BUG: soft lockup in cleanup_net (2)

Status: premoderation: reported on 2026/10/15 01:53
Reported-by: syzbot+ac16d962506e4d979688@syzkaller.appspotmail.com
First crash: 3d01h, last: 3d01h
▶ ▼ Similar bugs (12)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-10 BUG: soft lockup in cleanup_net 1 1 527d 527d 0/2 auto-obsoleted due to no activity on 2025/08/06 14:41
linux-4.19 INFO: rcu detected stall in cleanup_net (2) 1 4 1938d 2070d 0/1 auto-closed as invalid on 2021/10/25 03:43
linux-4.19 BUG: soft lockup in cleanup_net (2) 1 syz, C 3 1322d 1434d 0/1 upstream: reported C repro on 2022/11/13 07:04
android-5-15 BUG: soft lockup in cleanup_net origin:lts 1 syz 6 768d 895d 0/2 auto-obsoleted due to no activity on 2024/12/08 05:58
android-6-1 BUG: soft lockup in cleanup_net 1 1 638d 638d 0/2 auto-obsoleted due to no activity on 2025/04/17 10:35
linux-4.19 BUG: soft lockup in cleanup_net 1 4 1568d 1781d 0/1 auto-obsoleted due to no activity on 2022/10/30 18:15
upstream INFO: rcu detected stall in cleanup_net (8) prio:normal kernfs 1 syz, C error inconclusive 37 48d 277d 0/29 upstream: reported C repro on 2026/01/13 16:49
upstream INFO: rcu detected stall in cleanup_net (6) net 1 63 1136d 1379d 0/29 closed as invalid on 2023/10/27 14:39
upstream INFO: rcu detected stall in cleanup_net (5) net 1 24 1717d 1977d 0/29 closed as invalid on 2022/02/08 10:00
linux-6.1 INFO: rcu detected stall in cleanup_net origin:lts-only 1 syz inconclusive 143 238d 1193d 0/3 upstream: reported syz repro on 2023/07/12 14:45
upstream INFO: rcu detected stall in cleanup_net (7) kernfs rdma bridge 1 15 689d 1066d 0/29 auto-obsoleted due to no activity on 2025/02/25 20:50
linux-5.15 INFO: rcu detected stall in cleanup_net origin:lts-only 1 syz, C inconclusive 203 19d 1194d 0/3 upstream: reported C repro on 2023/07/11 05:04

Sample crash report:
watchdog: BUG: soft lockup - CPU#0 stuck for 5s! [kworker/u4:0:7]
Modules linked in:
CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: netns cleanup_net
RIP: 0010:check_kcov_mode kernel/kcov.c:165 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x36/0x60 kernel/kcov.c:188
Code: b0 b6 9d 7e 65 8b 15 b5 b6 9d 7e f7 c2 00 01 ff 00 74 11 f7 c2 00 01 00 00 74 35 83 b9 dc 0a 00 00 00 74 2c 8b 91 b8 0a 00 00 <83> fa 02 75 21 48 8b 91 c0 0a 00 00 48 8b 32 48 8d 7e 01 8b 89 bc
RSP: 0018:ffffc90000077bc8 EFLAGS: 00000246
RAX: ffffffff8259b0a2 RBX: 000000000509e9cd RCX: ffff88810024bc00
RDX: 0000000000000000 RSI: 000000000509e9cd RDI: ffff88810c591900
RBP: ffffc90000077bc8 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200000ef70 R12: 000000000509e9cd
R13: 1ffff110218b2323 R14: ffff88810c591900 R15: ffff888122b04900
FS:  0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbe963a9060 CR3: 000000010dd34000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 idr_find+0x12/0x60 lib/idr.c:175
 tipc_topsrv_stop net/tipc/topsrv.c:700 [inline]
 tipc_topsrv_exit_net+0x114/0x380 net/tipc/topsrv.c:727
 ops_exit_list net/core/net_namespace.c:185 [inline]
 cleanup_net+0x589/0xb80 net/core/net_namespace.c:609
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 16143 Comm: kworker/u4:8 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Workqueue: tipc_rcv tipc_conn_recv_work
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:434 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x5a4/0xb80 kernel/locking/qspinlock.c:508
Code: 8b 44 24 20 c6 00 00 48 8b 44 24 10 42 0f b6 04 38 84 c0 0f 85 c0 01 00 00 48 8d 43 01 c6 00 01 41 bd 00 80 ff ff eb 07 f3 90 <41> ff c5 74 4a 43 0f b6 04 3e 84 c0 75 2e 80 3b 00 75 eb 48 89 df
RSP: 0018:ffffc90000f4f940 EFLAGS: 00000206
RAX: 0000000000000000 RBX: ffff88810c591918 RCX: ffffffff814bea54
RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff88810c591918
RBP: ffffc90000f4fa30 R08: ffff88810c591918 R09: 1ffff110218b2323
R10: dffffc0000000000 R11: ffffed10218b2324 R12: ffff88823ff92900
R13: 00000000ffffde74 R14: 1ffff110218b2323 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f065dc222f8 CR3: 000000011850d000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:554 [inline]
 queued_spin_lock_slowpath+0x47/0x50 arch/x86/include/asm/qspinlock.h:51
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock include/linux/spinlock.h:184 [inline]
 __raw_spin_lock_bh include/linux/spinlock_api_smp.h:136 [inline]
 _raw_spin_lock_bh+0xe4/0xf0 kernel/locking/spinlock.c:175
 spin_lock_bh include/linux/spinlock.h:360 [inline]
 tipc_conn_kref_release net/tipc/topsrv.c:129 [inline]
 kref_put include/linux/kref.h:65 [inline]
 conn_put+0x78/0x320 net/tipc/topsrv.c:147
 tipc_conn_recv_work+0x42f/0x4a0 net/tipc/topsrv.c:432
 process_one_work+0x6fd/0xbc0 kernel/workqueue.c:2301
 worker_thread+0xa8e/0x13c0 kernel/workqueue.c:2447
 kthread+0x324/0x3b0 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/15 01:53 android13-5.10-lts 390db4f54a67 8fb0ae89 .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-5-10 BUG: soft lockup in cleanup_net
* Struck through repros no longer work on HEAD.