INFO: task hung in lo_release (3)

Status: auto-obsoleted due to no activity on 2026/08/20 09:47
Subsystems: block
Labels: prio:low
[Documentation on labels]
First crash: 93d, last: 93d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
3b344c21 assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ INFO: task hung in lo_release (3) 2026/06/02 05:58 2026/06/02 05:58 2026/06/02 07:01 1095583b
▶ ▼ Similar bugs (9)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in lo_release block 1 1 2958d 2958d 11/29 fixed on 2019/01/15 20:25
android-49 INFO: task hung in lo_release 1 867 2593d 2688d 0/3 auto-closed as invalid on 2019/10/25 14:11
linux-4.14 INFO: task hung in lo_release (2) 1 syz, C 19 1275d 2349d 0/1 upstream: reported C repro on 2020/03/19 00:28
upstream INFO: task hung in lo_release (2) block 1 38 1735d 1735d 0/29 closed as dup on 2021/11/23 00:29
android-49 INFO: task hung in lo_release (2) 1 3 2471d 2483d 0/3 auto-closed as invalid on 2020/03/16 04:39
android-414 INFO: task hung in lo_release 1 syz 1670 2466d 2691d 0/1 public: reported syz repro on 2019/04/12 00:01
android-44 INFO: task hung in lo_release 1 syz 59 2459d 2689d 0/2 public: reported syz repro on 2019/04/14 00:02
linux-4.14 INFO: task hung in lo_release 1 syz done 128 2578d 2691d 1/1 fixed on 2019/12/17 00:29
upstream INFO: task can't die in blk_mq_freeze_queue_wait block 1 221 1734d 1742d 20/29 fixed on 2022/03/08 16:11

Sample crash report:
INFO: task udevd:24605 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd           state:D stack:23288 pid:24605 tgid:24605 ppid:4986   task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 __schedule_loop kernel/sched/core.c:7268 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7283
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7340
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0x7f7/0x1550 kernel/locking/mutex.c:820
 uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
 kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410
 kobject_uevent_env+0x55c/0x9e0 lib/kobject_uevent.c:611
 __loop_clr_fd drivers/block/loop.c:1146 [inline]
 lo_release+0x469/0x840 drivers/block/loop.c:1751
 bdev_release+0x536/0x650 block/bdev.c:-1
 blkdev_release+0x15/0x20 block/fops.c:705
 __fput+0x44f/0xa60 fs/file_table.c:510
 fput_close_sync+0x11f/0x240 fs/file_table.c:615
 __do_sys_close fs/open.c:1507 [inline]
 __se_sys_close fs/open.c:1492 [inline]
 __x64_sys_close+0x7e/0x110 fs/open.c:1492
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f0430aa7407
RSP: 002b:00007ffda5c336e0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 00007f04311b8880 RCX: 00007f0430aa7407
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008
RBP: 00007f04311b86e8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000002
R13: 0000559f17273190 R14: 0000000000000008 R15: 0000559f1727a830
 </TASK>
INFO: task syz-executor:26417 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22264 pid:26417 tgid:26417 ppid:1      task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 __schedule_loop kernel/sched/core.c:7268 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7283
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7340
 __mutex_lock_common kernel/locking/mutex.c:726 [inline]
 __mutex_lock+0x7f7/0x1550 kernel/locking/mutex.c:820
 bdev_open+0xe0/0xd30 block/bdev.c:953
 blkdev_open+0x470/0x610 block/fops.c:697
 do_dentry_open+0x785/0x14e0 fs/open.c:947
 vfs_open+0x3b/0x340 fs/open.c:1079
 do_open fs/namei.c:4699 [inline]
 path_openat+0x2e08/0x3860 fs/namei.c:4858
 do_file_open+0x23e/0x4a0 fs/namei.c:4887
 do_sys_openat2+0x113/0x200 fs/open.c:1364
 do_sys_open fs/open.c:1370 [inline]
 __do_sys_openat fs/open.c:1386 [inline]
 __se_sys_openat fs/open.c:1381 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1381
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1deef5d68e
RSP: 002b:00007ffea7ad7fc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000555592720500 RCX: 00007f1deef5d68e
RDX: 0000000000000002 RSI: 00007ffea7ad8110 RDI: ffffffffffffff9c
