syzbot


INFO: task hung in fqdir_free_fn

Status: premoderation: reported on 2025/06/21 10:52
Reported-by: syzbot+b9e1fd3cc7a45f4a6fb6@syzkaller.appspotmail.com
First crash: 4d09h, last: 4d09h
Similar bugs (2)
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 INFO: task hung in fqdir_free_fn 1 336d 336d 0/3 auto-obsoleted due to no activity on 2024/11/01 18:36
upstream INFO: task hung in fqdir_free_fn net 4 230d 340d 0/29 auto-obsoleted due to no activity on 2025/02/05 05:14

Sample crash report:
INFO: task kworker/0:4:712 blocked for more than 122 seconds.
      Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:4     state:D stack:0     pid:712   tgid:712   ppid:2      flags:0x00004000
Workqueue: events fqdir_free_fn
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5924 [inline]
 __schedule+0x145b/0x1f10 kernel/sched/core.c:7750
 __schedule_loop kernel/sched/core.c:7831 [inline]
 schedule+0xc6/0x240 kernel/sched/core.c:7846
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:7903
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x836/0x1b60 kernel/locking/mutex.c:786
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1117
 mutex_lock+0x102/0x1c0 kernel/locking/mutex.c:270
 rcu_barrier+0x4d/0x530 kernel/rcu/tree.c:4574
 fqdir_free_fn+0x36/0x150 net/ipv4/inet_fragment.c:167
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d2/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc58/0x1250 kernel/workqueue.c:3400
 kthread+0x2c7/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task kworker/u8:4:24892 blocked for more than 122 seconds.
      Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u8:4    state:D stack:0     pid:24892 tgid:24892 ppid:2      flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5924 [inline]
 __schedule+0x145b/0x1f10 kernel/sched/core.c:7750
 __schedule_loop kernel/sched/core.c:7831 [inline]
 schedule+0xc6/0x240 kernel/sched/core.c:7846
 schedule_timeout+0xb2/0x3a0 kernel/time/timer.c:2595
 do_wait_for_common kernel/sched/completion.c:95 [inline]
 __wait_for_common kernel/sched/completion.c:116 [inline]
 wait_for_common+0x359/0x630 kernel/sched/completion.c:127
 wait_for_completion+0x1c/0x40 kernel/sched/completion.c:148
 rcu_barrier+0x415/0x530 kernel/rcu/tree.c:4642
 netdev_run_todo+0x10e/0xcb0 net/core/dev.c:10864
 rtnl_unlock+0x12/0x20 net/core/rtnetlink.c:152
 default_device_exit_batch+0x815/0x8a0 net/core/dev.c:12031
 ops_exit_list net/core/net_namespace.c:178 [inline]
 cleanup_net+0x72e/0xc70 net/core/net_namespace.c:642
 process_one_work kernel/workqueue.c:3238 [inline]
 process_scheduled_works+0x7d2/0x1020 kernel/workqueue.c:3319
 worker_thread+0xc58/0x1250 kernel/workqueue.c:3400
 kthread+0x2c7/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
INFO: task syz.2.10437:30912 blocked for more than 123 seconds.
      Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.10437     state:D stack:0     pid:30912 tgid:30912 ppid:25844  flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5924 [inline]
 __schedule+0x145b/0x1f10 kernel/sched/core.c:7750
 __schedule_loop kernel/sched/core.c:7831 [inline]
 schedule+0xc6/0x240 kernel/sched/core.c:7846
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:7903
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x836/0x1b60 kernel/locking/mutex.c:786
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1117
 mutex_lock+0x102/0x1c0 kernel/locking/mutex.c:270
 rcu_barrier+0x4d/0x530 kernel/rcu/tree.c:4574
 kvm_mmu_uninit_tdp_mmu+0x1df/0x210 arch/x86/kvm/mmu/tdp_mmu.c:51
 kvm_mmu_uninit_vm+0x27/0x60 arch/x86/kvm/mmu/mmu.c:6572
 kvm_arch_destroy_vm+0x383/0x410 arch/x86/kvm/x86.c:12892
 kvm_destroy_vm virt/kvm/kvm_main.c:1350 [inline]
 kvm_put_kvm+0xb04/0x12b0 virt/kvm/kvm_main.c:1386
 kvm_vm_release+0x47/0x70 virt/kvm/kvm_main.c:1409
 __fput+0x1fb/0xa00 fs/file_table.c:431
 ____fput+0x20/0x30 fs/file_table.c:459
 task_work_run+0x1e0/0x250 kernel/task_work.c:240
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x9b4/0x2630 kernel/exit.c:944
 do_group_exit+0x22a/0x300 kernel/exit.c:1094
 get_signal+0x139d/0x14f0 kernel/signal.c:2934
 arch_do_signal_or_restart+0x96/0x720 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x58/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x2515
RSP: 002b:00007f9a4817ef80 EFLAGS: 00000293 ORIG_RAX: 0000000000000000
RAX: 0000000000002000 RBX: 0000000000000000 RCX: 0000200000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000200010003
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000009 R15: 0000000000000004
 </TASK>
INFO: task syz.2.12246:3713 blocked for more than 126 seconds.
      Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.2.12246     state:D stack:0     pid:3713  tgid:3713  ppid:25844  flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5924 [inline]
 __schedule+0x145b/0x1f10 kernel/sched/core.c:7750
 __schedule_loop kernel/sched/core.c:7831 [inline]
 schedule+0xc6/0x240 kernel/sched/core.c:7846
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:7903
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x836/0x1b60 kernel/locking/mutex.c:786
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1117
 mutex_lock+0x102/0x1c0 kernel/locking/mutex.c:270
 rcu_barrier+0x4d/0x530 kernel/rcu/tree.c:4574
 netdev_run_todo+0x10e/0xcb0 net/core/dev.c:10864
 rtnl_unlock+0x12/0x20 net/core/rtnetlink.c:152
 tun_detach drivers/net/tun.c:704 [inline]
 tun_chr_close+0xc5/0x150 drivers/net/tun.c:3517
 __fput+0x1fb/0xa00 fs/file_table.c:431
 ____fput+0x20/0x30 fs/file_table.c:459
 task_work_run+0x1e0/0x250 kernel/task_work.c:240
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x9b4/0x2630 kernel/exit.c:944
 do_group_exit+0x22a/0x300 kernel/exit.c:1094
 get_signal+0x139d/0x14f0 kernel/signal.c:2934
 arch_do_signal_or_restart+0x96/0x720 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x58/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f9a4738e929
RSP: 002b:00007ffd972afff8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000d8fde RCX: 00007f9a4738e929
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f9a475b7ba0 R08: 0000000000000001 R09: 0000001e972b02ef
R10: 00007f9a47200000 R11: 0000000000000246 R12: 00007f9a475b5fac
R13: 00007f9a475b5fa0 R14: ffffffffffffffff R15: 00007ffd972b0110
 </TASK>
INFO: task syz.4.12262:3753 blocked for more than 127 seconds.
      Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.4.12262     state:D stack:0     pid:3753  tgid:3753  ppid:847    flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5924 [inline]
 __schedule+0x145b/0x1f10 kernel/sched/core.c:7750
 __schedule_loop kernel/sched/core.c:7831 [inline]
 schedule+0xc6/0x240 kernel/sched/core.c:7846
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:7903
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x836/0x1b60 kernel/locking/mutex.c:786
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1117
 mutex_lock+0x102/0x1c0 kernel/locking/mutex.c:270
 rcu_barrier+0x4d/0x530 kernel/rcu/tree.c:4574
 netdev_run_todo+0x10e/0xcb0 net/core/dev.c:10864
 rtnl_unlock+0x12/0x20 net/core/rtnetlink.c:152
 tun_detach drivers/net/tun.c:704 [inline]
 tun_chr_close+0xc5/0x150 drivers/net/tun.c:3517
 __fput+0x1fb/0xa00 fs/file_table.c:431
 ____fput+0x20/0x30 fs/file_table.c:459
 task_work_run+0x1e0/0x250 kernel/task_work.c:240
 resume_user_mode_work+0x36/0x50 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x64/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7fa929b8e929
RSP: 002b:00007ffee6860588 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000d9516 RCX: 00007fa929b8e929
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fa929db7ba0 R08: 0000000000000001 R09: 00000009e686087f
R10: 00007fa929a00000 R11: 0000000000000246 R12: 00007fa929db5fac
R13: 00007fa929db5fa0 R14: ffffffffffffffff R15: 00007ffee68606a0
 </TASK>
INFO: task syz.9.12281:3810 blocked for more than 127 seconds.
      Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.9.12281     state:D stack:0     pid:3810  tgid:3810  ppid:28927  flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5924 [inline]
 __schedule+0x145b/0x1f10 kernel/sched/core.c:7750
 __schedule_loop kernel/sched/core.c:7831 [inline]
 schedule+0xc6/0x240 kernel/sched/core.c:7846
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:7903
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x836/0x1b60 kernel/locking/mutex.c:786
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1117
 mutex_lock+0x102/0x1c0 kernel/locking/mutex.c:270
 rcu_barrier+0x4d/0x530 kernel/rcu/tree.c:4574
 kvm_mmu_uninit_tdp_mmu+0x1df/0x210 arch/x86/kvm/mmu/tdp_mmu.c:51
 kvm_mmu_uninit_vm+0x27/0x60 arch/x86/kvm/mmu/mmu.c:6572
 kvm_arch_destroy_vm+0x383/0x410 arch/x86/kvm/x86.c:12892
 kvm_destroy_vm virt/kvm/kvm_main.c:1350 [inline]
 kvm_put_kvm+0xb04/0x12b0 virt/kvm/kvm_main.c:1386
 kvm_vm_release+0x47/0x70 virt/kvm/kvm_main.c:1409
 __fput+0x1fb/0xa00 fs/file_table.c:431
 ____fput+0x20/0x30 fs/file_table.c:459
 task_work_run+0x1e0/0x250 kernel/task_work.c:240
 resume_user_mode_work+0x36/0x50 include/linux/resume_user_mode.h:50
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x64/0xb0 kernel/entry/common.c:218
 do_syscall_64+0x64/0xf0 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f750ed8e929
RSP: 002b:00007ffc14fe20f8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00000000000dcaad RCX: 00007f750ed8e929
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007f750efb7ba0 R08: 0000000000000001 R09: 0000001814fe23ef
R10: 00007f750ec00000 R11: 0000000000000246 R12: 00007f750efb5fac
R13: 00007f750efb5fa0 R14: ffffffffffffffff R15: 00007ffc14fe2210
 </TASK>
INFO: task syz.1.12287:3831 blocked for more than 128 seconds.
      Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz.1.12287     state:D stack:0     pid:3831  tgid:3830  ppid:32519  flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5924 [inline]
 __schedule+0x145b/0x1f10 kernel/sched/core.c:7750
 __schedule_loop kernel/sched/core.c:7831 [inline]
 schedule+0xc6/0x240 kernel/sched/core.c:7846
 schedule_preempt_disabled+0x14/0x30 kernel/sched/core.c:7903
 __mutex_lock_common kernel/locking/mutex.c:692 [inline]
 __mutex_lock+0x836/0x1b60 kernel/locking/mutex.c:786
 __mutex_lock_slowpath+0xe/0x20 kernel/locking/mutex.c:1117
 mutex_lock+0x102/0x1c0 kernel/locking/mutex.c:270
 rcu_barrier+0x4d/0x530 kernel/rcu/tree.c:4574
 setup_net+0x8cf/0x990 net/core/net_namespace.c:394
 copy_net_ns+0x513/0xa30 net/core/net_namespace.c:510
 create_new_namespaces+0x3b5/0x720 kernel/nsproxy.c:110
 copy_namespaces+0x25d/0x2b0 kernel/nsproxy.c:179
 copy_process+0x126d/0x3220 kernel/fork.c:2408
 kernel_clone+0x23f/0x830 kernel/fork.c:2818
 __do_sys_clone kernel/fork.c:2963 [inline]
 __se_sys_clone kernel/fork.c:2947 [inline]
 __x64_sys_clone+0x18c/0x1f0 kernel/fork.c:2947
 x64_sys_call+0x2b3c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:57
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x58/0xf0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7ff96c38e929
RSP: 002b:00007ff96d2a1fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ff96c5b5fa0 RCX: 00007ff96c38e929
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000640c7000
RBP: 00007ff96c410b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007ff96c5b5fa0 R15: 00007fff96e88348
 </TASK>
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 37 Comm: khungtaskd Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0 f1acc3ef52b3e732a05c4f7a2560722db90bb473
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:94
 dump_stack_lvl+0x10c/0x190 lib/dump_stack.c:120
 dump_stack+0x19/0x20 lib/dump_stack.c:129
 nmi_cpu_backtrace+0x2bf/0x2d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x142/0x2c0 lib/nmi_backtrace.c:62
 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:41
