INFO: task hung in lock_sock_nested

Status: auto-obsoleted due to no activity on 2026/04/10 07:35
Reported-by: syzbot+3386066711f7a5fafcf6@syzkaller.appspotmail.com
First crash: 215d, last: 215d
▶ ▼ Similar bugs (18)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in lock_sock_nested (2) net virt kvm 1 syz, C done 418 2340d 2353d 15/29 fixed on 2020/04/15 17:19
linux-6.1 INFO: task hung in lock_sock_nested 1 1 146d 146d 0/3 auto-obsoleted due to no activity on 2026/06/17 17:42
upstream INFO: task hung in lock_sock_nested kvm net virt 1 syz, C 2593 2357d 3157d 0/29 closed as dup on 2017/12/23 20:15
android-44 INFO: task hung in lock_sock_nested (2) 1 4 2440d 2535d 0/2 auto-closed as invalid on 2020/03/27 01:37
linux-4.19 INFO: task hung in lock_sock_nested (3) 1 6 1287d 1501d 0/1 upstream: reported on 2022/06/23 22:52
upstream INFO: task hung in lock_sock_nested (3) net 1 syz, C done 5 2129d 2130d 15/29 fixed on 2020/11/16 12:12
android-49 INFO: task hung in lock_sock_nested (2) 1 2 2518d 2637d 0/3 auto-closed as invalid on 2020/01/08 15:18
linux-4.14 INFO: task hung in lock_sock_nested 1 1 2460d 2460d 0/1 auto-closed as invalid on 2020/03/06 15:38
linux-4.14 INFO: task hung in lock_sock_nested (2) 1 1 2198d 2198d 0/1 auto-closed as invalid on 2020/11/24 03:07
android-44 INFO: task hung in lock_sock_nested 1 syz, C 82 3078d 3079d 0/2 closed as invalid on 2019/03/08 00:11
upstream INFO: task can't die in __lock_sock bluetooth 1 syz, C done error 1067 999d 1813d 0/29 auto-obsoleted due to no activity on 2024/01/16 13:36
upstream INFO: task hung in lock_sock_nested (5) mptcp tipc 1 syz, C done 43 463d 584d 28/29 fixed on 2025/05/06 15:33
upstream INFO: task hung in lock_sock_nested (4) mptcp 1 syz, C done 6 2023d 2070d 19/29 fixed on 2021/03/10 01:48
android-49 INFO: task hung in lock_sock_nested 1 syz, C 101 2717d 3079d 0/3 closed as invalid on 2019/03/08 00:11
android-414 INFO: task hung in lock_sock_nested 1 65 2484d 2669d 0/1 auto-closed as invalid on 2020/02/12 04:11
linux-4.19 INFO: task hung in lock_sock_nested (2) 1 1 1697d 1697d 0/1 auto-closed as invalid on 2022/04/08 17:15
linux-5.15 INFO: task hung in lock_sock_nested 1 1 720d 720d 0/3 auto-obsoleted due to no activity on 2024/11/21 04:55
linux-4.19 INFO: task hung in lock_sock_nested 1 1 2277d 2277d 0/1 auto-closed as invalid on 2020/09/05 19:53

Sample crash report:
INFO: task syz.5.2005:13705 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.5.2005      state:D stack:24168 pid:13705 ppid:10485  flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 __lock_sock+0x14e/0x2a0 net/core/sock.c:2986
 lock_sock_nested+0x9f/0x100 net/core/sock.c:3540
 lock_sock include/net/sock.h:1767 [inline]
 sctp_sendmsg+0xb92/0x27e0 net/sctp/socket.c:1970
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x5bf/0x950 net/socket.c:2595
 ___sys_sendmsg+0x220/0x290 net/socket.c:2649
 __sys_sendmsg net/socket.c:2678 [inline]
 __do_sys_sendmsg net/socket.c:2687 [inline]
 __se_sys_sendmsg+0x1a5/0x270 net/socket.c:2685
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fae9098f749
RSP: 002b:00007fae918a8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fae90be6090 RCX: 00007fae9098f749
RDX: 0000000004000080 RSI: 0000200000000680 RDI: 000000000000000a
RBP: 00007fae90a13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fae90be6128 R14: 00007fae90be6090 R15: 00007ffd4cbb1738
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/29:
 #0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8cd2ff20 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
1 lock held by klogd/5129:
2 locks held by getty/5529:
 #0: ffff88814d7500a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000326e2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x425/0x1380 drivers/tty/n_tty.c:2217
1 lock held by sshd-session/5756:
2 locks held by syz.5.2005/13704:
1 lock held by syz.5.2005/13705:
 #0: ffff888069335bf0 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1767 [inline]
 #0: ffff888069335bf0 (sk_lock-AF_INET){+.+.}-{0:0}, at: sctp_sendmsg+0xb92/0x27e0 net/sctp/socket.c:1970