RBP: 00007ffea7ad80bc R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000043
R13: 00000000000927c0 R14: 000000000011180e R15: 00007ffea7ad8110
 </TASK>
INFO: task kworker/1:1:28208 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:1     state:D stack:30632 pid:28208 tgid:28208 ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 __schedule_loop kernel/sched/core.c:7268 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7283
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7340
 kthread+0x260/0x470 kernel/kthread.c:420
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Showing all locks held in the system:
2 locks held by kworker/1:0/24:
4 locks held by kworker/1:2/30:
1 lock held by khungtaskd/32:
 #0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 #0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:838 [inline]
 #0: ffffffff8e95cca0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
4 locks held by udevd/4986:
 #0: ffff888032804410 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2724 [inline]
 #0: ffff888032804410 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x227/0xb90 fs/read_write.c:684
 #1: ffff88802910c080 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540 fs/kernfs/file.c:343
 #2: ffff88802602b3c8 (kn->active#5){++++}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
 #2: ffff88802602b3c8 (kn->active#5){++++}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540 fs/kernfs/file.c:344
 #3: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
 #3: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410
1 lock held by kworker/1:3/5352:
2 locks held by getty/5375:
 #0: ffff8880363e70a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000322b2e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13a0 drivers/tty/n_tty.c:2211
3 locks held by kworker/0:3/5755:
 #0: ffff88813fe43140 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
 #0: ffff88813fe43140 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3397
 #1: ffffc90004507c40 (rx_mode_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3290 [inline]
 #1: ffffc90004507c40 (rx_mode_work){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3397
 #2: ffffffff8fdd1300 (rtnl_mutex){+.+.}-{4:4}, at: netdev_rx_mode_work+0x19/0x3c0 net/core/dev_addr_lists.c:1312
3 locks held by kworker/u8:9/5815:
 #0: ffff888031e45940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3289 [inline]
 #0: ffff888031e45940 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa35/0x1860 kernel/workqueue.c:3397
 #1: ffffc90004ad7c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3290 [inline]
 #1: ffffc90004ad7c40 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa70/0x1860 kernel/workqueue.c:3397
 #2: ffffffff8fdd1300 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8fdd1300 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11e/0x14c0 net/ipv6/addrconf.c:4206
5 locks held by kworker/1:5/14180:
2 locks held by kworker/1:9/20927:
1 lock held by syz-executor/24185:
 #0: ffff88806990e0d8 (&type->s_umount_key#115){+.+.}-{4:4}, at: __super_lock fs/super.c:58 [inline]
 #0: ffff88806990e0d8 (&type->s_umount_key#115){+.+.}-{4:4}, at: __super_lock_excl fs/super.c:73 [inline]
 #0: ffff88806990e0d8 (&type->s_umount_key#115){+.+.}-{4:4}, at: deactivate_super+0xa9/0xe0 fs/super.c:508
2 locks held by kworker/R-wg-cr/24309:
2 locks held by kworker/R-wg-cr/24319:
1 lock held by kworker/R-wg-cr/24323:
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2787 [inline]
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3649
1 lock held by kworker/R-wg-cr/24326:
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2787 [inline]
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3649
1 lock held by kworker/R-wg-cr/24327:
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2729
1 lock held by kworker/R-wg-cr/24328:
1 lock held by kworker/R-wg-cr/24331:
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2787 [inline]
