INFO: task hung in synchronize_rcu

Status: upstream: reported on 2025/10/30 17:16
Reported-by: syzbot+6d7cbd2cd15cb48338f3@syzkaller.appspotmail.com
First crash: 286d, last: 6d17h
Similar bugs (16)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in synchronize_rcu (3) 1 syz, C done done 374 1275d 2212d 22/29 fixed on 2023/02/24 13:50
linux-6.1 INFO: task hung in synchronize_rcu origin:lts-only 1 syz, C unreliable 75 2h32m 1230d 0/3 upstream: reported C repro on 2023/04/01 04:49
android-6-12 INFO: task hung in synchronize_rcu (3) 1 3 6d17h 34d 0/1 premoderation: reported on 2026/07/10 14:29
android-49 INFO: task hung in synchronize_rcu 1 1 2448d 2448d 0/3 auto-closed as invalid on 2020/03/28 16:57
linux-4.14 INFO: task hung in synchronize_rcu vfs 1 syz, C error 162 1289d 2471d 0/1 upstream: reported C repro on 2019/11/07 04:32
linux-4.19 INFO: task hung in synchronize_rcu 1 syz, C error 70 1279d 2469d 0/1 upstream: reported C repro on 2019/11/08 21:27
linux-5.15 INFO: task hung in synchronize_rcu 1 1 1215d 1215d 0/3 auto-obsoleted due to no activity on 2023/08/14 02:05
android-6-12 INFO: task hung in synchronize_rcu 1 41 274d 397d 0/1 auto-obsoleted due to no activity on 2026/01/01 15:51
linux-5.15 INFO: task hung in synchronize_rcu (3) origin:lts-only 1 syz, C error 56 20d 748d 0/3 upstream: reported C repro on 2024/07/26 03:55
upstream INFO: task hung in synchronize_rcu 1 syz done 1206 2449d 2475d 14/29 fixed on 2019/11/29 15:48
upstream INFO: task hung in synchronize_rcu (4) prio:high fs net 1 syz, C done error 4282 4h41m 1197d 0/29 upstream: reported C repro on 2023/05/04 02:01
linux-5.15 INFO: task hung in synchronize_rcu (2) 1 1 904d 904d 0/3 auto-obsoleted due to no activity on 2024/05/31 13:53
android-414 INFO: task hung in synchronize_rcu 1 1 2467d 2467d 0/1 auto-closed as invalid on 2020/03/10 10:42
upstream INFO: task hung in synchronize_rcu (2) trace 1 8 2447d 2448d 0/29 closed as invalid on 2019/11/30 16:54
android-6-12 INFO: task hung in synchronize_rcu (2) 1 5 139d 179d 0/1 auto-obsoleted due to no activity on 2026/06/25 10:28
upstream INFO: task hung in rtnetlink_rcv_msg net 1 syz, C inconclusive inconclusive 1970 765d 2728d 26/29 fixed on 2024/07/09 19:14

Sample crash report:
INFO: task kworker/u4:0:20418 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:0    state:D stack:24360 pid:20418 ppid:2      flags:0x00004000
Workqueue: events_unbound fsnotify_connector_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 __synchronize_srcu+0x339/0x3d0 kernel/rcu/srcutree.c:1386
 fsnotify_connector_destroy_workfn+0x44/0xa0 fs/notify/mark.c:234
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task kworker/u4:1:24388 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:1    state:D stack:22920 pid:24388 ppid:2      flags:0x00004000
Workqueue: events_unbound fsnotify_mark_destroy_workfn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_timeout+0xc1/0x2d0 kernel/time/timer.c:2144
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common kernel/sched/completion.c:127 [inline]
 wait_for_completion+0x2c6/0x5a0 kernel/sched/completion.c:148
 __synchronize_srcu+0x339/0x3d0 kernel/rcu/srcutree.c:1386
 fsnotify_mark_destroy_workfn+0x10a/0x2e0 fs/notify/mark.c:928
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
INFO: task syz.5.6674:25595 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.6674      state:D stack:25992 pid:25595 ppid:24278  flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:78 [inline]
 rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x61b/0x980 net/socket.c:2595
 ___sys_sendmsg+0x2a6/0x360 net/socket.c:2649
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2687 [inline]
 __se_sys_sendmsg+0x1d0/0x2c0 net/socket.c:2685
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ffbc4f9e0d9
RSP: 002b:00007ffbc5d98028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007ffbc5226360 RCX: 00007ffbc4f9e0d9
RDX: 0000000000000000 RSI: 0000200000001200 RDI: 0000000000000004
RBP: 00007ffbc5035024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffbc52263f8 R14: 00007ffbc5226360 R15: 00007ffcb7e2eac8
