BUG: soft lockup in tipc_disc_timeout (2)

Status: upstream: reported on 2026/05/19 15:10
Reported-by: syzbot+1740cd1278ad039c1d0e@syzkaller.appspotmail.com
First crash: 101d, last: 2h26m
Similar bugs (8)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 BUG: soft lockup in tipc_disc_timeout (2) 1 1 1419d 1419d 0/1 auto-obsoleted due to no activity on 2023/02/06 01:50
linux-6.1 BUG: soft lockup in tipc_disc_timeout 1 6 342d 404d 0/3 auto-obsoleted due to no activity on 2025/12/29 01:14
upstream BUG: soft lockup in tipc_disc_timeout net 1 1 627d 627d 0/29 closed as invalid on 2025/01/15 12:30
linux-4.19 BUG: soft lockup in tipc_disc_timeout 1 2 1804d 1804d 0/1 auto-closed as invalid on 2022/01/17 13:56
android-5-15 BUG: soft lockup in tipc_disc_timeout 1 1 1117d 1117d 0/2 auto-obsoleted due to no activity on 2023/11/05 03:35
linux-5.15 INFO: rcu detected stall in tipc_disc_timeout (2) 1 4 31d 150d 0/3 upstream: reported on 2026/03/30 17:12
linux-5.15 INFO: rcu detected stall in tipc_disc_timeout 1 1 393d 393d 0/3 auto-obsoleted due to no activity on 2025/11/07 23:05
upstream INFO: rcu detected stall in tipc_disc_timeout (3) net 1 1 784d 784d 0/29 auto-obsoleted due to no activity on 2024/10/03 12:56

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 26s! [syz.3.348:5718]
Modules linked in:
irq event stamp: 1290327
hardirqs last  enabled at (1290326): [<ffff8000083c7520>] seqcount_lockdep_reader_access include/linux/seqlock.h:104 [inline]
hardirqs last  enabled at (1290326): [<ffff8000083c7520>] timekeeping_get_delta kernel/time/timekeeping.c:254 [inline]
hardirqs last  enabled at (1290326): [<ffff8000083c7520>] timekeeping_get_ns+0x120/0x3b8 kernel/time/timekeeping.c:388
hardirqs last disabled at (1290327): [<ffff800011b9adc4>] __el1_irq arch/arm64/kernel/entry-common.c:468 [inline]
hardirqs last disabled at (1290327): [<ffff800011b9adc4>] el1_interrupt+0x24/0x54 arch/arm64/kernel/entry-common.c:486
softirqs last  enabled at (31558): [<ffff8000081ae3b4>] softirq_handle_end kernel/softirq.c:439 [inline]
softirqs last  enabled at (31558): [<ffff8000081ae3b4>] handle_softirqs+0xb1c/0xc90 kernel/softirq.c:624
softirqs last disabled at (46351): [<ffff800008020e6c>] __do_softirq+0x14/0x20 kernel/softirq.c:630
CPU: 0 PID: 5718 Comm: syz.3.348 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
pstate: 02400005 (nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : check_kcov_mode kernel/kcov.c:178 [inline]
pc : write_comp_data kernel/kcov.c:241 [inline]
pc : __sanitizer_cov_trace_const_cmp2+0x28/0xac kernel/kcov.c:302
lr : cake_heap_get_backlog net/sched/sch_cake.c:1466 [inline]
lr : cake_heapify+0x44/0x464 net/sched/sch_cake.c:1474
sp : ffff800008007100
x29: ffff800008007120 x28: 0000000000000000 x27: ffff0000ea300000
x26: 0000000000000000 x25: dfff800000000000 x24: 1fffe0001d46085b
x23: ffff0000ea3042d8 x22: ffff0000ea3002c0 x21: 0000000000000f8a
x20: 0000000000000f8a x19: 0000000000000f8a x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000082dd25c x15: ffff8000184dd000
x14: 0000000000000001 x13: 1ffff00002a72071 x12: 00000000540d193d
x11: ff008000101a37d4 x10: 0000000000000300 x9 : ffff0000d1c95400
x8 : ffff8000101a37d4 x7 : ffff8000083c7930 x6 : 0000000000000000
