syzbot


INFO: task hung in nsim_destroy (4)

Status: upstream: reported syz repro on 2024/05/31 11:16
Subsystems: net
[Documentation on labels]
Reported-by: syzbot+8141dcbd23a8f857798a@syzkaller.appspotmail.com
First crash: 673d, last: 25d
Cause bisection: failed (error log, bisect log)
  
Fix bisection: failed (error log, bisect log)
  
Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] INFO: task hung in nsim_destroy (4) 0 (2) 2025/10/13 12:20
Similar bugs (19)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in nsim_destroy net 1 1 1608d 1608d 0/29 auto-closed as invalid on 2022/01/17 12:55
upstream INFO: task hung in nsim_destroy (2) net 1 2 964d 1021d 0/29 auto-obsoleted due to no activity on 2023/09/24 06:54
linux-6.1 INFO: task hung in nsim_destroy 1 1 637d 637d 0/3 auto-obsoleted due to no activity on 2024/09/25 07:16
upstream INFO: task hung in nsim_destroy (3) net 1 1 894d 894d 0/29 auto-obsoleted due to no activity on 2024/01/01 15:33
linux-6.1 INFO: rcu detected stall in corrupted origin:upstream missing-backport 1 C inconclusive 4018 7d19h 1099d 0/3 upstream: reported C repro on 2023/03/13 04:03
upstream INFO: task hung in exit_aio (4) fs 1 6 458d 523d 0/29 auto-obsoleted due to no activity on 2025/03/13 05:51
android-5-15 BUG: soft lockup in corrupted origin:upstream 1 C error 33 547d 704d 0/2 upstream: reported C repro on 2024/04/11 09:01
upstream BUG: workqueue lockup (5) kernel 1 C done 15123 41m 2252d 0/29 upstream: reported C repro on 2020/01/14 22:04
upstream INFO: task hung in reg_process_self_managed_hints wireless 1 C done 1046 2d07h 937d 0/29 upstream: reported C repro on 2023/08/21 16:36
linux-6.6 INFO: rcu detected stall in corrupted origin:lts-only 1 C done 110 8d09h 266d 0/2 upstream: reported C repro on 2025/06/23 09:19
upstream INFO: rcu detected stall in corrupted (4) tipc 1 C done inconclusive 801 2d00h 2018d 0/29 upstream: reported C repro on 2020/09/04 18:49
linux-4.14 BUG: soft lockup in corrupted 1 C error 12 1323d 1807d 0/1 upstream: reported C repro on 2021/04/04 06:30
upstream INFO: task hung in reg_check_chans_work (7) wireless 1 C error 868 4d00h 539d 0/29 upstream: reported C repro on 2024/09/23 08:39
android-6-12 INFO: rcu detected stall in corrupted origin:lts 1 syz 2 21d 141d 0/1 premoderation: reported syz repro on 2025/10/26 00:18
upstream INFO: task hung in linkwatch_event (4) net 1 C done 3477 13h00m 597d 0/29 upstream: reported C repro on 2024/07/27 06:21
linux-4.19 INFO: rcu detected stall in corrupted 1 C error 2 1515d 2223d 0/1 upstream: reported C repro on 2020/02/13 05:06
upstream INFO: task hung in uevent_show (2) kernel 1 C inconclusive 8325 253d 491d 29/29 fixed on 2025/07/17 21:22
linux-4.19 BUG: soft lockup in corrupted 1 C error 3 1352d 1540d 0/1 upstream: reported C repro on 2021/12/26 20:46
linux-5.15 INFO: rcu detected stall in corrupted origin:lts-only 1 C error 117 7d01h 875d 0/3 upstream: reported C repro on 2023/10/23 02:41
Last patch testing requests (2)
Created Duration User Patch Repo Result
2026/03/04 23:03 1h16m retest repro upstream OK log
2025/10/30 06:40 58m retest repro upstream report log