 </TASK>
INFO: task syz-executor:25599 blocked for more than 147 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25384 pid:25599 ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:78 [inline]
 rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x4a9/0x6b0 net/socket.c:2201
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0xde/0xf0 net/socket.c:2209
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fe1cdf5e90e
RSP: 002b:00007fff2b3155d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555556bb4500 RCX: 00007fe1cdf5e90e
RDX: 0000000000000028 RSI: 00007fe1ced54670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007fff2b315654 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fe1ced54670 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:25607 blocked for more than 148 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:25384 pid:25607 ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5382 [inline]
 __schedule+0x15ae/0x4660 kernel/sched/core.c:6701
 schedule+0xbd/0x170 kernel/sched/core.c:6775
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6834
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x673/0xc80 kernel/locking/mutex.c:747
 rtnl_lock net/core/rtnetlink.c:78 [inline]
 rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
 netlink_rcv_skb+0x235/0x4c0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x7b1/0x930 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8d0/0xbf0 net/netlink/af_netlink.c:1899
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x4a9/0x6b0 net/socket.c:2201
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0xde/0xf0 net/socket.c:2209
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f83c795e90e
RSP: 002b:00007ffd38b71398 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00005555937b6500 RCX: 00007f83c795e90e
RDX: 0000000000000028 RSI: 00007f83c8754670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007ffd38b71414 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f83c8754670 R15: 0000000000000000
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/29:
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8d131da0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
3 locks held by kworker/u4:9/1119:
 #0: ffff88814c5b0538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff88814c5b0538 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc900049c7d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc900049c7d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4730
2 locks held by getty/5525:
 #0: ffff888031a6a0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc900032832f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x428/0x1370 drivers/tty/n_tty.c:2217
2 locks held by kworker/u4:15/9246:
2 locks held by kworker/u4:0/20418:
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000588fd00 (connector_reaper_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000588fd00 (connector_reaper_work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
3 locks held by kworker/u4:13/20424:
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc9000da4fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc9000da4fd00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #2: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
2 locks held by kworker/0:1/24311:
2 locks held by kworker/u4:1/24388:
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #0: ffff888017c71938 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
 #1: ffffc900032ffd00 ((reaper_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2632 [inline]
 #1: ffffc900032ffd00 ((reaper_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x975/0x1600 kernel/workqueue.c:2734
3 locks held by syz.0.6673/25583:
2 locks held by syz.5.6674/25588:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: tun_detach drivers/net/tun.c:698 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: tun_chr_close+0x41/0x1c0 drivers/net/tun.c:3514
 #1: ffffffff8cfcd110 (cpu_hotplug_lock){++++}-{0:0}, at: flush_all_backlogs net/core/dev.c:6004 [inline]
