BUG: soft lockup in addrconf_rs_timer (5)

Status: upstream: reported C repro on 2026/05/10 21:46
Bug presence: origin:lts
[Documentation on labels]
Reported-by: syzbot+04aa0ea96895abc877d6@syzkaller.appspotmail.com
First crash: 106d, last: 81d
▶ ▼ Bug presence (2)
Date Name Commit Repro Result
2026/05/11 lts (merge base) 1989cd3d56e2 C [report] BUG: soft lockup in addrconf_rs_timer
2026/05/11 upstream (ToT) 5d6919055dec C Didn't crash
▶ ▼ Similar bugs (26)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: soft lockup in addrconf_rs_timer (3) net 1 syz 8 1041d 1105d 0/29 auto-obsoleted due to no activity on 2024/01/05 16:48
upstream BUG: soft lockup in addrconf_rs_timer (4) net 1 1 936d 936d 0/29 closed as invalid on 2024/03/12 13:17
android-6-1 BUG: soft lockup in addrconf_rs_timer 1 1 1009d 1009d 0/2 auto-obsoleted due to no activity on 2024/01/27 13:54
android-5-10 BUG: soft lockup in addrconf_rs_timer (2) 1 syz, C 265 441d 772d 0/2 auto-obsoleted due to no activity on 2025/07/28 18:01
android-5-10 BUG: soft lockup in addrconf_rs_timer 1 2 1100d 1118d 0/2 auto-obsoleted due to no activity on 2023/10/29 01:38
linux-6.1 BUG: soft lockup in addrconf_rs_timer 1 syz, C done 26 1147d 1159d 3/3 fixed on 2023/07/30 15:47
linux-4.19 BUG: soft lockup in addrconf_rs_timer 1 syz error 24 1281d 1964d 0/1 upstream: reported syz repro on 2021/03/19 06:05
linux-4.14 BUG: soft lockup in addrconf_rs_timer 1 syz, C error 133 1319d 2521d 0/1 upstream: reported C repro on 2019/09/08 14:09
android-5-10 BUG: soft lockup in addrconf_rs_timer (3) 1 1 181d 181d 0/2 auto-obsoleted due to no activity on 2026/05/05 01:45
linux-5.15 BUG: soft lockup in addrconf_rs_timer 1 syz, C error 36 1147d 1159d 0/3 auto-obsoleted due to no activity on 2023/08/23 09:06
android-5-15 BUG: soft lockup in addrconf_rs_timer (3) 1 1 105d 105d 0/2 auto-obsoleted due to no activity on 2026/07/19 17:10
android-5-15 BUG: soft lockup in addrconf_rs_timer (2) 1 syz 99 586d 828d 0/2 auto-obsoleted due to no activity on 2025/02/14 09:13
android-6-1 BUG: soft lockup in addrconf_rs_timer (3) 1 1 486d 486d 0/2 auto-obsoleted due to no activity on 2025/07/03 20:11
linux-6.6 INFO: rcu detected stall in addrconf_rs_timer origin:lts-only 1 syz, C inconclusive 29 8d17h 247d 0/2 upstream: reported C repro on 2025/11/29 19:55
android-54 BUG: soft lockup in addrconf_rs_timer 1 190 761d 816d 0/2 auto-obsoleted due to no activity on 2024/08/22 17:20
android-5-10 BUG: soft lockup in addrconf_rs_timer (4) 1 1 34d 34d 0/2 premoderation: reported on 2026/06/30 19:53
upstream BUG: soft lockup in addrconf_rs_timer net 1 18 2325d 2522d 0/29 auto-closed as invalid on 2020/07/20 22:25
android-6-1 BUG: soft lockup in addrconf_rs_timer (2) 1 syz 176 607d 812d 0/2 auto-obsoleted due to no activity on 2025/01/24 01:43
upstream BUG: soft lockup in addrconf_rs_timer (2) net 1 syz, C 51 1139d 1160d 23/29 fixed on 2023/07/04 09:17
android-6-1 BUG: soft lockup in addrconf_rs_timer (4) 1 7 209d 357d 0/2 auto-obsoleted due to no activity on 2026/04/06 21:21
android-5-15 BUG: soft lockup in addrconf_rs_timer 1 1 1107d 1107d 0/2 auto-obsoleted due to no activity on 2023/10/21 14:14
upstream INFO: rcu detected stall in addrconf_rs_timer (4) net 1 syz, C error error 121 1737d 2191d 0/29 closed as invalid on 2022/02/08 10:39
linux-6.1 INFO: rcu detected stall in addrconf_rs_timer origin:lts-only 1 syz, C done 124 8d22h 801d 0/3 upstream: reported C repro on 2024/05/24 18:08