Sample crash report:
INFO: task kworker/u8:0:12 blocked for more than 147 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:0    state:D stack:22400 pid:12    tgid:12    ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5340 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 rtnl_net_dev_lock+0x257/0x2f0 net/core/dev.c:2155
 unregister_netdevice_notifier_dev_net+0x96/0x440 net/core/dev.c:2200
 nsim_destroy+0xd9/0x680 drivers/net/netdevsim/netdev.c:1173
 __nsim_dev_port_del+0x14d/0x1b0 drivers/net/netdevsim/dev.c:1529
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1541 [inline]
 nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1765
 nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1039
 devlink_reload+0x1d1/0x8d0 net/devlink/dev.c:461
 devlink_pernet_pre_exit+0x1e6/0x3f0 net/devlink/core.c:507
 ops_pre_exit_list net/core/net_namespace.c:161 [inline]
 ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
 cleanup_net+0x56b/0x800 net/core/net_namespace.c:704
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/R-ipv6_:3183 blocked for more than 147 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/R-ipv6_ state:D stack:24704 pid:3183  tgid:3183  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5340 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 addrconf_dad_work+0x11e/0x14c0 net/ipv6/addrconf.c:4199
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 rescuer_thread+0x824/0x1120 kernel/workqueue.c:3582
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task kworker/u8:12:7508 blocked for more than 147 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:12   state:D stack:22400 pid:7508  tgid:7508  ppid:2      task_flags:0x4208160 flags:0x00080000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5340 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 linkwatch_event+0xe/0x60 net/core/link_watch.c:313
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
INFO: task syz-executor:17910 blocked for more than 147 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:22992 pid:17910 tgid:17910 ppid:17902  task_flags:0x400140 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5340 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 rtnl_lock net/core/rtnetlink.c:80 [inline]
 rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071
 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg net/socket.c:742 [inline]
 __sys_sendto+0x709/0x7a0 net/socket.c:2206
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2209
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe50355cece
RSP: 002b:00007fe50393f638 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000555580e71500 RCX: 00007fe50355cece
RDX: 0000000000000068 RSI: 00007fe504344670 RDI: 0000000000000003
RBP: 0000000000000001 R08: 00007fe50393f6b4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fe504344670 R15: 0000000000000000
 </TASK>
INFO: task syz.4.3062:18169 blocked for more than 147 seconds.
      Tainted: G             L      syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.3062      state:D stack:25448 pid:18169 tgid:18166 ppid:16975  task_flags:0x400140 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5340 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7061
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x7fe/0x1300 kernel/locking/mutex.c:776
 ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146
 ops_init+0x35c/0x5c0 net/core/net_namespace.c:137
 setup_net+0x118/0x340 net/core/net_namespace.c:446
 copy_net_ns+0x50e/0x730 net/core/net_namespace.c:581
 create_new_namespaces+0x3e7/0x6a0 kernel/nsproxy.c:130
 copy_namespaces+0x438/0x4b0 kernel/nsproxy.c:195
 copy_process+0x18e2/0x3cf0 kernel/fork.c:2226
 kernel_clone+0x248/0x8e0 kernel/fork.c:2654
 __do_sys_clone kernel/fork.c:2795 [inline]
 __se_sys_clone kernel/fork.c:2779 [inline]
 __x64_sys_clone+0x1b6/0x230 kernel/fork.c:2779
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x14d/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f739899c629
RSP: 002b:00007f739982afd8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f7398c16180 RCX: 00007f739899c629
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040800000
RBP: 00007f7398a32b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f7398c16218 R14: 00007f7398c16180 R15: 00007f7398d3fa48
 </TASK>