 trigger_all_cpu_backtrace include/linux/nmi.h:158 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:229 [inline]
 watchdog+0xd8f/0xed0 kernel/hung_task.c:385
 kthread+0x2c7/0x370 kernel/kthread.c:389
 ret_from_fork+0x64/0xa0 arch/x86/kernel/process.c:153
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 98 Comm: klogd Not tainted 6.12.23-syzkaller-gd9fd901baa98 #0 f1acc3ef52b3e732a05c4f7a2560722db90bb473
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
RIP: 0010:update_stack_state+0x55/0x4b0 arch/x86/kernel/unwind_frame.c:205
Code: 48 89 45 b8 42 0f b6 04 28 84 c0 0f 85 03 04 00 00 8b 03 89 45 ac 48 8d 7b 58 48 89 f8 48 c1 e8 03 48 89 45 98 42 80 3c 28 00 <48> 89 7d c8 74 09 e8 e0 82 97 00 48 8b 7d c8 48 8b 07 48 85 c0 74
RSP: 0018:ffffc90000def098 EFLAGS: 00000246
RAX: 1ffff920001bde48 RBX: ffffc90000def1e8 RCX: 1ffff920001bde00
RDX: dffffc0000000000 RSI: ffffc90000def310 RDI: ffffc90000def240
RBP: ffffc90000def158 R08: ffffc90000def2b0 R09: ffffc90000def2a8
R10: 0000000000000000 R11: ffffffff8173e5d0 R12: 0000000000000000
R13: dffffc0000000000 R14: ffffc90000def240 R15: ffffc90000def310
FS:  00007f500529fc80(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4bc79b6038 CR3: 000000010bb66000 CR4: 00000000003526b0
DR0: 0000000000000007 DR1: 000000000000000b DR2: 0000000000000004
DR3: 0000000000000002 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 unwind_next_frame+0x3c2/0x750 arch/x86/kernel/unwind_frame.c:315
 arch_stack_walk+0x139/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x9d/0xe0 kernel/stacktrace.c:122
 save_stack+0xf8/0x1f0 mm/page_owner.c:174
 __reset_page_owner+0x79/0x450 mm/page_owner.c:315
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1319 [inline]
 free_unref_page+0xa17/0xcf0 mm/page_alloc.c:2806
 __free_pages+0x6b/0x3b0 mm/page_alloc.c:5271
 __free_slab+0xbf/0x120 mm/slub.c:2729
 free_slab+0x18/0xf0 mm/slub.c:2752
 discard_slab mm/slub.c:2758 [inline]
 __put_partials+0x11b/0x150 mm/slub.c:3227
 put_cpu_partial+0x91/0xc0 mm/slub.c:3302
 __slab_free+0x1d3/0x2b0 mm/slub.c:4535
 do_slab_free mm/slub.c:4617 [inline]
 ___cache_free+0xc9/0xe0 mm/slub.c:4726
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0xb5/0x130 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x14f/0x180 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x28/0x90 mm/kasan/common.c:329
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4167 [inline]
 slab_alloc_node mm/slub.c:4216 [inline]
 kmem_cache_alloc_node_noprof+0x139/0x3b0 mm/slub.c:4270
 __alloc_skb+0x10c/0x370 net/core/skbuff.c:677
 alloc_skb include/linux/skbuff.h:1331 [inline]
 alloc_skb_with_frags+0xce/0x8b0 net/core/skbuff.c:6622
 sock_alloc_send_pskb+0x858/0x990 net/core/sock.c:2897
 unix_dgram_sendmsg+0x59a/0x1b70 net/unix/af_unix.c:2027
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x66a/0x6f0 net/socket.c:2217
 __do_sys_sendto net/socket.c:2229 [inline]
 __se_sys_sendto net/socket.c:2225 [inline]
 __x64_sys_sendto+0xe9/0x100 net/socket.c:2225
 x64_sys_call+0x2c2c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:45
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x58/0xf0 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f50053ef407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff3715a410 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f500529fc80 RCX: 00007f50053ef407
RDX: 0000000000000047 RSI: 00007fff3715a550 RDI: 0000000000000003
RBP: 00007fff3715a980 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000004000 R11: 0000000000000202 R12: 00007fff3715a998
R13: 00007fff3715a550 R14: 000000000000002c R15: 00007fff3715a550
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/06/21 10:51 android16-6.12 d9fd901baa98 d6cdfb8a .config console log report info [disk image] [vmlinux] [kernel image] ci2-android-6-12-rust INFO: task hung in fqdir_free_fn
* Struck through repros no longer work on HEAD.