linux-5.15 INFO: rcu detected stall in addrconf_rs_timer origin:lts-only 1 syz, C error 117 8d14h 967d 0/3 upstream: reported C repro on 2023/12/10 10:27
upstream INFO: rcu detected stall in addrconf_rs_timer (6) prio:normal virt mm netfilter 1 syz error error 704 7d12h 793d 0/29 upstream: reported syz repro on 2024/06/01 13:51
upstream INFO: rcu detected stall in addrconf_rs_timer (5) kvm 1 4 1561d 1561d 0/29 auto-closed as invalid on 2022/06/24 22:41
▶ ▼ Last patch testing requests (4)
Created Duration User Patch Repo Result
2026/05/30 06:31 16m retest repro android14-6.1 log
2026/05/30 06:31 15m retest repro android14-6.1 log
2026/05/30 06:31 14m retest repro android14-6.1 log
2026/05/30 06:31 20m retest repro android14-6.1 log

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 143s! [syz.3.20:398]
Modules linked in:
CPU: 0 PID: 398 Comm: syz.3.20 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:task_stack_page include/linux/sched/task_stack.h:22 [inline]
RIP: 0010:last_frame arch/x86/kernel/unwind_frame.c:82 [inline]
RIP: 0010:is_last_frame arch/x86/kernel/unwind_frame.c:87 [inline]
RIP: 0010:is_last_task_frame arch/x86/kernel/unwind_frame.c:156 [inline]
RIP: 0010:unwind_next_frame+0x115/0x700 arch/x86/kernel/unwind_frame.c:276
Code: f7 e8 5f 66 81 00 48 ba 00 00 00 00 00 fc ff df 4c 89 75 98 49 8b 06 48 89 45 a8 4c 8d 68 20 4c 89 e8 48 c1 e8 03 80 3c 10 00 <74> 12 4c 89 ef e8 31 66 81 00 48 ba 00 00 00 00 00 fc ff df 49 8b
RSP: 0018:ffffc90000007708 EFLAGS: 00000246
RAX: 1ffff1102256328c RBX: ffffc90000007788 RCX: 0000000000007700
RDX: dffffc0000000000 RSI: ffffffff8162e07a RDI: ffffc90000007788
RBP: ffffc90000007778 R08: ffffc90000007850 R09: ffffc90000007848
R10: 0000000000000009 R11: fffff52000000efd R12: 0000000000000000
R13: ffff888112b19460 R14: ffffc900000077b0 R15: ffffc90000007ef8
FS:  000055556458f500(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000004 CR3: 0000000122d20000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 arch_stack_walk+0x124/0x150 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_alloc_info+0x25/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:380 [inline]
 __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389
 kasan_kmalloc include/linux/kasan.h:212 [inline]
 __do_kmalloc_node mm/slab_common.c:938 [inline]
 __kmalloc_node_track_caller+0xb1/0x1e0 mm/slab_common.c:958
 kmalloc_reserve net/core/skbuff.c:449 [inline]
 __alloc_skb+0x236/0x4b0 net/core/skbuff.c:518
 alloc_skb include/linux/skbuff.h:1322 [inline]
 ndisc_alloc_skb net/ipv6/ndisc.c:423 [inline]
 ndisc_send_rs+0x304/0x870 net/ipv6/ndisc.c:707
 addrconf_rs_timer+0x2cf/0x610 net/ipv6/addrconf.c:4005
 call_timer_fn+0x46/0x2a0 kernel/time/timer.c:1553
 expire_timers kernel/time/timer.c:1604 [inline]
 __run_timers+0x65b/0x9f0 kernel/time/timer.c:1875
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1888
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:generic_exec_single+0x2bc/0x3b0 kernel/smp.c:-1
Code: 74 71 e8 e7 7d 09 00 43 0f b6 04 3e 84 c0 0f 85 c7 00 00 00 41 c7 04 24 00 00 00 00 bb fa ff ff ff eb 11 e8 c6 7d 09 00 31 db <49> bf 00 00 00 00 00 fc ff df 48 c7 44 24 20 0e 36 e0 45 4b c7 44
RSP: 0018:ffffc90000ac7a20 EFLAGS: 00000293
RAX: ffffffff8167f81e RBX: 0000000000000000 RCX: ffff888112b19440
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc90000ac7ad0 R08: ffff888112b19440 R09: fffff52000158e80
