syzbot


INFO: task hung in nmi_cpu_backtrace

Status: premoderation: reported on 2025/07/28 05:35
Reported-by: syzbot+84f0be7c2107fef842bb@syzkaller.appspotmail.com
First crash: 111d, last: 16d
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: task hung in nmi_cpu_backtrace fs 1 7 2691d 2689d 0/29 auto-closed as invalid on 2019/02/22 10:26
upstream INFO: task hung in nmi_cpu_backtrace (3) block serial 1 3 453d 468d 0/29 auto-obsoleted due to no activity on 2024/11/17 17:25
android-49 INFO: task hung in nmi_cpu_backtrace 1 3 2659d 2835d 0/3 auto-closed as invalid on 2019/02/22 13:59
upstream INFO: task hung in nmi_cpu_backtrace (2) serial 1 1 768d 768d 0/29 auto-obsoleted due to no activity on 2024/01/08 02:36
upstream INFO: task hung in nmi_cpu_backtrace (4) nfs 1 5 203d 309d 0/29 auto-obsoleted due to no activity on 2025/07/25 14:14
linux-4.14 INFO: task hung in nmi_cpu_backtrace 1 1 2144d 2144d 0/1 auto-closed as invalid on 2020/05/02 01:19

Sample crash report:
INFO: task syz.3.373:1590 blocked for more than 122 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 37 Comm: khungtaskd Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x10c/0x190 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 nmi_cpu_backtrace+0x2bf/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:267 [inline]
 watchdog+0xd8f/0xed0 kernel/hung_task.c:423
 kthread+0x2ca/0x370 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 17 Comm: ksoftirqd/0 Not tainted syzkaller #0 0b5ffdee5fcd2f7749818d1ff954e9c21353764e
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:refcount_read include/linux/refcount.h:170 [inline]
RIP: 0010:skb_shared include/linux/skbuff.h:2061 [inline]
RIP: 0010:skb_share_check include/linux/skbuff.h:2080 [inline]
RIP: 0010:ip6_rcv_core+0x1b2/0x1300 net/ipv6/ip6_input.c:169
Code: 00 00 8b 43 70 65 49 01 46 10 4c 8d a3 f4 00 00 00 4c 89 e7 be 04 00 00 00 e8 3a b9 f9 fc 4c 89 e0 48 c1 e8 03 42 0f b6 04 38 <84> c0 0f 85 13 0d 00 00 45 8b 34 24 bf 01 00 00 00 44 89 f6 e8 05
RSP: 0018:ffffc900001172e8 EFLAGS: 00000a03
RAX: 0000000000000000 RBX: ffff8881219f0640 RCX: ffffffff84e2b5c6
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff8881219f0734
RBP: ffffc90000117390 R08: ffff8881219f0737 R09: 1ffff1102433e0e6
R10: dffffc0000000000 R11: ffffed102433e0e7 R12: ffff8881219f0734
R13: ffff888129894958 R14: 0000607e08e0f568 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcca8e9c18 CR3: 000000015eeec000 CR4: 00000000003526b0
Call Trace:
 <TASK>
 ipv6_rcv+0xce/0x220 net/ipv6/ip6_input.c:306
 __netif_receive_skb_one_core net/core/dev.c:5769 [inline]
 __netif_receive_skb net/core/dev.c:5882 [inline]
 netif_receive_skb_internal net/core/dev.c:5968 [inline]
 netif_receive_skb+0x147/0x7b0 net/core/dev.c:6027
 br_netif_receive_skb net/bridge/br_input.c:30 [inline]
 NF_HOOK include/linux/netfilter.h:317 [inline]
 br_pass_frame_up+0x126/0x1c0 net/bridge/br_input.c:70
 br_handle_frame_finish+0x12d9/0x1720 net/bridge/br_input.c:221
 nf_hook_bridge_pre net/bridge/br_input.c:301 [inline]
 br_handle_frame+0x5a6/0xba0 net/bridge/br_input.c:424
 __netif_receive_skb_core+0xf4b/0x3940 net/core/dev.c:5663
 __netif_receive_skb_one_core net/core/dev.c:5767 [inline]
 __netif_receive_skb net/core/dev.c:5882 [inline]
 process_backlog+0x3e5/0xae0 net/core/dev.c:6218
 __napi_poll+0xd3/0x610 net/core/dev.c:6869
 napi_poll net/core/dev.c:6938 [inline]
 net_rx_action+0x584/0xce0 net/core/dev.c:7060
 handle_softirqs+0x1ab/0x630 kernel/softirq.c:621
 run_ksoftirqd+0x20/0x30 kernel/softirq.c:999
 smpboot_thread_fn+0x493/0x8c0 kernel/smpboot.c:164
 kthread+0x2ca/0x370 kernel/kthread.c:389
 ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
net_ratelimit: 70955 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
net_ratelimit: 74643 callbacks suppressed
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:3a:77:d3:48:02:a9, vlan:0)

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/10/30 20:58 android16-6.12 0d6730ee6542 2c50b6a9 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust INFO: task hung in nmi_cpu_backtrace
2025/10/24 16:15 android16-6.12 0d6730ee6542 c0460fcd .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust INFO: task hung in nmi_cpu_backtrace
2025/07/28 05:34 android16-6.12 e9bbc29c066a fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust INFO: task hung in nmi_cpu_backtrace
* Struck through repros no longer work on HEAD.