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4d/0x1130 kernel/workqueue.c:3649
1 lock held by kworker/R-wg-cr/24333:
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2729
2 locks held by udevd/24605:
 #0: ffff88802614e350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_release+0x1a9/0x650 block/bdev.c:1136
 #1: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
 #1: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410
1 lock held by syz-executor/26417:
 #0: ffff88802614e350 (&disk->open_mutex){+.+.}-{4:4}, at: bdev_open+0xe0/0xd30 block/bdev.c:953
2 locks held by kworker/R-wg-cr/26678:
1 lock held by kworker/R-wg-cr/26680:
2 locks held by kworker/R-wg-cr/28631:
2 locks held by kworker/R-wg-cr/28634:
2 locks held by kworker/R-wg-cr/28639:
2 locks held by syz.6.9781/29918:
 #0: ffff8880261e9430 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_global_lock_killable drivers/block/loop.c:118 [inline]
 #0: ffff8880261e9430 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_configure+0x36f/0xdf0 drivers/block/loop.c:1016
 #1: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
 #1: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410
2 locks held by syz.8.9860/30130:
 #0: ffff888029c50e00 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
 #0: ffff888029c50e00 (&dev->mutex){....}-{4:4}, at: __device_driver_lock drivers/base/dd.c:1174 [inline]
 #0: ffff888029c50e00 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 drivers/base/dd.c:1372
 #1: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
 #1: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410
2 locks held by syz.0.9868/30161:
 #0: ffff888026133430 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_global_lock_killable drivers/block/loop.c:118 [inline]
 #0: ffff888026133430 (&lo->lo_mutex){+.+.}-{4:4}, at: loop_configure+0x36f/0xdf0 drivers/block/loop.c:1016
 #1: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: uevent_net_broadcast_untagged lib/kobject_uevent.c:317 [inline]
 #1: ffffffff90175600 (uevent_sock_mutex){+.+.}-{4:4}, at: kobject_uevent_net_broadcast+0x27e/0x560 lib/kobject_uevent.c:410
2 locks held by kworker/R-wg-cr/30282:
3 locks held by kworker/R-wg-cr/30283:
2 locks held by kworker/R-wg-cr/30284:
3 locks held by syz-executor/30399:
 #0: ffffffff8fdd1300 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #0: ffffffff8fdd1300 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #0: ffffffff8fdd1300 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x883/0x1bb0 net/core/rtnetlink.c:4109
 #1: ffff8880778b4dc8 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock include/linux/netdevice.h:2818 [inline]
 #1: ffff8880778b4dc8 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: netdev_lock_ops include/net/netdev_lock.h:42 [inline]
 #1: ffff8880778b4dc8 (&dev_instance_lock_key#23){+.+.}-{4:4}, at: do_setlink+0x3d2/0x45a0 net/core/rtnetlink.c:3091
 #2: ffffffff8e962fa8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock kernel/rcu/tree_exp.h:343 [inline]
 #2: ffffffff8e962fa8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 kernel/rcu/tree_exp.h:961
7 locks held by syz-executor/30427:
 #0: ffff888032804410 (sb_writers#7){.+.+}-{0:0}, at: file_start_write include/linux/fs.h:2724 [inline]
 #0: ffff888032804410 (sb_writers#7){.+.+}-{0:0}, at: vfs_write+0x227/0xb90 fs/read_write.c:684
 #1: ffff88805547bc80 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1de/0x540 fs/kernfs/file.c:343
 #2: ffff888028fc3a58 (kn->active#53){.+.+}-{0:0}, at: kernfs_get_active_of fs/kernfs/file.c:80 [inline]
 #2: ffff888028fc3a58 (kn->active#53){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x231/0x540 fs/kernfs/file.c:344
 #3: ffffffff8f6503a0 (nsim_bus_dev_list_lock){+.+.}-{4:4}, at: new_device_store+0x13c/0x710 drivers/net/netdevsim/bus.c:184
 #4: ffff888029ed4128 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:1040 [inline]
 #4: ffff888029ed4128 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 drivers/base/dd.c:1076
