syzbot

 sign-in | mailing list | source | docs
🐞 Open [825]
🐞 Fixed [84]
🐞 Invalid [1053]
⬇ Missing Backports [127]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

INFO: task hung in addrconf_dad_work

Status: upstream: reported C repro on 2024/01/20 08:09
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+ccc611a0c79fb895b37f@syzkaller.appspotmail.com
First crash: 639d, last: 26d
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2025/09/27 upstream (ToT) fec734e8d564 C [report] INFO: task hung in exit_mmap
▶ ▼ Similar bugs (14)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.1 INFO: task hung in addrconf_dad_work (2) 1 67 398d 604d 0/3 auto-obsoleted due to no activity on 2024/11/26 11:15
android-414 INFO: task hung in addrconf_dad_work 1 1 2325d 2325d 0/1 auto-closed as invalid on 2019/10/25 08:37
upstream INFO: task hung in addrconf_dad_work (5) net 1 C done 1571 23h23m 448d 0/29 upstream: reported C repro on 2024/07/29 15:23
android-49 INFO: task hung in addrconf_dad_work 1 1 2612d 2612d 0/3 auto-closed as invalid on 2019/02/22 20:09
upstream INFO: task hung in addrconf_dad_work (2) net 1 C unreliable error 107 698d 1052d 0/29 closed as invalid on 2023/11/23 17:05
linux-6.1 INFO: task hung in addrconf_dad_work (4) origin:upstream missing-backport 1 syz 2 121d 144d 0/3 upstream: reported syz repro on 2025/05/29 09:13
linux-6.1 INFO: task hung in addrconf_dad_work 1 2 887d 917d 0/3 auto-obsoleted due to no activity on 2023/08/26 05:16
upstream INFO: task hung in addrconf_dad_work net 1 C inconclusive inconclusive 468 1398d 2438d 0/29 closed as invalid on 2022/02/08 10:54
upstream INFO: task hung in addrconf_dad_work (3) net 1 C 185 587d 629d 25/29 fixed on 2024/03/25 23:45
linux-6.1 INFO: task hung in addrconf_dad_work (3) 1 2 257d 289d 0/3 auto-obsoleted due to no activity on 2025/05/16 13:56
linux-4.19 INFO: task hung in addrconf_dad_work 1 1 2247d 2247d 0/1 auto-closed as invalid on 2019/12/24 18:36
linux-4.19 INFO: task hung in addrconf_dad_work (2) 1 C error 72 965d 2038d 0/1 upstream: reported C repro on 2020/03/22 17:39
linux-4.14 INFO: task hung in addrconf_dad_work 1 C inconclusive 1 1213d 1819d 0/1 upstream: reported C repro on 2020/10/27 17:48
upstream INFO: task hung in addrconf_dad_work (4) net 1 2632 468d 519d 26/29 fixed on 2024/07/09 19:14
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2025/10/09 16:24 14m retest repro linux-5.15.y report log
2025/10/09 16:24 12m retest repro linux-5.15.y report log
2025/08/14 23:40 13m retest repro linux-5.15.y report log
2025/05/06 14:30 15m retest repro linux-5.15.y report log
2025/01/31 09:33 15m retest repro linux-5.15.y report log
▶ ▼ Fix bisection attempts (2)
Created Duration User Patch Repo Result
2025/06/04 21:01 1h37m bisect fix linux-5.15.y OK (0) job log log
2025/02/23 18:42 2h34m bisect fix linux-5.15.y OK (0) job log log

Sample crash report:
INFO: task kworker/0:0:7 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/0:0     state:D stack:25312 pid:    7 ppid:     2 flags:0x00004000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xc71/0x2390 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 addrconf_dad_work+0xc4/0x1520 net/ipv6/addrconf.c:4110
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/u4:2:154 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:2    state:D stack:25504 pid:  154 ppid:     2 flags:0x00004000
Workqueue: events_unbound linkwatch_event
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xc71/0x2390 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 linkwatch_event+0xa/0x50 net/core/link_watch.c:251
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task kworker/u4:4:1275 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/u4:4    state:D stack:25000 pid: 1275 ppid:     2 flags:0x00004000
Workqueue: netns cleanup_net
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xc71/0x2390 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 netdev_run_todo+0x86b/0xa40 net/core/dev.c:10696
 ip6gre_exit_batch_net+0x44a/0x490 net/ipv6/ip6_gre.c:1651
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x77b/0xb80 net/core/net_namespace.c:635
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
