 2026/10/06 00:53 2026/10/06 00:53 2026/10/06 01:30 1995e6c7
▶ ▼ Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 INFO: rcu detected stall in aoecmd_cfg 1 2 771d 861d 0/3 auto-obsoleted due to no activity on 2024/12/07 10:13
upstream BUG: soft lockup in aoecmd_cfg (3) prio:low block 1 27 182d 527d 0/29 auto-obsoleted due to no activity on 2026/07/19 06:30
upstream BUG: soft lockup in aoecmd_cfg (2) block 1 3 675d 707d 0/29 auto-obsoleted due to no activity on 2025/03/02 19:34
upstream BUG: soft lockup in aoecmd_cfg block 1 1 994d 990d 0/29 auto-obsoleted due to no activity on 2024/04/17 16:28
upstream INFO: rcu detected stall in aoecmd_cfg (2) usb block 1 syz, C done 7 770d 883d 28/29 fixed on 2024/10/22 11:57
linux-6.6 INFO: rcu detected stall in aoecmd_cfg (2) 1 1 17d 17d 0/2 upstream: reported on 2026/09/21 22:20
linux-5.15 INFO: rcu detected stall in aoecmd_cfg (3) 1 5 17d 37d 0/3 upstream: reported on 2026/09/01 17:54
linux-5.15 INFO: rcu detected stall in aoecmd_cfg 1 1 417d 417d 0/3 auto-obsoleted due to no activity on 2025/11/25 17:18
linux-6.1 INFO: rcu detected stall in aoecmd_cfg (2) 1 1 227d 227d 0/3 auto-obsoleted due to no activity on 2026/06/03 19:48
linux-5.15 INFO: rcu detected stall in aoecmd_cfg (2) 1 2 257d 317d 0/3 auto-obsoleted due to no activity on 2026/05/05 06:23
linux-6.6 INFO: rcu detected stall in aoecmd_cfg 1 1 222d 222d 0/2 auto-obsoleted due to no activity on 2026/06/09 04:24
upstream INFO: rcu detected stall in aoecmd_cfg block 1 2 2099d 2131d 0/29 auto-closed as invalid on 2021/04/09 11:08

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 140s! [syz.7.807:10082]
Modules linked in:
irq event stamp: 126687
hardirqs last  enabled at (126686): [<ffffffff818911d6>] __local_bh_enable_ip+0xd6/0x140 kernel/softirq.c:478
hardirqs last disabled at (126687): [<ffffffff8be71c2e>] sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1062
softirqs last  enabled at (120560): [<ffffffff81891e7b>] __do_softirq kernel/softirq.c:679 [inline]
softirqs last  enabled at (120560): [<ffffffff81891e7b>] invoke_softirq kernel/softirq.c:519 [inline]
softirqs last  enabled at (120560): [<ffffffff81891e7b>] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
softirqs last disabled at (122583): [<ffffffff81891e7b>] __do_softirq kernel/softirq.c:679 [inline]
softirqs last disabled at (122583): [<ffffffff81891e7b>] invoke_softirq kernel/softirq.c:519 [inline]
softirqs last disabled at (122583): [<ffffffff81891e7b>] __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
CPU: 0 UID: 0 PID: 10082 Comm: syz.7.807 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:debug_lockdep_rcu_enabled+0xd/0x40 kernel/rcu/update.c:320
Code: 8e 67 48 0f b9 3a 90 eb bc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 31 c0 83 3d 3b 38 93 04 00 <74> 1d 83 3d 0a 68 93 04 00 74 14 65 48 8b 0d 88 64 ae 07 31 c0 83
RSP: 0018:ffffc900000075f8 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffffffff81b3e3c7 RCX: 0000000000000101
RDX: 000000008cf65548 RSI: ffffffff8e69f5c6 RDI: ffffffff8c6dad80
RBP: 1ffff92000000edc R08: ffffffff817811df R09: 0000000000000000
R10: ffffc900000073c0 R11: ffffffff81b2c450 R12: dffffc0000000000
R13: ffffffff817811df R14: ffffc900000076a8 R15: 1ffff92000000ed5
