syzbot


WARNING in call_timer_fn (2)

Status: upstream: reported on 2026/03/06 23:46
Reported-by: syzbot+660cf2a04050f8320a51@syzkaller.appspotmail.com
First crash: 62d, last: 1d15h
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 WARNING in call_timer_fn -1 syz error 21 167d 324d 0/2 auto-obsoleted due to no activity on 2026/03/02 01:43
upstream WARNING in call_timer_fn bluetooth -1 C unreliable 8873 28m 1268d 0/29 upstream: reported C repro on 2022/11/16 15:25
linux-5.15 WARNING in call_timer_fn (2) -1 5 251d 352d 0/3 auto-obsoleted due to no activity on 2025/12/07 22:59
linux-5.15 WARNING in call_timer_fn (3) -1 2 6d14h 27d 0/3 upstream: reported on 2026/04/10 14:54
linux-6.1 WARNING in call_timer_fn origin:lts-only -1 C unreliable 201 78d 1156d 0/3 upstream: reported C repro on 2023/03/08 12:11
linux-5.15 WARNING in call_timer_fn origin:lts-only -1 syz unreliable 7 551d 807d 0/3 auto-obsoleted due to no activity on 2025/02/11 06:36

Sample crash report:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 2981 at kernel/workqueue.c:1745 is_chained_work kernel/workqueue.c:1691 [inline]
WARNING: CPU: 1 PID: 2981 at kernel/workqueue.c:1745 __queue_work+0xd49/0x1020 kernel/workqueue.c:1744
Modules linked in:
CPU: 1 PID: 2981 Comm: kworker/u4:9 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:__queue_work+0xd49/0x1020 kernel/workqueue.c:1744
Code: 4c 89 f7 48 89 de 89 e9 e8 c4 e6 00 00 48 8b 5c 24 10 e9 10 ff ff ff e8 65 af 2f 00 eb 0c e8 5e af 2f 00 eb 05 e8 57 af 2f 00 <0f> 0b 48 83 c4 78 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 41 af 2f 00
RSP: 0018:ffffc900001f0bb0 EFLAGS: 00010046
RAX: ffffffff8157729b RBX: 0000000000000100 RCX: ffff88802c0b0000
RDX: 0000000000000100 RSI: 0000000000000100 RDI: 0000000000000000
RBP: ffff8880274399c0 R08: ffffffff8e8b19af R09: 1ffffffff1d16335
R10: dffffc0000000000 R11: fffffbfff1d16336 R12: 0000000000000008
R13: dffffc0000000000 R14: ffff88802f85c9c0 R15: ffff888027439800
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff26747098 CR3: 0000000067b7d000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1747 [inline]
 __run_timers+0x56d/0x800 kernel/time/timer.c:2023
 run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 do_softirq+0xfa/0x1a0 kernel/softirq.c:479
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x184/0x1c0 kernel/softirq.c:406
 spin_unlock_bh include/linux/spinlock.h:396 [inline]
 cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2988 [inline]
 cfg80211_inform_bss_frame_data+0xb93/0x13d0 net/wireless/scan.c:3013
 ieee80211_bss_info_update+0x759/0x9b0 net/mac80211/scan.c:211
 ieee80211_rx_bss_info net/mac80211/ibss.c:1124 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1613 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x18ae/0x2c80 net/mac80211/ibss.c:1642
 ieee80211_iface_process_skb net/mac80211/iface.c:1655 [inline]
 ieee80211_iface_work+0x717/0xc70 net/mac80211/iface.c:1709
 cfg80211_wiphy_work+0x225/0x260 net/wireless/core.c:437
 process_one_work kernel/workqueue.c:2653 [inline]
 process_scheduled_works+0xa5d/0x15d0 kernel/workqueue.c:2730
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2811
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/06 14:55 linux-6.6.y 258cf62a6dfd 1dddfd3d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in call_timer_fn
2026/03/06 23:45 linux-6.6.y 4fc00fe35d46 41d8037d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan WARNING in call_timer_fn
* Struck through repros no longer work on HEAD.