Showing all locks held in the system:
2 locks held by kthreadd/2:
1 lock held by kworker/R-kvfre/6:
 #0: ffffffff8e5fec68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2691
2 locks held by kworker/0:0/9:
6 locks held by kworker/u8:0/12:
 #0: ffff88801b6d6948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff88801b6d6948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc90000117c40 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc90000117c40 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffffffff8fbbcf30 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf4/0x800 net/core/net_namespace.c:675
 #3: ffff88805706c0e8 (&dev->mutex){....}-{4:4}, at: device_lock include/linux/device.h:895 [inline]
 #3: ffff88805706c0e8 (&dev->mutex){....}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:108 [inline]
 #3: ffff88805706c0e8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x117/0x3f0 net/devlink/core.c:504
 #4: ffff88805706b250 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_lock net/devlink/core.c:274 [inline]
 #4: ffff88805706b250 (&devlink->lock_key#2){+.+.}-{4:4}, at: devl_dev_lock net/devlink/devl_internal.h:109 [inline]
 #4: ffff88805706b250 (&devlink->lock_key#2){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x129/0x3f0 net/devlink/core.c:504
 #5: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #5: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x257/0x2f0 net/core/dev.c:2155
1 lock held by kworker/R-mm_pe/14:
 #0: ffffffff8e5fec68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_attach_to_pool+0x2e/0x3a0 kernel/workqueue.c:2691
3 locks held by kworker/1:0/24:
1 lock held by khungtaskd/30:
 #0: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8e7602e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 kernel/locking/lockdep.c:6775
3 locks held by kworker/u8:2/35:
3 locks held by kworker/u8:3/49:
4 locks held by kworker/u8:4/63:
3 locks held by kworker/u8:6/136:
3 locks held by kworker/u8:7/1147:
3 locks held by kworker/R-ipv6_/3183:
 #0: ffff888030f61948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff888030f61948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc9000cabfc00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc9000cabfc00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_lock include/linux/rtnetlink.h:130 [inline]
 #2: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_dad_work+0x11e/0x14c0 net/ipv6/addrconf.c:4199
1 lock held by kworker/R-bat_e/3408:
 #0: ffffffff8e5fec68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline]
 #0: ffffffff8e5fec68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4a/0x1120 kernel/workqueue.c:3610
3 locks held by kworker/u8:9/4559:
2 locks held by klogd/5181:
1 lock held by udevd/5192:
1 lock held by dhcpcd/5486:
 #0: ffff888078c80948 (vm_lock){++++}-{0:0}, at: lock_vma_under_rcu+0x1d1/0x500 mm/mmap_lock.c:310
2 locks held by crond/5563:
2 locks held by getty/5582:
 #0: ffff888035f010a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 drivers/tty/n_tty.c:2211
1 lock held by syz-executor/5810:
3 locks held by kworker/1:5/5897:
4 locks held by kworker/0:7/5962:
3 locks held by kworker/u8:11/7507:
3 locks held by kworker/u8:12/7508:
 #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff88813fe4c148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc90005c6fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc90005c6fc40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:313
4 locks held by kworker/0:10/7918:
3 locks held by kworker/0:11/7919:
 #0: ffff88813fe0e148 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff88813fe0e148 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc9000214fc40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc9000214fc40 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xa5/0xfe0 net/wireless/reg.c:2464
5 locks held by kworker/0:12/7920:
6 locks held by kworker/1:10/7931:
3 locks held by kworker/1:13/7934:
1 lock held by syz-executor/16516:
3 locks held by kworker/0:1/17081:
1 lock held by kworker/R-wg-cr/17607:
1 lock held by kworker/R-wg-cr/17611:
 #0: ffffffff8e5fec68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: worker_detach_from_pool kernel/workqueue.c:2749 [inline]
 #0: ffffffff8e5fec68 (wq_pool_attach_mutex){+.+.}-{4:4}, at: rescuer_thread+0xc4a/0x1120 kernel/workqueue.c:3610
1 lock held by syz-executor/17863:
2 locks held by syz-executor/17910:
 #0: ffffffff8f3003e8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_lock_acquire include/linux/rcupdate.h:312 [inline]
 #0: ffffffff8f3003e8 (&ops->srcu#2){.+.+}-{0:0}, at: rcu_read_lock include/linux/rcupdate.h:850 [inline]
 #0: ffffffff8f3003e8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 net/core/rtnetlink.c:570
 #1: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_lock net/core/rtnetlink.c:80 [inline]
 #1: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_nets_lock net/core/rtnetlink.c:341 [inline]
 #1: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8a1/0x1be0 net/core/rtnetlink.c:4071
4 locks held by syz.4.3062/18168:
2 locks held by syz.4.3062/18169:
 #0: ffffffff8fbbcf30 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x4f7/0x730 net/core/net_namespace.c:577
 #1: ffffffff8fbcb788 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x2d7/0x840 net/ipv4/ip_tunnel.c:1146
6 locks held by syz.1.3064/18178:
4 locks held by kworker/u8:1/18179:
 #0: ffff8880535ab948 ((wq_completion)wg-kex-wg1#13){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3250 [inline]
 #0: ffff8880535ab948 ((wq_completion)wg-kex-wg1#13){+.+.}-{0:0}, at: process_scheduled_works+0x9ea/0x1830 kernel/workqueue.c:3358
 #1: ffffc90004347c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3251 [inline]
 #1: ffffc90004347c40 ((work_completion)(&peer->transmit_handshake_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa25/0x1830 kernel/workqueue.c:3358
 #2: ffff88804ca71348 (&wg->static_identity.lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x12f/0x830 drivers/net/wireguard/noise.c:529
 #3: ffff88802b371708 (&handshake->lock){++++}-{4:4}, at: wg_noise_handshake_create_initiation+0x140/0x830 drivers/net/wireguard/noise.c:530
4 locks held by kworker/u8:5/18180:

=============================================

NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 30 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 nmi_cpu_backtrace+0x274/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x300 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:161 [inline]
 __sys_info lib/sys_info.c:157 [inline]
 sys_info+0x135/0x170 lib/sys_info.c:165
 check_hung_uninterruptible_tasks kernel/hung_task.c:346 [inline]
 watchdog+0xfd9/0x1030 kernel/hung_task.c:515
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 7931 Comm: kworker/1:10 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: wg-kex-wg0 wg_packet_handshake_receive_worker
RIP: 0010:__in6_dev_get include/net/addrconf.h:347 [inline]
RIP: 0010:ip6_ignore_linkdown+0x16/0x140 include/net/addrconf.h:448
Code: 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 41 56 53 48 89 fb 49 be 00 00 00 00 00 fc ff df e8 2a 34 70 f7 <48> 81 c3 c0 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48
RSP: 0018:ffffc90000a082d8 EFLAGS: 00000246
RAX: ffffffff8a5553b6 RBX: ffff888058e7a000 RCX: ffff888034e00000
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff888058e7a000
RBP: 1ffff1100f94b919 R08: ffffc90000a08600 R09: ffffc90000a08610
R10: ffffc90000a08460 R11: fffff5200014108e R12: 0000000000000003
R13: ffff88807ca5c8c8 R14: dffffc0000000000 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888125566000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffd714f76d0 CR3: 000000004cec4000 CR4: 00000000003526f0
DR0: 0000000000000003 DR1: 00000000000001f8 DR2: 000000000000008e
DR3: 000000000000057a DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 find_match+0x9c/0xb40 net/ipv6/route.c:780
 __find_rr_leaf+0x248/0x760 net/ipv6/route.c:868
 find_rr_leaf net/ipv6/route.c:889 [inline]
 rt6_select net/ipv6/route.c:933 [inline]
 fib6_table_lookup+0x3b4/0xa80 net/ipv6/route.c:2246
 ip6_pol_route+0x228/0x13d0 net/ipv6/route.c:2282
 pol_lookup_func include/net/ip6_fib.h:617 [inline]
 fib6_rule_lookup+0x556/0x730 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2351 [inline]
 ip6_route_input+0x730/0xad0 net/ipv6/route.c:2654
 ip6_rcv_finish+0x141/0x2e0 net/ipv6/ip6_input.c:77
 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:318
 __netif_receive_skb_one_core net/core/dev.c:6149 [inline]
 __netif_receive_skb net/core/dev.c:6262 [inline]
 process_backlog+0x7dd/0x1950 net/core/dev.c:6614
 __napi_poll+0xae/0x340 net/core/dev.c:7678
 napi_poll net/core/dev.c:7741 [inline]
 net_rx_action+0x627/0xf70 net/core/dev.c:7893
 handle_softirqs+0x22a/0x870 kernel/softirq.c:622
 do_softirq+0x76/0xd0 kernel/softirq.c:523
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
 blake2s_compress+0xf9/0x1eb0 lib/crypto/x86/blake2s.h:42
 blake2s_final+0x116/0x260 lib/crypto/blake2s.c:142
 hmac+0x20c/0x3b0 drivers/net/wireguard/noise.c:325
 kdf drivers/net/wireguard/noise.c:367 [inline]
 message_ephemeral+0x255/0x310 drivers/net/wireguard/noise.c:493
 wg_noise_handshake_create_response+0x28a/0x9e0 drivers/net/wireguard/noise.c:692
 wg_packet_send_handshake_response+0x115/0x310 drivers/net/wireguard/send.c:94
 wg_receive_handshake_packet drivers/net/wireguard/receive.c:154 [inline]
 wg_packet_handshake_receive_worker+0x6a9/0x10c0 drivers/net/wireguard/receive.c:213
 process_one_work kernel/workqueue.c:3275 [inline]
 process_scheduled_works+0xb02/0x1830 kernel/workqueue.c:3358
 worker_thread+0xa50/0xfc0 kernel/workqueue.c:3439
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
net_ratelimit: 40151 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 32295 callbacks suppressed
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)