x5 : 0000000000000080 x4 : 0000000000000001 x3 : 0000000000000000
x2 : 0000000000000002 x1 : 0000000000000f8a x0 : 0000000000002001
Call trace:
 __sanitizer_cov_trace_const_cmp2+0x28/0xac kernel/kcov.c:303
 cake_drop net/sched/sch_cake.c:1571 [inline]
 cake_enqueue+0x36c0/0x6a18 net/sched/sch_cake.c:1945
 qdisc_enqueue include/net/sch_generic.h:855 [inline]
 netem_dequeue+0xa00/0x1018 net/sched/sch_netem.c:736
 dequeue_skb net/sched/sch_generic.c:295 [inline]
 qdisc_restart net/sched/sch_generic.c:400 [inline]
 __qdisc_run+0x1b4/0x1300 net/sched/sch_generic.c:418
 __dev_xmit_skb net/core/dev.c:3995 [inline]
 __dev_queue_xmit+0xc38/0x3154 net/core/dev.c:4337
 dev_queue_xmit include/linux/netdevice.h:3053 [inline]
 tipc_l2_send_msg+0x2a0/0x364 net/tipc/bearer.c:519
 tipc_bearer_xmit_skb+0x240/0x380 net/tipc/bearer.c:578
 tipc_disc_timeout+0x4e8/0x630 net/tipc/discover.c:340
 call_timer_fn+0x1b8/0x96c kernel/time/timer.c:1701
 expire_timers kernel/time/timer.c:1752 [inline]
 __run_timers+0x478/0x6d8 kernel/time/timer.c:2023
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2036
 handle_softirqs+0x318/0xc90 kernel/softirq.c:596
 __do_softirq+0x14/0x20 kernel/softirq.c:630
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:897
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85
 invoke_softirq kernel/softirq.c:477 [inline]
 __irq_exit_rcu+0x23c/0x430 kernel/softirq.c:679
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:691
 __el1_irq arch/arm64/kernel/entry-common.c:472 [inline]
 el1_interrupt+0x38/0x54 arch/arm64/kernel/entry-common.c:486
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
 _raw_spin_unlock_irqrestore+0x58/0xac kernel/locking/spinlock.c:194
 spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
 __wake_up_common_lock kernel/sched/wait.c:140 [inline]
 __wake_up_sync_key+0x120/0x184 kernel/sched/wait.c:208
 __unix_dgram_recvmsg+0x38c/0xb24 net/unix/af_unix.c:2480
 unix_dgram_recvmsg+0xd0/0xe8 net/unix/af_unix.c:2550
 ____sys_recvmsg+0x270/0x754 net/socket.c:-1
 ___sys_recvmsg net/socket.c:2780 [inline]
 do_recvmmsg+0x36c/0x9d8 net/socket.c:2874
 __sys_recvmmsg net/socket.c:2953 [inline]
 __do_sys_recvmmsg net/socket.c:2976 [inline]
 __se_sys_recvmmsg net/socket.c:2969 [inline]
 __arm64_sys_recvmmsg+0x184/0x244 net/socket.c:2969
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Crashes (6):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/28 14:32 linux-6.1.y d64a499eea6b e2fa417d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: soft lockup in tipc_disc_timeout
2026/08/13 08:43 linux-6.1.y e4f7d8be268e 359b2492 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: soft lockup in tipc_disc_timeout
2026/08/05 08:24 linux-6.1.y fb28aa725e05 52aa2820 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: soft lockup in tipc_disc_timeout
2026/07/24 22:11 linux-6.1.y dc5c83b7f5f8 dd737a83 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: soft lockup in tipc_disc_timeout
2026/06/11 20:45 linux-6.1.y 228da13e907e d93a6ab6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: soft lockup in tipc_disc_timeout
2026/05/19 15:09 linux-6.1.y c27210688955 223544dc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 BUG: soft lockup in tipc_disc_timeout
* Struck through repros no longer work on HEAD.