BUG: soft lockup in mmap_file

Status: premoderation: reported on 2026/09/02 19:03
Reported-by: syzbot+60de9b17452909c9dbf2@syzkaller.appspotmail.com
First crash: 15d, last: 15d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: rcu detected stall in mmap_file (3) 1 3 198d 369d 0/3 auto-obsoleted due to no activity on 2026/06/11 12:22
linux-5.15 INFO: rcu detected stall in mmap_file 1 1 634d 634d 0/3 auto-obsoleted due to no activity on 2025/04/01 14:21
linux-5.15 INFO: rcu detected stall in mmap_file (4) 1 4 21d 95d 0/3 upstream: reported on 2026/06/14 00:35
linux-6.1 INFO: rcu detected stall in mmap_file 1 1 113d 113d 0/3 auto-obsoleted due to no activity on 2026/09/04 21:34
linux-5.15 INFO: rcu detected stall in mmap_file (2) 1 1 479d 479d 0/3 auto-obsoleted due to no activity on 2025/09/02 23:08

Sample crash report:
watchdog: BUG: soft lockup - CPU#1 stuck for 123s! [syz-executor:2864]
Modules linked in:
CPU: 1 PID: 2864 Comm: syz-executor Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:trylock_clear_pending kernel/locking/qspinlock_paravirt.h:121 [inline]
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:435 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x5ae/0xb80 kernel/locking/qspinlock.c:508
Code: 24 10 42 0f b6 04 38 84 c0 0f 85 c0 01 00 00 48 8d 43 01 c6 00 01 41 bd 00 80 ff ff eb 07 f3 90 41 ff c5 74 4a 43 0f b6 04 3e <84> c0 75 2e 80 3b 00 75 eb 48 89 df be 02 00 00 00 e8 6c 4a 53 00
RSP: 0018:ffffc90001d476c0 EFLAGS: 00000282

RAX: 0000000000000004 RBX: ffffffff86eb3520 RCX: 0000000086eb3500
RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffffffff86eb3520
RBP: ffffc90001d477b0 R08: 0000000000000000 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff0dd66a4 R12: ffff88823ff92740
R13: 00000000ffffeb5d R14: 1ffffffff0dd66a4 R15: dffffc0000000000
FS:  000055558bd10500(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f326397f038 CR3: 0000000110a56000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:554 [inline]
 queued_spin_lock_slowpath+0x47/0x50 arch/x86/include/asm/qspinlock.h:51
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock include/linux/spinlock.h:184 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0xe4/0xf0 kernel/locking/spinlock.c:151
 spin_lock include/linux/spinlock.h:355 [inline]
 alloc_vmap_area+0x218/0x19d0 mm/vmalloc.c:1216
 __get_vm_area_node+0x147/0x450 mm/vmalloc.c:2099
 __vmalloc_node_range+0xe7/0x7a0 mm/vmalloc.c:2598
 vmalloc_user+0x73/0x80 mm/vmalloc.c:2758
 kcov_mmap+0x2b/0x130 kernel/kcov.c:465
 call_mmap include/linux/fs.h:2077 [inline]
 mmap_file+0x60/0xb0 mm/util.c:1085
 __mmap_region mm/mmap.c:1884 [inline]
 mmap_region+0x11fd/0x19c0 mm/mmap.c:3075
 do_mmap+0x85f/0xf50 mm/mmap.c:1661
 vm_mmap_pgoff+0x1f4/0x350 mm/util.c:543
 ksys_mmap_pgoff+0x16f/0x1e0 mm/mmap.c:1712
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:95 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:86 [inline]
 __x64_sys_mmap+0xfa/0x110 arch/x86/kernel/sys_x86_64.c:86
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f32636f6ec2
Code: 4f 01 00 0f 1f 44 00 00 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 3b 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 6e 5b 5d c3 0f 1f 00 48 c7 c0 e8 ff ff ff 64
RSP: 002b:00007ffda0a4dd58 EFLAGS: 00000206
