INFO: task hung in hfs_mdb_commit (3)

Status: upstream: reported C repro on 2025/06/13 11:04
Subsystems: hfs
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+6bdbdd12cf8cdbc66466@syzkaller.appspotmail.com
First crash: 505d, last: 98d
Cause bisection: failed (error log, bisect log)
  
Fix bisection: fixed by (bisect log) :
commit 42b0ef01e6b5e9c77b383d32c25a0ec2a735d08a
Author: Arnd Bergmann <arnd@arndb.de>
Date: Fri Jul 11 08:46:51 2025 +0000

  block: fix FS_IOC_GETLBMD_CAP parsing in blkdev_common_ioctl()

  
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
dddadfe5 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ✅ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ INFO: task hung in hfs_mdb_commit (3) 2026/05/26 08:49 2026/05/26 08:49 2026/05/26 09:41 c69befb3
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[syzbot] Monthly hfs report (Jul 2026) 0 (1) 2026/07/04 12:32
[syzbot] [hfs?] INFO: task hung in hfs_mdb_commit (3) 0 (2) 2025/08/11 13:11
▶ ▼ Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in hfs_mdb_commit hfs 1 syz, C error done 25 988d 1366d 25/29 fixed on 2024/03/20 11:33
linux-6.1 INFO: task hung in hfs_mdb_commit 1 1 1239d 1239d 0/3 auto-obsoleted due to no activity on 2023/08/31 05:50
linux-6.1 INFO: task hung in hfs_mdb_commit (5) origin:upstream 1 syz, C error 1 185d 185d 0/3 upstream: reported C repro on 2026/04/11 11:52
linux-5.15 INFO: task hung in hfs_mdb_commit (2) origin:upstream 1 syz, C error 9 17d 918d 0/3 upstream: reported C repro on 2024/04/08 12:18
linux-4.19 INFO: task hung in hfs_mdb_commit hfs 1 syz, C error 1 1357d 1357d 0/1 upstream: reported C repro on 2023/01/25 02:58
linux-6.1 INFO: task hung in hfs_mdb_commit (3) 1 1 607d 607d 0/3 auto-obsoleted due to no activity on 2025/05/23 22:52
linux-5.15 INFO: task hung in hfs_mdb_commit 1 1 1221d 1221d 0/3 auto-obsoleted due to no activity on 2023/09/18 06:33
linux-6.1 INFO: task hung in hfs_mdb_commit (2) 1 1 919d 919d 0/3 auto-obsoleted due to no activity on 2024/07/16 10:21
linux-6.6 INFO: task hung in hfs_mdb_commit 1 1 410d 410d 0/2 auto-obsoleted due to no activity on 2025/12/07 18:32
upstream INFO: task hung in hfs_mdb_commit (2) hfs 1 1 840d 840d 0/29 auto-obsoleted due to no activity on 2024/09/23 18:09
linux-6.1 INFO: task hung in hfs_mdb_commit (4) 1 1 327d 327d 0/3 auto-obsoleted due to no activity on 2026/02/27 20:02
▶ ▼ Last patch testing requests (10)
Created Duration User Patch Repo Result
2026/10/12 23:05 23m retest repro upstream no crash job log log
2026/09/30 17:36 28m retest repro linux-next no crash job log log
2026/09/10 06:57 41m retest repro linux-next error job log
2026/07/22 03:05 19m retest repro upstream log
2026/07/21 07:35 31m retest repro linux-next error
2026/06/25 03:08 29m retest repro linux-next log
2026/04/22 05:52 30m retest repro upstream report log
2026/04/21 05:10 2h27m retest repro linux-next report log
2026/04/15 18:21 46m retest repro linux-next report log
2026/02/10 19:46 16m retest repro upstream report log