 #1: ffffffff8cfcd110 (cpu_hotplug_lock){++++}-{0:0}, at: unregister_netdevice_many_notify+0x59b/0x1910 net/core/dev.c:11106
1 lock held by syz.5.6674/25591:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz.5.6674/25595:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25599:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25607:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25610:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25615:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25636:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25644:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25647:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25651:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25672:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25680:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25683:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481
1 lock held by syz-executor/25687:
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8e3d70c8 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x7ed/0xf90 net/core/rtnetlink.c:6481

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a6/0x3e0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf59/0xfa0 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
bridge0: received packet on veth1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
NMI backtrace for cpu 0
CPU: 0 PID: 25583 Comm: syz.0.6673 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:memset_orig+0x75/0xac arch/x86/lib/memset_64.S:90
Code: 89 47 30 48 89 47 38 48 8d 7f 40 75 d8 0f 1f 84 00 00 00 00 00 89 d1 83 e1 38 74 14 c1 e9 03 66 0f 1f 44 00 00 ff c9 48 89 07 <48> 8d 7f 08 75 f5 83 e2 07 74 0a ff ca 88 07 48 8d 7f 01 75 f6 4c
RSP: 0018:ffffc90000006c88 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 1ffff110171c5701 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffff88807c2f7350
RBP: ffffffff97335780 R08: ffff88807c2f7357 R09: 0000000000000000
R10: ffff88807c2f7348 R11: ffffed100f85ee6b R12: ffff88807c2f7340
R13: dffffc0000000000 R14: 0000000000000001 R15: ffffffff97335790
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f36992e3ff8 CR3: 000000000cf32000 CR4: 00000000003506f0
Call Trace:
 <IRQ>
 rb_link_node include/linux/rbtree.h:63 [inline]
 rb_add_cached include/linux/rbtree.h:182 [inline]
 timerqueue_add+0x143/0x1f0 lib/timerqueue.c:40
 __run_hrtimer kernel/time/hrtimer.c:1771 [inline]
 __hrtimer_run_queues+0x62f/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_interrupt+0x39d/0x980 kernel/time/hrtimer.c:1880
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x51/0xc0 arch/x86/kernel/apic/apic.c:1088
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:console_trylock_spinning kernel/printk/printk.c:2008 [inline]
RIP: 0010:vprintk_emit+0x46f/0x610 kernel/printk/printk.c:2340
Code: 85 3f 01 00 00 e8 61 a1 1b 00 45 89 f7 48 85 db 48 8b 1c 24 75 07 e8 50 a1 1b 00 eb 06 e8 49 a1 1b 00 fb 48 c7 c7 80 61 12 8d <31> f6 ba 01 00 00 00 31 c9 41 b8 01 00 00 00 45 31 c9 53 e8 b9 b4
RSP: 0018:ffffc90000007040 EFLAGS: 00000246
RAX: ffffffff816bd037 RBX: ffffffff816bcedb RCX: ffff88802d8e3c00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffffffff8d126180
RBP: ffffc90000007130 R08: ffffffff911eb62f R09: 1ffffffff223d6c5
R10: dffffc0000000000 R11: fffffbfff223d6c6 R12: dffffc0000000000
R13: 1ffff92000000e0c R14: 0000000000000065 R15: 0000000000000065
 _printk+0xde/0x130 kernel/printk/printk.c:2366
 br_fdb_update+0x610/0x680 net/bridge/br_fdb.c:877
 br_handle_frame_finish+0x5ee/0x15c0 net/bridge/br_input.c:141
 br_nf_hook_thresh+0x3cd/0x4a0 net/bridge/br_netfilter_hooks.c:1184
 br_nf_pre_routing_finish_ipv6+0x9e5/0xd20 net/bridge/br_netfilter_ipv6.c:-1
 NF_HOOK include/linux/netfilter.h:304 [inline]
 br_nf_pre_routing_ipv6+0x34d/0x6a0 net/bridge/br_netfilter_ipv6.c:184
 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]
 br_handle_frame+0x1240/0x14d0 net/bridge/br_input.c:424
 __netif_receive_skb_core+0xf94/0x3ab0 net/core/dev.c:5540
 __netif_receive_skb_one_core net/core/dev.c:5644 [inline]
 __netif_receive_skb+0x74/0x290 net/core/dev.c:5760
 process_backlog+0x380/0x710 net/core/dev.c:6088