Crashes (436):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/18 22:45 upstream 2961f841b025 77d4d919 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2026/02/16 23:58 upstream 0f2acd3148e0 84656fa6 .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto INFO: task hung in nsim_destroy
2025/10/16 06:10 upstream 1f4a222b0e33 19568248 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nsim_destroy
2025/10/13 12:19 upstream 3a8660878839 ff1712fe .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in nsim_destroy
2025/09/27 20:21 upstream fec734e8d564 001c9061 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in nsim_destroy
2025/09/23 12:13 upstream cec1e6e5d1ab 0ac7291c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in nsim_destroy
2025/09/15 11:59 upstream f83ec76bf285 e2beed91 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in nsim_destroy
2025/07/25 15:18 upstream 2942242dde89 fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: task hung in nsim_destroy
2025/06/29 19:25 upstream dfba48a70cb6 fc9d8ee5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2025/05/20 18:09 upstream a5806cd506af 8f9cf946 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: task hung in nsim_destroy
2025/03/19 08:38 upstream 81e4f8d68c66 8d0a2921 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nsim_destroy
2025/03/07 01:19 upstream f315296c92fd 831e3629 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in nsim_destroy
2025/03/05 11:22 upstream 48a5eed9ad58 60f5d8d9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: task hung in nsim_destroy
2025/02/22 19:22 upstream ff202c5028a1 d34966d1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2025/02/14 19:32 upstream 128c8f96eb86 d9a046cf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2025/01/28 19:59 upstream 9c5968db9e62 f5427d7c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2025/01/15 23:10 upstream 619f0b6fad52 968edaf4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2025/01/03 00:46 upstream 0bc21e701a6f d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2024/12/24 18:00 upstream f07044dd0df0 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2024/12/18 06:37 upstream aef25be35d23 a0626d3a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nsim_destroy
2024/12/17 06:06 upstream f44d154d6e3d f93b2b55 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2024/12/05 20:52 upstream feffde684ac2 6e50d07b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2024/12/04 15:54 upstream feffde684ac2 b50eb251 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2024/11/30 14:02 upstream 2ba9f676d0a2 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nsim_destroy
2024/11/19 03:21 upstream c6d64479d609 571351cb .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nsim_destroy
2024/11/18 05:55 upstream f66d6acccbc0 cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nsim_destroy
2024/11/04 05:15 upstream a33ab3f94f51 f00eed24 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2024/10/29 19:21 upstream e42b1a9a2557 66aeb999 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: task hung in nsim_destroy
2024/10/26 02:19 upstream b423f5a9a61f 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2024/10/25 21:41 upstream b423f5a9a61f 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: task hung in nsim_destroy
2024/10/25 20:13 upstream b423f5a9a61f 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nsim_destroy
2024/10/25 06:37 upstream ae90f6a6170d c79b8ca5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: task hung in nsim_destroy
2024/05/31 10:43 upstream 4a4be1ad3a6e 34889ee3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: task hung in nsim_destroy
2024/05/26 22:01 upstream 6fbf71854e2d a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: task hung in nsim_destroy
2024/05/25 16:57 upstream 56fb6f92854f a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: task hung in nsim_destroy
2025/01/13 21:14 upstream c45323b7560e b1f1cd88 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 INFO: task hung in nsim_destroy
2024/12/09 16:17 upstream fac04efc5c79 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 INFO: task hung in nsim_destroy
2024/12/02 06:33 upstream e70140ba0d2b 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 INFO: task hung in nsim_destroy
2024/10/21 12:57 upstream 42f7652d3eb5 cd6fc0a3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 INFO: task hung in nsim_destroy
2025/03/14 16:16 net 4003c9e78778 e2826670 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nsim_destroy
2025/02/10 05:07 net 011b03359038 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nsim_destroy
2025/02/09 22:29 net 011b03359038 ef44b750 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nsim_destroy
2025/01/29 01:27 net b2aec4efe834 f5427d7c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nsim_destroy
2025/01/27 04:55 net 15a901361ec3 9fbd772e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nsim_destroy
2025/01/07 11:23 net 8c817eb26230 f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nsim_destroy
2024/12/01 09:31 net 16ed454515a4 68914665 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nsim_destroy
2024/10/23 10:58 net 34d35b4edbbe 15fa2979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: task hung in nsim_destroy
2025/01/19 06:33 net-next 41c5d104f338 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/11/17 05:09 net-next 38f83a57aa8e cfe3a04a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/10/28 19:22 net-next 6d858708d465 9efb3cc7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/10/28 17:18 net-next 6d858708d465 9efb3cc7 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/10/28 02:25 net-next 6d858708d465 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/10/25 17:28 net-next 6d858708d465 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/10/23 21:48 net-next 6d858708d465 15fa2979 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/10/21 23:36 net-next 6d858708d465 a93682b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/10/21 15:46 net-next 6d858708d465 a93682b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: task hung in nsim_destroy
2024/06/11 15:18 net-next 2ebb87f45b3c b7d9eb04 .config console log report info [disk image] [vmlinux] [kernel image] ci2-upstream-net-next-test-gce INFO: task hung in nsim_destroy
2024/10/15 04:01 linux-next 7f773fd61baa b01b6661 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: task hung in nsim_destroy
* Struck through repros no longer work on HEAD.