 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007f3263158000 RCX: 00007f32636f6ec2
RDX: 0000000000000003 RSI: 0000000000400000 RDI: 00007f3263158000
RBP: 0000000000000011 R08: 00000000000000d8 R09: 0000000000000000
R10: 0000000000000011 R11: 0000000000000206 R12: 0000000000000003
R13: 0000000000000003 R14: 00007ffda0a4dfc8 R15: 0000000000000000
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 2541 Comm: syz.4.8297 Tainted: G        W         syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:on_stack arch/x86/include/asm/stacktrace.h:45 [inline]
RIP: 0010:update_stack_state+0x185/0x490 arch/x86/kernel/unwind_frame.c:228
Code: 8b 74 24 28 4c 89 f7 4c 89 e2 48 8b 8d 68 ff ff ff e8 4f f5 f7 ff 85 c0 0f 85 35 01 00 00 48 8b 85 50 ff ff ff 42 80 3c 28 00 <74> 08 4c 89 ff e8 21 f4 6f 00 4c 89 fb 4d 8b 37 48 8b 85 58 ff ff
RSP: 0018:ffffc900000070a8 EFLAGS: 00000246
RAX: 1ffff92000000e3a RBX: ffffc900000071c8 RCX: 1ffff92000000e3b
RDX: 1ffff92000000e3c RSI: 1ffff92000000e3a RDI: ffffc90000007220
RBP: ffffc90000007158 R08: ffffc90000007290 R09: ffffc90000007288
R10: 000000000000001f R11: fffff52000000e45 R12: ffffc900000071c8
R13: dffffc0000000000 R14: ffffc90000e67208 R15: ffffc900000071d0
FS:  00007fa94fadf6c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcdc88e9590 CR3: 00000001360a5000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 unwind_next_frame+0x39e/0x670 arch/x86/kernel/unwind_frame.c:316
 arch_stack_walk+0x108/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:121
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4a/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x125/0x160 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370
 kasan_slab_free include/linux/kasan.h:220 [inline]
 slab_free_hook mm/slub.c:1600 [inline]
 slab_free_freelist_hook+0xc5/0x190 mm/slub.c:1626
 slab_free mm/slub.c:3208 [inline]
 kmem_cache_free+0x100/0x2d0 mm/slub.c:3224
 kfree_skbmem+0x10c/0x180 net/core/skbuff.c:-1
 __kfree_skb net/core/skbuff.c:695 [inline]
 kfree_skb+0xc1/0x2f0 net/core/skbuff.c:713
 ip6_mc_input+0x22b/0x290 net/ipv6/ip6_input.c:574
 dst_input include/net/dst.h:461 [inline]
 ip6_rcv_finish+0x18c/0x360 net/ipv6/ip6_input.c:80
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ipv6_rcv+0xf0/0x230 net/ipv6/ip6_input.c:301
 __netif_receive_skb_one_core net/core/dev.c:5413 [inline]
 __netif_receive_skb+0xc8/0x280 net/core/dev.c:5527
 netif_receive_skb_internal net/core/dev.c:5632 [inline]
 netif_receive_skb+0x9b/0x3e0 net/core/dev.c:5691
 br_netif_receive_skb net/bridge/br_input.c:30 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 br_pass_frame_up+0x164/0x1e0 net/bridge/br_input.c:72
 br_handle_frame_finish+0xce7/0x10f0 net/bridge/br_input.c:179
 nf_hook_bridge_pre net/bridge/br_input.c:259 [inline]
 br_handle_frame+0x406/0x8e0 net/bridge/br_input.c:363
 __netif_receive_skb_core+0xed5/0x30b0 net/core/dev.c:5307
 __netif_receive_skb_one_core net/core/dev.c:5411 [inline]
 __netif_receive_skb+0x72/0x280 net/core/dev.c:5527
 process_backlog+0x351/0x600 net/core/dev.c:6434
 napi_poll net/core/dev.c:6885 [inline]
 net_rx_action+0x48d/0xed0 net/core/dev.c:6955
 __do_softirq+0x255/0x563 kernel/softirq.c:309
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:405 [inline]