 __napi_poll+0xbb/0x460 net/core/dev.c:6650
 napi_poll net/core/dev.c:6717 [inline]
 net_rx_action+0x65f/0xcc0 net/core/dev.c:6853
 handle_softirqs+0x27d/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:check_kcov_mode kernel/kcov.c:193 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:245 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x36/0x80 kernel/kcov.c:320
Code: 70 42 7c 7e 65 8b 15 71 42 7c 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 57 83 b9 1c 16 00 00 00 74 4e 8b 91 f8 15 00 00 <83> fa 03 75 43 48 8b 91 00 16 00 00 44 8b 89 fc 15 00 00 49 c1 e1
RSP: 0018:ffffc900044171e0 EFLAGS: 00000246
RAX: ffffffff81bba76a RBX: ffffea0001cefb00 RCX: ffff88802d8e3c00
RDX: 0000000000000000 RSI: 0000000000000010 RDI: 0000000000000000
RBP: 1ffffd400039df60 R08: ffffea0001cefb07 R09: 1ffffd400039df60
R10: dffffc0000000000 R11: fffff9400039df61 R12: 00fff6000008003d
R13: dffffc0000000000 R14: ffffea0001cefb08 R15: 1ffffd400039df61
 constant_test_bit arch/x86/include/asm/bitops.h:207 [inline]
 arch_test_bit arch/x86/include/asm/bitops.h:239 [inline]
 _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
 folio_test_dirty include/linux/page-flags.h:493 [inline]
 folio_cancel_dirty include/linux/pagemap.h:1182 [inline]
 truncate_cleanup_folio+0x29a/0x5e0 mm/truncate.c:185
 truncate_inode_folio+0x55/0x70 mm/truncate.c:194
 shmem_undo_range+0x3f0/0x1a80 mm/shmem.c:1022
 shmem_truncate_range mm/shmem.c:1135 [inline]
 shmem_evict_inode+0x285/0xa70 mm/shmem.c:1264
 evict+0x4b7/0x8a0 fs/inode.c:705
 __dentry_kill+0x412/0x630 fs/dcache.c:611
 shrink_dentry_list+0x39a/0x6b0 fs/dcache.c:1206
 shrink_dcache_parent+0xb2/0x3f0 fs/dcache.c:-1
 do_one_tree+0x23/0xe0 fs/dcache.c:1686
 shrink_dcache_for_umount+0x69/0x110 fs/dcache.c:1703
 generic_shutdown_super+0x67/0x2b0 fs/super.c:665
 kill_anon_super fs/super.c:1303 [inline]
 kill_litter_super+0x76/0xb0 fs/super.c:1313
 deactivate_locked_super+0x97/0x100 fs/super.c:481
 cleanup_mnt+0x3d7/0x460 fs/namespace.c:1259
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x986/0x2530 kernel/exit.c:890
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 get_signal+0x12a6/0x1390 kernel/signal.c:2911
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f369839e0d9
Code: Unable to access opcode bytes at 0x7f369839e0af.
RSP: 002b:00007f36992e4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035
RAX: 0000000000000000 RBX: 00007f3698626090 RCX: 00007f369839e0d9
RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: 00007f3698435024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f3698626128 R14: 00007f3698626090 R15: 00007ffe8e4ee618
 </TASK>

Crashes (11):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/06 22:42 linux-6.6.y 80dfb0405055 c38879ea .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in synchronize_rcu
2026/07/31 20:47 linux-6.6.y a1153c0deb44 7664cf44 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in synchronize_rcu
2026/07/26 10:55 linux-6.6.y c5596480c50e 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in synchronize_rcu
2026/06/28 15:03 linux-6.6.y d1cfde2d5d15 fb92f11c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in synchronize_rcu
2026/06/25 17:40 linux-6.6.y d1cfde2d5d15 cfa969bf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in synchronize_rcu
2026/04/26 13:45 linux-6.6.y 9760bf04666d 9c2d0995 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in synchronize_rcu
2026/04/20 05:23 linux-6.6.y 9760bf04666d 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in synchronize_rcu
2026/01/15 21:39 linux-6.6.y c596736dadab d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in synchronize_rcu
2025/12/22 06:24 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in synchronize_rcu
2025/12/10 21:00 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in synchronize_rcu
2025/10/30 17:16 linux-6.6.y e5bbb12db2c7 2c50b6a9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in synchronize_rcu
* Struck through repros no longer work on HEAD.