FS:  0000000000000000(0000) GS:ffff888124cc7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f528c47dff8 CR3: 000000002b72a000 CR4: 00000000003526f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 rcu_read_lock include/linux/rcupdate.h:850 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 unwind_next_frame+0xb5/0x2550 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:351 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:377
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_node_noprof+0x354/0x610 mm/slub.c:5068
 __alloc_skb+0x1db/0x7a0 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 new_skb+0x2c/0x2a0 drivers/block/aoe/aoecmd.c:66
 aoecmd_cfg_pkts drivers/block/aoe/aoecmd.c:430 [inline]
 aoecmd_cfg+0x2b1/0x800 drivers/block/aoe/aoecmd.c:1374
 call_timer_fn+0x18d/0x5f0 kernel/time/timer.c:1748
 expire_timers kernel/time/timer.c:1799 [inline]
 __run_timers kernel/time/timer.c:2374 [inline]
 __run_timer_base+0x652/0x8b0 kernel/time/timer.c:2386
 run_timer_base kernel/time/timer.c:2395 [inline]
 run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
 handle_softirqs+0x226/0x860 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0xcb/0x220 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:memcpy_orig+0x87/0x140 arch/x86/lib/memcpy_64.S:114
Code: 8b 56 e8 4c 8b 5e e0 48 8d 76 e0 4c 89 47 f8 4c 89 4f f0 4c 89 57 e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 <83> fa 10 72 34 4c 8b 06 4c 8b 4e 08 4c 8b 54 16 f0 4c 8b 5c 16 f8
RSP: 0018:ffffc9000422e118 EFLAGS: 00000287
RAX: ffffe8ffffce22c8 RBX: ffffe8ffffce22b0 RCX: ffffffff81a2a9c3
RDX: 000000000000000d RSI: ffffffff8c0e4240 RDI: ffffe8ffffce22c8
RBP: ffffc9000422e208 R08: ffffe8ffffce22d4 R09: 1ffffd1ffff9c45a
R10: dffffc0000000000 R11: fffff91ffff9c45b R12: ffff8880b8633460
R13: 000000000000000e R14: 000000000000002c R15: 1ffff92000845c2c
 do_perf_trace_lock include/trace/events/lock.h:61 [inline]
 perf_trace_lock+0x2b3/0x410 include/trace/events/lock.h:49
 __do_trace_lock_release include/trace/events/lock.h:68 [inline]
 trace_lock_release include/trace/events/lock.h:68 [inline]
 lock_release+0x396/0x3c0 kernel/locking/lockdep.c:5954
 rcu_lock_release include/linux/rcupdate.h:319 [inline]
 rcu_read_unlock include/linux/rcupdate.h:880 [inline]
 __update_page_owner_handle+0x512/0x580 mm/page_owner.c:288
 __set_page_owner+0x10a/0x4c0 mm/page_owner.c:360
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_pages_mpol+0x21e/0x390 mm/mempolicy.c:2486
 folio_alloc_mpol_noprof+0x39/0x160 mm/mempolicy.c:2505
 shmem_alloc_folio mm/shmem.c:1936 [inline]
 shmem_alloc_and_add_folio+0x43e/0xf60 mm/shmem.c:1978
 shmem_get_folio_gfp+0x5da/0x16d0 mm/shmem.c:2531
 shmem_get_folio mm/shmem.c:2637 [inline]
 shmem_write_begin+0x16c/0x330 mm/shmem.c:3268
 generic_perform_write+0x2d5/0x8f0 mm/filemap.c:4374
 shmem_file_write_iter+0xf8/0x120 mm/shmem.c:3443
 __kernel_write_iter+0x44a/0x8f0 fs/read_write.c:621
 dump_emit_page fs/coredump.c:1293 [inline]
 dump_user_range+0xc19/0x12c0 fs/coredump.c:1367
 elf_core_dump+0x3485/0x3a90 fs/binfmt_elf.c:2106
 coredump_write+0x1290/0x1960 fs/coredump.c:1047
 do_coredump fs/coredump.c:1126 [inline]
 vfs_coredump+0x3764/0x4520 fs/coredump.c:1195
 get_signal+0x1094/0x12c0 kernel/signal.c:3097
 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:101 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
 irqentry_exit+0x2ba/0x910 kernel/entry/common.c:165