Sample crash report:
INFO: task kworker/0:3:981 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:3     state:D stack:24512 pid:981   tgid:981   ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_long flush_mdb
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5258 [inline]
 __schedule+0x150e/0x5070 kernel/sched/core.c:6866
 __schedule_loop kernel/sched/core.c:6948 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6963
 io_schedule+0x80/0xd0 kernel/sched/core.c:7792
 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:250
 __wait_on_bit_lock+0xec/0x4f0 kernel/sched/wait_bit.c:93
 out_of_line_wait_on_bit_lock+0x123/0x170 kernel/sched/wait_bit.c:120
 lock_buffer include/linux/buffer_head.h:432 [inline]
 hfs_mdb_commit+0x115/0x12e0 fs/hfs/mdb.c:271
 process_one_work+0x93a/0x15a0 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0x9b0/0xee0 kernel/workqueue.c:3443
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
INFO: task syz-executor:5988 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:19496 pid:5988  tgid:5988  ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5258 [inline]
 __schedule+0x150e/0x5070 kernel/sched/core.c:6866
 __schedule_loop kernel/sched/core.c:6948 [inline]
 schedule+0x165/0x360 kernel/sched/core.c:6963
 io_schedule+0x80/0xd0 kernel/sched/core.c:7792
 bit_wait_io+0x11/0xd0 kernel/sched/wait_bit.c:250
 __wait_on_bit_lock+0xec/0x4f0 kernel/sched/wait_bit.c:93
 out_of_line_wait_on_bit_lock+0x123/0x170 kernel/sched/wait_bit.c:120
 lock_buffer include/linux/buffer_head.h:432 [inline]
 hfs_mdb_commit+0xe4e/0x12e0 fs/hfs/mdb.c:331
 hfs_sync_fs+0x15/0x20 fs/hfs/super.c:37
 sync_filesystem+0xee/0x230 fs/sync.c:56
 generic_shutdown_super+0x6f/0x2c0 fs/super.c:622
 kill_block_super+0x44/0x90 fs/super.c:1722
 deactivate_locked_super+0xbc/0x130 fs/super.c:474
 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1318
 task_work_run+0x1d4/0x260 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0xff/0x4f0 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2d0/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe4dfd90a77
RSP: 002b:00007ffdb2c3a038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
RAX: 0000000000000000 RBX: 00007fe4dfe13d7d RCX: 00007fe4dfd90a77
RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdb2c3a0f0
RBP: 00007ffdb2c3a0f0 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffdb2c3b180
R13: 00007fe4dfe13d7d R14: 0000000000016343 R15: 00007ffdb2c3b1c0
 </TASK>

Showing all locks held in the system:
2 locks held by kworker/0:0/9:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc900000e7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
2 locks held by kworker/0:1/10:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc900000f7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
1 lock held by khungtaskd/31:
 #0: ffffffff8e13f2e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 #0: ffffffff8e13f2e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:867 [inline]
 #0: ffffffff8e13f2e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
2 locks held by kworker/1:1/37:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc90000ad7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
2 locks held by kworker/0:3/981:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc90003cb7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
2 locks held by getty/5587:
 #0: ffff8880356b90a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 drivers/tty/n_tty.c:2211
3 locks held by kworker/1:4/5856:
 #0: ffff88813fe15948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc9000406fb80 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
 #2: ffff88806dd95240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1f7/0x3b0 drivers/net/netdevsim/fib.c:1490
1 lock held by syz-executor/5988:
 #0: ffff88803120a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff88803120a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff88803120a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
2 locks held by kworker/0:5/6132:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc90002fa7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
1 lock held by syz-executor/6137:
 #0: ffff888021b420e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff888021b420e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff888021b420e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
2 locks held by kworker/0:6/6166:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc90002fe7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
1 lock held by syz-executor/6168:
 #0: ffff88802fe8c0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff88802fe8c0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff88802fe8c0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
2 locks held by kworker/0:7/6188:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc900035c7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
1 lock held by syz-executor/6190:
 #0: ffff88807e7c40e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff88807e7c40e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff88807e7c40e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
2 locks held by kworker/0:8/6209:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc900036a7b80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
1 lock held by syz-executor/6212:
 #0: ffff88805fb0a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff88805fb0a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff88805fb0a0e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
1 lock held by syz-executor/6240:
 #0: ffff88805c8c00e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff88805c8c00e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff88805c8c00e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
2 locks held by kworker/0:10/6256:
 #0: ffff88813fe16148 ((wq_completion)events_long){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc90003dbfb80 ((work_completion)(&(&sbi->mdb_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
1 lock held by syz-executor/6274:
 #0: ffff888065cc60e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff888065cc60e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff888065cc60e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
1 lock held by syz-executor/6303:
 #0: ffff88805d9600e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff88805d9600e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff88805d9600e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
1 lock held by syz-executor/6332:
 #0: ffff88805d5780e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock fs/super.c:57 [inline]
 #0: ffff88805d5780e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:72 [inline]
 #0: ffff88805d5780e0 (&type->s_umount_key#54){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:506
3 locks held by kworker/u8:18/6361:
 #0: ffff88802ff8c948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x841/0x15a0 kernel/workqueue.c:3254
 #1: ffffc90004427b80 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x868/0x15a0 kernel/workqueue.c:3255
 #2: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x112/0x14b0 net/ipv6/addrconf.c:4194
3 locks held by syz-executor/6367:
 #0: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8f512448 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8ec/0x1c90 net/core/rtnetlink.c:4071
 #1: ffff88802fc95528 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_open+0x227/0x420 drivers/net/wireguard/device.c:50
 #2: ffffffff8e144e38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:311 [inline]
 #2: ffffffff8e144e38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 kernel/rcu/tree_exp.h:956