 __irq_exit_rcu+0x128/0x150 kernel/softirq.c:435
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:447
 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1106
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635
RIP: 0010:__kernel_text_address+0xcf/0x100 kernel/extable.c:118
Code: f4 01 45 84 ff 75 05 e8 cf f6 3a 03 45 84 e4 74 19 49 81 fe 00 50 cc 86 0f 93 c0 49 81 fe 2a f1 d9 86 0f 92 c1 20 c1 0f b6 d9 <89> d8 5b 41 5c 41 5e 41 5f 5d c3 48 c7 c1 00 40 c3 86 80 e1 07 80
RSP: 0018:ffffc90000e66f50 EFLAGS: 00000202
RAX: 0000000000000001 RBX: 0000000000000001 RCX: 00000000001ccd01
RDX: ffffc90000e67208 RSI: 1ffff920001ccdf6 RDI: ffffffff81a3c876
RBP: ffffc90000e66f70 R08: ffffc90000e67070 R09: ffffc90000e67068
R10: 0000000000000000 R11: fffff520001cce01 R12: ffff888119e113c0
R13: ffffea000444cad8 R14: dffffc0000000000 R15: 1ffff920001ccdfe
 unwind_get_return_address+0x4d/0x90 arch/x86/kernel/unwind_frame.c:19
 arch_stack_walk+0xee/0x140 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:121
 save_stack+0xc1/0x230 mm/page_owner.c:146
 __reset_page_owner+0x36/0x140 mm/page_owner.c:174
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1349 [inline]
 free_pcp_prepare mm/page_alloc.c:1421 [inline]
 free_unref_page_prepare+0x2b7/0x2d0 mm/page_alloc.c:3336
 free_unref_page mm/page_alloc.c:3391 [inline]
 free_the_page mm/page_alloc.c:5443 [inline]
 __free_pages+0x146/0x390 mm/page_alloc.c:5454
 free_pages+0x82/0x90 mm/page_alloc.c:5465
 kasan_depopulate_vmalloc_pte+0x6b/0x90 mm/kasan/shadow.c:354
 apply_to_pte_range mm/memory.c:2504 [inline]
 apply_to_pmd_range mm/memory.c:2540 [inline]
 apply_to_pud_range mm/memory.c:2568 [inline]
 apply_to_p4d_range mm/memory.c:2596 [inline]
 __apply_to_page_range+0x790/0xa20 mm/memory.c:2623
 apply_to_existing_page_range+0x38/0x50 mm/memory.c:2874
 kasan_release_vmalloc+0x97/0xb0 mm/kasan/shadow.c:464
 __purge_vmap_area_lazy+0x1326/0x1440 mm/vmalloc.c:1382
 _vm_unmap_aliases+0x2ec/0x370 mm/vmalloc.c:1779
 vm_unmap_aliases+0x19/0x20 mm/vmalloc.c:1802
 change_page_attr_set_clr+0x317/0xc10 arch/x86/mm/pat/set_memory.c:1732
 change_page_attr_clear arch/x86/mm/pat/set_memory.c:1789 [inline]
 set_memory_x+0xd3/0x110 arch/x86/mm/pat/set_memory.c:1922
 bpf_jit_binary_lock_ro include/linux/filter.h:847 [inline]
 bpf_int_jit_compile+0x848b/0x8930 arch/x86/net/bpf_jit_comp.c:2134
 bpf_prog_select_runtime+0x722/0x9c0 kernel/bpf/core.c:1876
 bpf_prog_load+0x1031/0x14e0 kernel/bpf/syscall.c:2238
 __do_sys_bpf kernel/bpf/syscall.c:4435 [inline]
 __se_sys_bpf+0x49a/0x740 kernel/bpf/syscall.c:4391
 __x64_sys_bpf+0x7b/0x90 kernel/bpf/syscall.c:4391
 do_syscall_64+0x31/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7fa951086159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa94fadf028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007fa95130dfa0 RCX: 00007fa951086159
RDX: 0000000000000094 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007fa95111d024 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fa95130e038 R14: 00007fa95130dfa0 R15: 00007fff41aabeb8

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/02 19:02 android13-5.10-lts 4185c27befd4 85995287 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10-perf BUG: soft lockup in mmap_file
* Struck through repros no longer work on HEAD.