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7f9b97a53bd7
Code: e8 fe f9 ff ff 89 f2 48 8d 3d 8d 4f 1b 00 48 8d 35 0a 0b 1e 00 31 c0 e8 37 f8 ff ff 0f 1f 80 00 00 00 00 53 89 fb 48 83 ec 10 <64> 8b 04 25 a4 ff ff ff 85 c0 74 2a 89 fe 31 c0 bf 3c 00 00 00 e8
RSP: 002b:00007f9b98a7f120 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 000000000000000b RCX: 00007f9b97b9e159
RDX: 00007f9b98a7f140 RSI: 00007f9b98a7f270 RDI: 000000000000000b
RBP: 00007f9b97c3506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f9b97e26038 R14: 00007f9b97e25fa0 R15: 00007ffcd16574d8
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 10149 Comm: syz.5.819 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:csd_lock_wait kernel/smp.c:363 [inline]
RIP: 0010:csd_lock kernel/smp.c:396 [inline]
RIP: 0010:smp_call_function_many_cond+0x62d/0x1500 kernel/smp.c:944
Code: 89 fe 83 e6 01 31 ff e8 01 59 0c 00 41 83 e7 01 75 07 e8 f6 53 0c 00 eb 3f f3 90 48 b8 00 00 00 00 00 fc ff df 41 0f b6 04 04 <84> c0 75 0f f7 03 01 00 00 00 74 1d e8 d2 53 0c 00 eb dc 89 d9 80
RSP: 0018:ffffc90003f4f320 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff8880b8643708 RCX: ffff88807a0cddc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90003f4f470 R08: ffff88807a0cf35f R09: 1ffff1100f419e6b
R10: dffffc0000000000 R11: 0000000000000000 R12: 1ffff110170c86e1
R13: 0000000000000000 R14: ffff8880b8643700 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888124dc7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000100000002 CR3: 000000007ae8a000 CR4: 00000000003526f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 __flush_tlb_multi arch/x86/include/asm/paravirt.h:46 [inline]
 flush_tlb_multi arch/x86/mm/tlb.c:1361 [inline]
 flush_tlb_mm_range+0x8ff/0x1090 arch/x86/mm/tlb.c:1435
 tlb_flush arch/x86/include/asm/tlb.h:23 [inline]
 tlb_flush_mmu_tlbonly include/asm-generic/tlb.h:509 [inline]
 tlb_flush_mmu+0x1af/0xa30 mm/mmu_gather.c:423
 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:549
 free_ldt_pgtables+0x192/0x360 arch/x86/kernel/ldt.c:411
 arch_exit_mmap arch/x86/include/asm/mmu_context.h:229 [inline]
 exit_mmap+0x1bf/0x9f0 mm/mmap.c:1300
 __mmput+0x118/0x420 kernel/fork.c:1193
 exit_mm+0x18e/0x240 kernel/exit.c:592
 do_exit+0x6cd/0x2360 kernel/exit.c:974
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1129
 get_signal+0x121b/0x12c0 kernel/signal.c:3112
 arch_do_signal_or_restart+0xbb/0x860 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x10e/0x770 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x328/0x520 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa26cf9e159
Code: Unable to access opcode bytes at 0x7fa26cf9e12f.
RSP: 002b:00007fa26deaa0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fa26d226188 RCX: 00007fa26cf9e159
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa26d226188
RBP: 00007fa26d226180 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa26d226218 R14: 00007ffedbecdfa0 R15: 00007ffedbece088
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/04 20:13 bpf ff47652a4b66 57bbd979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-bpf-kasan-gce BUG: soft lockup in aoecmd_cfg
2026/10/08 08:49 upstream 7b63ef2d55f2 6520ecdb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: rcu detected stall in aoecmd_cfg
* Struck through repros no longer work on HEAD.