INFO: task dhcpcd:3854 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:dhcpcd          state:D stack:21376 pid: 3854 ppid:  3853 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 percpu_rwsem_wait+0x2d8/0x310 kernel/locking/percpu-rwsem.c:160
 __percpu_down_read+0xc9/0x100 kernel/locking/percpu-rwsem.c:174
 percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
 cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:724 [inline]
 cgroup_css_set_fork kernel/cgroup/cgroup.c:6196 [inline]
 cgroup_can_fork+0xc94/0xda0 kernel/cgroup/cgroup.c:6314
 copy_process+0x2290/0x3e00 kernel/fork.c:2382
 kernel_clone+0x219/0x930 kernel/fork.c:2679
 __do_sys_clone kernel/fork.c:2796 [inline]
 __se_sys_clone kernel/fork.c:2780 [inline]
 __x64_sys_clone+0x170/0x1c0 kernel/fork.c:2780
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fc84a08b636
RSP: 002b:00007ffcd6db0ac0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007ffcd6db0ac8 RCX: 00007fc84a08b636
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffcd6dd1010 R08: 0000000000000000 R09: 0000000000000001
R10: 00007fc849fb7a10 R11: 0000000000000246 R12: 00007ffcd6db0c00
R13: 0000000000000000 R14: 0000000000000000 R15: 000055dce0e3dac0
 </TASK>
INFO: task udevd:4213 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd           state:D stack:27200 pid: 4213 ppid:  3561 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 percpu_rwsem_wait+0x2d8/0x310 kernel/locking/percpu-rwsem.c:160
 __percpu_down_read+0xc9/0x100 kernel/locking/percpu-rwsem.c:174
 percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
 cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:724 [inline]
 exit_signals+0x3e5/0x510 kernel/signal.c:2991
 do_exit+0x256/0x20a0 kernel/exit.c:830
 do_group_exit+0x12e/0x300 kernel/exit.c:997
 __do_sys_exit_group kernel/exit.c:1008 [inline]
 __se_sys_exit_group kernel/exit.c:1006 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1006
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd21f0b36c5
RSP: 002b:00007fffb6b79a78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00005556bfa36f80 RCX: 00007fd21f0b36c5
RDX: 00000000000000e7 RSI: fffffffffffffe68 RDI: 0000000000000000
RBP: 00005556bfa12910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffb6b79ac0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
INFO: task udevd:4215 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd           state:D stack:26368 pid: 4215 ppid:  3561 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 percpu_rwsem_wait+0x2d8/0x310 kernel/locking/percpu-rwsem.c:160
 __percpu_down_read+0xc9/0x100 kernel/locking/percpu-rwsem.c:174
 percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
 cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:724 [inline]
 exit_signals+0x3e5/0x510 kernel/signal.c:2991
 do_exit+0x256/0x20a0 kernel/exit.c:830
 do_group_exit+0x12e/0x300 kernel/exit.c:997
 __do_sys_exit_group kernel/exit.c:1008 [inline]
 __se_sys_exit_group kernel/exit.c:1006 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1006
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd21f0b36c5
RSP: 002b:00007fffb6b79a78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00005556bfa37970 RCX: 00007fd21f0b36c5
RDX: 00000000000000e7 RSI: fffffffffffffe68 RDI: 0000000000000000
RBP: 00005556bfa12910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffb6b79ac0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:4328 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21792 pid: 4328 ppid:  4324 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xc71/0x2390 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 rtnl_lock net/core/rtnetlink.c:72 [inline]
 rtnetlink_rcv_msg+0x974/0xe60 net/core/rtnetlink.c:5647
 netlink_rcv_skb+0x1e0/0x430 net/netlink/af_netlink.c:2507
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x774/0x920 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x8ab/0xbc0 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:704 [inline]
 __sock_sendmsg net/socket.c:716 [inline]
 __sys_sendto+0x423/0x580 net/socket.c:2063
 __do_sys_sendto net/socket.c:2075 [inline]
 __se_sys_sendto net/socket.c:2071 [inline]
 __x64_sys_sendto+0xda/0xf0 net/socket.c:2071
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f60d7c4ad5c