=============================================

NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x39e/0x3d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:363 [inline]
 watchdog+0xe40/0xe90 kernel/hung_task.c:557
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:12 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:put_dec+0x0/0xe0 lib/vsprintf.c:312
Code: 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 19 1b 04 00 66 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <41> 57 41 56 41 54 53 48 89 f3 49 89 fe e8 6e 22 68 f6 bf ff e0 f5
RSP: 0018:ffffc9000c24edb8 EFLAGS: 00000293
RAX: ffffffff8b59b745 RBX: ffffc9000c24ee40 RCX: ffff888031261e80
RDX: 0000000000000000 RSI: 00000000000000f2 RDI: ffffc9000c24ee40
RBP: ffffc9000c24eee0 R08: ffffc9000c24ee57 R09: 0000000000000000
R10: ffffc9000c24ee40 R11: fffff52001849dcb R12: 00000000000000f2
R13: 00000000000000f2 R14: ffffc9000c24f1c1 R15: 0000000005ffff0a
FS:  0000000000000000(0000) GS:ffff888125c25000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055f146b35ea8 CR3: 0000000077a86000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 number+0x2f8/0xf60 lib/vsprintf.c:520
 vsnprintf+0x8e5/0xee0 lib/vsprintf.c:2912
 sprintf+0xd9/0x120 lib/vsprintf.c:3111
 print_time kernel/printk/printk.c:1357 [inline]
 info_print_prefix+0x155/0x310 kernel/printk/printk.c:1383
 record_print_text+0x154/0x420 kernel/printk/printk.c:1432
 printk_get_next_message+0x26d/0x7b0 kernel/printk/printk.c:3018
 console_emit_next_record kernel/printk/printk.c:3083 [inline]
 console_flush_one_record kernel/printk/printk.c:3215 [inline]
 console_flush_all+0x514/0xb60 kernel/printk/printk.c:3289
 __console_flush_and_unlock kernel/printk/printk.c:3319 [inline]
 console_unlock+0xbb/0x190 kernel/printk/printk.c:3359
 vprintk_emit+0x4f8/0x5f0 kernel/printk/printk.c:2426
 _printk+0xcf/0x120 kernel/printk/printk.c:2451
 ieee80211_sta_find_ibss net/mac80211/ibss.c:1443 [inline]
 ieee80211_ibss_work+0xdae/0x1060 net/mac80211/ibss.c:1666
 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438
 process_one_work+0x93a/0x15a0 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0x9b0/0xee0 kernel/workqueue.c:3443
 kthread+0x711/0x8a0 kernel/kthread.c:463
 ret_from_fork+0x599/0xb30 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Crashes (23):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/02 05:46 linux-next cc3aa43b44bd d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root INFO: task hung in hfs_mdb_commit
2026/07/07 05:46 upstream 0e35b9b6ec0f 8e71ce95 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2026/07/04 15:50 upstream 1e9cdc2ea15a fcece630 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2026/06/30 07:33 upstream dc59e4fea9d8 fff8d0a0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2026/06/29 06:27 upstream dc59e4fea9d8 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2026/04/01 15:55 upstream 9147566d8016 0285fe54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in hfs_mdb_commit
2026/03/24 21:54 upstream e3c33bc767b5 74e70d19 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2026/02/21 22:20 upstream d79526b89571 6e7b5511 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in hfs_mdb_commit
2026/02/19 14:12 upstream 956b9cbd7f15 746545b8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in hfs_mdb_commit
2026/01/25 14:14 upstream d91a46d6805a 40acda8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2025/11/17 12:50 upstream 6a23ae0a96a6 ef766cd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2025/11/06 19:55 upstream c2c2ccfd4ba7 4e1406b4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2025/08/31 14:54 upstream c8bc81a52d5a 807a3b61 .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2025/08/11 17:28 upstream 8f5ae30d69d7 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in hfs_mdb_commit
2025/08/11 17:28 upstream 8f5ae30d69d7 32a0e5ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in hfs_mdb_commit
2025/08/08 12:39 upstream bec077162bd0 6a893178 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2025/06/09 12:45 upstream 19272b37aa4f 4826c28e .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2025/06/09 10:53 upstream 19272b37aa4f 4826c28e .config strace log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-kasan-gce-root INFO: task hung in hfs_mdb_commit
2025/06/09 09:02 upstream 19272b37aa4f 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in hfs_mdb_commit
2025/06/09 04:26 upstream 19272b37aa4f 4826c28e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in hfs_mdb_commit
2025/05/26 03:39 upstream 0f8c0258bf04 2d4582d0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-fs INFO: task hung in hfs_mdb_commit
2026/01/01 23:04 linux-next cc3aa43b44bd d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: task hung in hfs_mdb_commit
2025/08/14 22:56 linux-next 931e46dcbc7e dcc075fb .config console log report syz / log C [disk image] [vmlinux] [kernel image] [mounted in repro] ci-upstream-linux-next-kasan-gce-root INFO: task hung in hfs_mdb_commit
* Struck through repros no longer work on HEAD.