=============================================

NMI backtrace for cpu 0
CPU: 0 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x39b/0x3d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf41/0xf80 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5129 Comm: klogd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:unwind_get_return_address+0x71/0xc0 arch/x86/kernel/unwind_orc.c:369
Code: 80 3c 37 00 74 08 48 89 df e8 bb 5c a2 00 48 8b 3b e8 13 d8 1d 00 89 c5 31 ff 89 c6 e8 68 f2 4a 00 85 ed 74 20 e8 af ee 4a 00 <43> 80 3c 37 00 74 08 48 89 df e8 90 5c a2 00 48 8b 03 eb 0e e8 96
RSP: 0000:ffffc90003297180 EFLAGS: 00000293
RAX: ffffffff813aa211 RBX: ffffc900032971f0 RCX: ffff88807eb99e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000001 R08: ffff88807eb99e00 R09: 0000000000000003
R10: 0000000000000004 R11: 0000000000000000 R12: ffffffff81c2bde2
R13: ffffc900032975b8 R14: dffffc0000000000 R15: 1ffff92000652e3e
FS:  00007f8b6f7f9c80(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000023000 CR3: 000000002e2dd000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 arch_stack_walk+0x11d/0x190 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:522
 ____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236
 kasan_slab_free include/linux/kasan.h:164 [inline]
 slab_free_hook mm/slub.c:1811 [inline]
 slab_free_freelist_hook+0x130/0x1b0 mm/slub.c:1837
 slab_free mm/slub.c:3830 [inline]
 __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
 memcg_free_slab_cgroups mm/slab.h:463 [inline]
 unaccount_slab mm/slab.h:651 [inline]
 __free_slab+0xbe/0x270 mm/slub.c:2097
 discard_slab mm/slub.c:2127 [inline]
 __unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
 put_cpu_partial+0x17c/0x250 mm/slub.c:2743
 __slab_free+0x31d/0x410 mm/slub.c:3700
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
 ____kasan_kmalloc mm/kasan/common.c:340 [inline]
 __kasan_kmalloc+0x22/0xa0 mm/kasan/common.c:383
 kasan_kmalloc include/linux/kasan.h:198 [inline]
 __do_kmalloc_node mm/slab_common.c:1007 [inline]
 __kmalloc_node_track_caller+0xb2/0x230 mm/slab_common.c:1027
 kmalloc_reserve+0x116/0x240 net/core/skbuff.c:584
 __alloc_skb+0x138/0x2c0 net/core/skbuff.c:653
 alloc_skb include/linux/skbuff.h:1284 [inline]
 alloc_skb_with_frags+0xca/0x7c0 net/core/skbuff.c:6332
 sock_alloc_send_pskb+0x857/0x990 net/core/sock.c:2821
 unix_dgram_sendmsg+0x5a1/0x1720 net/unix/af_unix.c:2001
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x46a/0x620 net/socket.c:2201
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0xde/0xf0 net/socket.c:2209
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8b6f949407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007ffe1f7adcd0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f8b6f7f9c80 RCX: 00007f8b6f949407
RDX: 0000000000000054 RSI: 00007ffe1f7ade10 RDI: 0000000000000003
RBP: 00007ffe1f7ae240 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007ffe1f7ae258
R13: 00007ffe1f7ade10 R14: 0000000000000039 R15: 00007ffe1f7ade10
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/31 07:34 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in lock_sock_nested
* Struck through repros no longer work on HEAD.