syzbot
BUG: soft lockup in cleanup_net (2)
Status:
premoderation: reported on 2026/10/15 01:53
Reported-by: syzbot+ac16d962506e4d979688@syzkaller.appspotmail.com
First crash: 3d01h, last: 3d01h
Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 5s! [kworker/u4:0:7]
Modules linked in:
CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: netns cleanup_net
RIP: 0010:check_kcov_mode kernel/kcov.c:165 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60 kernel/kcov.c:188
Code: b0 b6 9d 7e 65 8b 15 b5 b6 9d 7e f7 c2 00 01 ff 00 74 11 f7 c2 00 01 00 00 74 35 83 b9 dc 0a 00 00 00 74 2c 8b 91 b8 0a 00 00 <83> fa 02 75 21 48 8b 91 c0 0a 00 00 48 8b 32 48 8d 7e 01 8b 89 bc
RSP: 0018:ffffc90000077bc8 EFLAGS: 00000246
RAX: ffffffff8259b0a2 RBX: 000000000509e9cd RCX: ffff88810024bc00
RDX: 0000000000000000 RSI: 000000000509e9cd RDI: ffff88810c591900
RBP: ffffc90000077bc8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200000ef70 R12: 000000000509e9cd
R13: 1ffff110218b2323 R14: ffff88810c591900 R15: ffff888122b04900
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe963a9060 CR3: 000000010dd34000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
idr_find+0x12/0x60 lib/idr.c:175
tipc_topsrv_stop net/tipc/topsrv.c:700 [inline]
tipc_topsrv_exit_net+0x114/0x380 net/tipc/topsrv.c:727
ops_exit_list net/core/net_namespace.c:185 [inline]
cleanup_net+0x589/0xb80 net/core/net_namespace.c:609
process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
kthread+0x324/0x3b0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 16143 Comm: kworker/u4:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: tipc_rcv tipc_conn_recv_work
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:434 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x5a4/0xb80 kernel/locking/qspinlock.c:508
Code: 8b 44 24 20 c6 00 00 48 8b 44 24 10 42 0f b6 04 38 84 c0 0f 85 c0 01 00 00 48 8d 43 01 c6 00 01 41 bd 00 80 ff ff eb 07 f3 90 <41> ff c5 74 4a 43 0f b6 04 3e 84 c0 75 2e 80 3b 00 75 eb 48 89 df
RSP: 0018:ffffc90000f4f940 EFLAGS: 00000206
RAX: 0000000000000000 RBX: ffff88810c591918 RCX: ffffffff814bea54
RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff88810c591918
RBP: ffffc90000f4fa30 R08: ffff88810c591918 R09: 1ffff110218b2323
R10: dffffc0000000000 R11: ffffed10218b2324 R12: ffff88823ff92900
R13: 00000000ffffde74 R14: 1ffff110218b2323 R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f065dc222f8 CR3: 000000011850d000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:554 [inline]
queued_spin_lock_slowpath+0x47/0x50 arch/x86/include/asm/qspinlock.h:51
queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
do_raw_spin_lock include/linux/spinlock.h:184 [inline]
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
_raw_spin_lock_bh+0xe4/0xf0 kernel/locking/spinlock.c:175
spin_lock_bh include/linux/spinlock.h:360 [inline]
tipc_conn_kref_release net/tipc/topsrv.c:129 [inline]
kref_put include/linux/kref.h:65 [inline]
conn_put+0x78/0x320 net/tipc/topsrv.c:147
tipc_conn_recv_work+0x42f/0x4a0 net/tipc/topsrv.c:432
process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
kthread+0x324/0x3b0 kernel/kthread.c:313
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
* Struck through repros no longer work on HEAD.