 #5: ffff888021ed6258 (&devlink->lock_key#17){+.+.}-{4:4}, at: nsim_drv_probe+0xc9/0xc20 drivers/net/netdevsim/dev.c:1658
 #6: ffffffff8fdd1300 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #6: ffffffff8fdd1300 (rtnl_mutex){+.+.}-{4:4}, at: register_netdevice_notifier_net+0x1a/0xa0 net/core/dev.c:2102
1 lock held by kworker/R-btrfs/30831:
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: set_pf_worker kernel/workqueue.c:3403 [inline]
 #0: ffffffff8e7faf00 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0x105b/0x1130 kernel/workqueue.c:3664
2 locks held by dhcpcd-run-hook/30864:
 #0: ffff8880b863aea0 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x31/0x150 kernel/sched/core.c:652
 #1: ffff8880b8624588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 kernel/sched/psi.c:933

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 32 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:162 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:353 [inline]
 watchdog+0xfd3/0x1030 kernel/hung_task.c:561
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 26678 Comm: kworker/R-wg-cr Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: wg-crypt-wg0 wg_packet_tx_worker
RIP: 0010:rcu_is_watching+0x72/0xb0 kernel/rcu/tree.c:754
Code: c9 3a 93 49 03 1e 48 89 d8 48 c1 e8 03 42 0f b6 04 38 84 c0 75 34 8b 03 65 ff 0d c9 b1 8e 11 74 11 83 e0 04 c1 e8 02 5b 41 5e <41> 5f e9 92 62 65 ff cc e8 f1 bc 88 ff eb e8 48 c7 c7 00 32 96 8e
RSP: 0018:ffffc90000a08408 EFLAGS: 00000012
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000080000101
RDX: 0000000000000000 RSI: ffffffff8c28b640 RDI: ffffffff8c28b600
RBP: ffffffff8176f256 R08: 0000000000000000 R09: 0000000000000000
R10: dffffc0000000000 R11: ffffffff81b0f020 R12: 0000000000000002
R13: ffffffff8e95cca0 R14: 0000000000000000 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff888125387000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f416ff8 CR3: 000000000e74a000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0x5f/0x350 kernel/locking/lockdep.c:5831
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:838 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1181 [inline]
 unwind_next_frame+0xc3/0x2550 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x11b/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x31c/0x660 mm/slub.c:5419
 kmalloc_noprof include/linux/slab.h:950 [inline]
 dummy_urb_enqueue+0x7c/0x780 drivers/usb/gadget/udc/dummy_hcd.c:1277
 usb_hcd_submit_urb+0x328/0x1b70 drivers/usb/core/hcd.c:1542
 ath9k_hif_usb_reg_in_cb+0x4d5/0x6f0 drivers/net/wireless/ath/ath9k/hif_usb.c:790
 __usb_hcd_giveback_urb+0x376/0x540 drivers/usb/core/hcd.c:1657
 dummy_timer+0xbc0/0x4650 drivers/usb/gadget/udc/dummy_hcd.c:2005
 __run_hrtimer kernel/time/hrtimer.c:1930 [inline]
 __hrtimer_run_queues+0x3c0/0xa20 kernel/time/hrtimer.c:1994
 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2011
 handle_softirqs+0x22a/0x840 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1061
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:wg_prev_queue_peek drivers/net/wireguard/queueing.h:140 [inline]
RIP: 0010:wg_packet_tx_worker+0x8a/0x7c0 drivers/net/wireguard/send.c:269
Code: 24 18 4c 89 24 24 eb 1d e8 e3 95 4e fb 48 c7 c7 e0 b2 65 8c be 1b 01 00 00 31 d2 e8 90 45 1e fb 2e 2e 2e 31 c0 48 8b 44 24 10 <80> 3c 28 00 74 08 4c 89 e7 e8 d8 d5 b9 fb 4d 8b 34 24 4d 85 f6 74
RSP: 0018:ffffc90003fdfa28 EFLAGS: 00000293
RAX: 1ffff11004a3e27d RBX: 0000000000000000 RCX: ffff88801df21ec0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: dffffc0000000000 R08: ffff8880251f1ad3 R09: 1ffff11004a3e35a
R10: dffffc0000000000 R11: ffffed1004a3e35b R12: ffff8880251f13e8
R13: 1000000000000000 R14: ffffffff867730ba R15: ffff8880251f13d0
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397
 rescuer_thread+0x827/0x1130 kernel/workqueue.c:3621
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/22 09:39 upstream 6779b50faa56 e16cf9f3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in lo_release
* Struck through repros no longer work on HEAD.