R10: 0000000000000000 R11: ffffffff81980270 R12: ffffc90000ac7b28
R13: 1ffff92000158f48 R14: ffffc90000ac7c60 R15: 0000000000000200
 smp_call_function_single+0x1d9/0x490 kernel/smp.c:784
 task_function_call kernel/events/core.c:120 [inline]
 perf_install_in_context+0x4b8/0x760 kernel/events/core.c:2935
 __do_sys_perf_event_open kernel/events/core.c:12775 [inline]
 __se_sys_perf_event_open+0x12b1/0x1bb0 kernel/events/core.c:12369
 __x64_sys_perf_event_open+0xbf/0xd0 kernel/events/core.c:12369
 x64_sys_call+0x385/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:299
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fc9c9b9cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff42efe0a8 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 00007fc9c9e15fa0 RCX: 00007fc9c9b9cdd9
RDX: afffffffffffffff RSI: 0000000000000000 RDI: 0000200000000180
RBP: 00007fc9c9c32d69 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007fc9c9e15fac R14: 00007fc9c9e15fa0 R15: 00007fc9c9e15fa0
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 395 Comm: syz.1.18 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:230 [inline]
RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:147 [inline]
RIP: 0010:wrmsr arch/x86/include/asm/msr.h:254 [inline]
RIP: 0010:native_apic_msr_write+0x39/0x50 arch/x86/include/asm/apic.h:206
Code: 74 05 83 ff 30 75 12 5d c3 81 ff d0 00 00 00 74 f6 81 ff e0 00 00 00 74 ee c1 ef 04 81 c7 00 08 00 00 89 f9 89 f0 31 d2 0f 30 <66> 90 eb d9 89 f6 31 d2 e8 ea 2d 5c 01 5d c3 0f 1f 84 00 00 00 00
RSP: 0018:ffffc900001b0840 EFLAGS: 00000046
RAX: 000000000000017c RBX: 000000000000017c RCX: 0000000000000838
RDX: 0000000000000000 RSI: 000000000000017c RDI: 0000000000000838
RBP: ffffc900001b0840 R08: ffff888115265100 R09: 0000000000000002
R10: 0000000000000000 R11: ffffffff8134c020 R12: 0000000000000020
R13: dffffc0000000000 R14: ffffffff866d5b60 R15: dffffc0000000000
FS:  000055555ef26500(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe85a244b91 CR3: 0000000112bcb000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 apic_write arch/x86/include/asm/apic.h:394 [inline]
 lapic_next_event+0x70/0x80 arch/x86/kernel/apic/apic.c:478
 clockevents_program_event+0x1d9/0x330 kernel/time/clockevents.c:334
 tick_program_event+0xa3/0x120 kernel/time/tick-oneshot.c:44
 hrtimer_interrupt+0x501/0x8c0 kernel/time/hrtimer.c:1824
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline]
 __sysvec_apic_timer_interrupt+0x11e/0x440 arch/x86/kernel/apic/apic.c:1124
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0x53/0xc0 arch/x86/kernel/apic/apic.c:1118
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:kasan_poison_last_granule+0x0/0x30 mm/kasan/shadow.c:108
Code: 89 c7 48 89 f2 89 ce e8 7e 8a 3f 03 5d c3 0f 0b c3 0f 0b c3 66 0f 1f 44 00 00 90 90 90 90 90 90 90 90 90 90 90 b8 8d bb 8f cf <48> 89 f0 48 83 e0 07 74 19 55 48 89 e5 48 01 f7 48 c1 ef 03 48 b9
RSP: 0018:ffffc900001b0b18 EFLAGS: 00000246
RAX: ffff8881f714e001 RBX: ffff88812f4c1800 RCX: ffffffff38373800
RDX: 0000000000000200 RSI: 0000000000000200 RDI: ffff88812f4c1800
RBP: ffffc900001b0b40 R08: ffffc900001b0b08 R09: ffff88812f4c1800
R10: 00000000743a084c R11: 00000000ffffffff R12: 0000000000000200
R13: ffff888100042f00 R14: 0000000000082a20 R15: ffff888100042f00
 kasan_kmalloc include/linux/kasan.h:212 [inline]
 __do_kmalloc_node mm/slab_common.c:938 [inline]
 __kmalloc_node_track_caller+0xb1/0x1e0 mm/slab_common.c:958
 kmalloc_reserve net/core/skbuff.c:449 [inline]
 __alloc_skb+0x236/0x4b0 net/core/skbuff.c:518
 alloc_skb include/linux/skbuff.h:1322 [inline]
 ndisc_alloc_skb net/ipv6/ndisc.c:423 [inline]
 ndisc_send_rs+0x304/0x870 net/ipv6/ndisc.c:707
 addrconf_rs_timer+0x2cf/0x610 net/ipv6/addrconf.c:4005
 call_timer_fn+0x46/0x2a0 kernel/time/timer.c:1553
 expire_timers kernel/time/timer.c:1604 [inline]
 __run_timers+0x65b/0x9f0 kernel/time/timer.c:1875
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1888
 handle_softirqs+0x1d7/0x600 kernel/softirq.c:642
 __do_softirq kernel/softirq.c:680 [inline]
 invoke_softirq kernel/softirq.c:497 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:729
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:741
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:do_exit+0x67f/0x2660 kernel/exit.c:854
Code: fc ff df e9 af 01 00 00 e8 de 9b 2e 00 e9 aa 01 00 00 4c 89 64 24 08 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 20 80 3c 01 00 <74> 0a 48 8b 7c 24 10 e8 c5 36 74 00 41 bc 58 02 00 00 48 8b 44 24
RSP: 0018:ffffc90000a97a00 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffff88812d268001 RCX: 1ffff11022a4cb2a
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888115265100
RBP: ffffc90000a97b60 R08: ffff88812d268007 R09: 1ffff11025a4d000
R10: dffffc0000000000 R11: ffffed1025a4d001 R12: ffff888115265660
R13: ffff88811258f200 R14: 1ffff11022a4cacc R15: 000000000000018b
 do_group_exit+0x210/0x2d0 kernel/exit.c:1028
 get_signal+0x13b5/0x1520 kernel/signal.c:2891
 arch_do_signal_or_restart+0xd1/0x1140 arch/x86/kernel/signal.c:871
 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210
 irqentry_exit_to_user_mode+0x9/0x10 kernel/entry/common.c:316
 irqentry_exit+0x12/0x40 kernel/entry/common.c:419
 sysvec_apic_timer_interrupt+0x64/0xc0 arch/x86/kernel/apic/apic.c:1118
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0033:0x7fe85a195b77
Code: 24 08 64 48 2b 14 25 28 00 00 00 75 05 48 83 c4 18 c3 e8 7c 97 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 05 e9 0a 25 00 <48> 85 c0 74 14 48 83 ec 08 ff d0 85 c0 75 1a 31 c0 48 83 c4 08 c3
RSP: 002b:00007ffd15e4d928 EFLAGS: 00000206
RAX: 00007ffd15e6d750 RBX: 0000000000000004 RCX: 0000000000000000
RDX: 00007fe85a2b9b40 RSI: 00007ffd15e4d990 RDI: 0000000000000001
RBP: 00007fe85a244b91 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe85a415fac R14: 00007fe85a415fa0 R15: 00007fe85a415fa0
 </TASK>

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/05/11 06:14 android14-6.1 2f67b6088692 29233ece .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: soft lockup in addrconf_rs_timer
2026/05/11 03:22 android14-6.1 2f67b6088692 29233ece .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: soft lockup in addrconf_rs_timer
2026/05/11 00:39 android14-6.1 2f67b6088692 29233ece .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: soft lockup in addrconf_rs_timer
2026/05/10 21:36 android14-6.1 2f67b6088692 29233ece .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: soft lockup in addrconf_rs_timer
2026/05/14 17:49 android14-6.1 17b41c3753e0 6ccb967e .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: soft lockup in addrconf_rs_timer
2026/04/19 17:28 android14-6.1 7790109d9d13 303e2802 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-1-perf BUG: soft lockup in addrconf_rs_timer
* Struck through repros no longer work on HEAD.