RSP: 002b:00007ffd6ebbd060 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f60d89ce620 RCX: 00007f60d7c4ad5c
RDX: 000000000000002c RSI: 00007f60d89ce670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffd6ebbd0b4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f60d89ce670 R15: 0000000000000000
 </TASK>
INFO: task udevd:4329 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:udevd           state:D stack:27328 pid: 4329 ppid:  3561 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 percpu_rwsem_wait+0x2d8/0x310 kernel/locking/percpu-rwsem.c:160
 __percpu_down_read+0xc9/0x100 kernel/locking/percpu-rwsem.c:174
 percpu_down_read include/linux/percpu-rwsem.h:65 [inline]
 cgroup_threadgroup_change_begin include/linux/cgroup-defs.h:724 [inline]
 exit_signals+0x3e5/0x510 kernel/signal.c:2991
 do_exit+0x256/0x20a0 kernel/exit.c:830
 do_group_exit+0x12e/0x300 kernel/exit.c:997
 __do_sys_exit_group kernel/exit.c:1008 [inline]
 __se_sys_exit_group kernel/exit.c:1006 [inline]
 __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:1006
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fd21f0b36c5
RSP: 002b:00007fffb6b79a78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00005556bfa3caa0 RCX: 00007fd21f0b36c5
RDX: 00000000000000e7 RSI: fffffffffffffe68 RDI: 0000000000000000
RBP: 00005556bfa12910 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffb6b79ac0 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:4331 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:18344 pid: 4331 ppid:  4326 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 rwsem_down_write_slowpath+0xc46/0x11f0 kernel/locking/rwsem.c:1165
 mmap_write_lock include/linux/mmap_lock.h:71 [inline]
 mpol_rebind_mm+0x33/0x2c0 mm/mempolicy.c:381
 cpuset_attach+0x330/0x5f0 kernel/cgroup/cpuset.c:2376
 cgroup_migrate_execute+0x7eb/0x1010 kernel/cgroup/cgroup.c:2574
 cgroup_attach_task+0x562/0x7e0 kernel/cgroup/cgroup.c:2869
 __cgroup1_procs_write+0x2e5/0x3f0 kernel/cgroup/cgroup-v1.c:527
 cgroup_file_write+0x2f7/0x630 kernel/cgroup/cgroup.c:3943
 kernfs_fop_write_iter+0x379/0x4c0 fs/kernfs/file.c:296
 call_write_iter include/linux/fs.h:2172 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x712/0xd00 fs/read_write.c:594
 ksys_write+0x14d/0x250 fs/read_write.c:647
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fc42510497f
RSP: 002b:00007ffcd713feb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007fc42510497f
RDX: 0000000000000001 RSI: 00007ffcd713ff00 RDI: 0000000000000003
RBP: 00007ffcd7140470 R08: 0000000000000000 R09: 00007ffcd713fd07
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001
R13: 00007ffcd713ff00 R14: 00007ffcd7140430 R15: 00007ffcd7140470
 </TASK>
INFO: task kworker/1:5:4398 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:kworker/1:5     state:D stack:25288 pid: 4398 ppid:     2 flags:0x00004000
Workqueue: ipv6_addrconf addrconf_dad_work
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11bb/0x4390 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_preempt_disabled+0xf/0x20 kernel/sched/core.c:6537
 __mutex_lock_common+0xc71/0x2390 kernel/locking/mutex.c:669
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 addrconf_dad_work+0xc4/0x1520 net/ipv6/addrconf.c:4110
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Showing all locks held in the system:
1 lock held by kthreadd/2:
 #0: ffffffff8c1420f0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x2290/0x3e00 kernel/fork.c:2382
3 locks held by kworker/0:0/7:
 #0: ffff88814c11f138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
 #1: ffffc90000cc7d00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
 #2: ffffffff8d238048 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1520 net/ipv6/addrconf.c:4110
3 locks held by kworker/1:1/23:
 #0: ffff888016871938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
 #1: ffffc90000ddfd00 ((reg_check_chans).work){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
 #2: ffffffff8d238048 (rtnl_mutex){+.+.}-{3:3}, at: reg_check_chans_work+0x81/0xa50 net/wireless/reg.c:2437
1 lock held by khungtaskd/27:
 #0: ffffffff8c11c660 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire+0x0/0x30
3 locks held by kworker/u4:2/154:
 #0: ffff888016879138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
 #1: ffffc90002017d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
 #2: ffffffff8d238048 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xa/0x50 net/core/link_watch.c:251
4 locks held by kworker/u4:4/1275:
 #0: ffff8880169cd938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
 #1: ffffc90004fdfd00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
 #2: ffffffff8d22c3d0 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x132/0xb80 net/core/net_namespace.c:589
 #3: ffffffff8d238048 (rtnl_mutex){+.+.}-{3:3}, at: netdev_run_todo+0x86b/0xa40 net/core/dev.c:10696
1 lock held by dhcpcd/3854:
 #0: ffffffff8c1420f0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: copy_process+0x2290/0x3e00 kernel/fork.c:2382
2 locks held by getty/3949:
 #0: ffff88814cd38098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x21/0x70 drivers/tty/tty_ldisc.c:252
 #1: ffffc900026562e8 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x5ba/0x1a30 drivers/tty/n_tty.c:2158
1 lock held by udevd/4213:
 #0: ffffffff8c1420f0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x256/0x20a0 kernel/exit.c:830
1 lock held by udevd/4215:
 #0: ffffffff8c1420f0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x256/0x20a0 kernel/exit.c:830
1 lock held by syz-executor/4317:
 #0: ffffffff8c1420f0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x256/0x20a0 kernel/exit.c:830
2 locks held by syz-executor/4319:
 #0: ffffffff8c1a66f0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap kernel/fork.c:503 [inline]
 #0: ffffffff8c1a66f0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1466 [inline]
 #0: ffffffff8c1a66f0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x21f/0x1380 kernel/fork.c:1518
 #1: ffff8880750a5528 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline]
 #1: ffff8880750a5528 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:504 [inline]
 #1: ffff8880750a5528 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1466 [inline]
 #1: ffff8880750a5528 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x238/0x1380 kernel/fork.c:1518
2 locks held by syz-executor/4322:
 #0: ffffffff8c1a66f0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mmap kernel/fork.c:503 [inline]
 #0: ffffffff8c1a66f0 (dup_mmap_sem){.+.+}-{0:0}, at: dup_mm kernel/fork.c:1466 [inline]
 #0: ffffffff8c1a66f0 (dup_mmap_sem){.+.+}-{0:0}, at: copy_mm+0x21f/0x1380 kernel/fork.c:1518
 #1: ffff8880750a6328 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock_killable include/linux/mmap_lock.h:87 [inline]
 #1: ffff8880750a6328 (&mm->mmap_lock){++++}-{3:3}, at: dup_mmap kernel/fork.c:504 [inline]
 #1: ffff8880750a6328 (&mm->mmap_lock){++++}-{3:3}, at: dup_mm kernel/fork.c:1466 [inline]
 #1: ffff8880750a6328 (&mm->mmap_lock){++++}-{3:3}, at: copy_mm+0x238/0x1380 kernel/fork.c:1518
1 lock held by syz-executor/4328:
 #0: ffffffff8d238048 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:72 [inline]
 #0: ffffffff8d238048 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x974/0xe60 net/core/rtnetlink.c:5647
1 lock held by udevd/4329:
 #0: ffffffff8c1420f0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: do_exit+0x256/0x20a0 kernel/exit.c:830
7 locks held by syz-executor/4331:
 #0: ffff888079ab6460 (sb_writers#11){.+.+}-{0:0}, at: vfs_write+0x28a/0xd00 fs/read_write.c:590
 #1: ffff88807ae4e888 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x1e5/0x4c0 fs/kernfs/file.c:287
 #2: ffffffff8c141f08 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xee/0x230 kernel/cgroup/cgroup.c:1639
 #3: ffffffff8bfbadd0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_attach_lock kernel/cgroup/cgroup.c:2388 [inline]
 #3: ffffffff8bfbadd0 (cpu_hotplug_lock){++++}-{0:0}, at: cgroup_procs_write_start+0x17c/0x580 kernel/cgroup/cgroup.c:2898
 #4: ffffffff8c1420f0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_attach_lock kernel/cgroup/cgroup.c:2390 [inline]
 #4: ffffffff8c1420f0 (cgroup_threadgroup_rwsem){++++}-{0:0}, at: cgroup_procs_write_start+0x192/0x580 kernel/cgroup/cgroup.c:2898
 #5: ffffffff8c14f948 (cpuset_mutex){+.+.}-{3:3}, at: cpuset_attach+0xac/0x5f0 kernel/cgroup/cpuset.c:2348
 #6: ffff88802b2e4728 (&mm->mmap_lock){++++}-{3:3}, at: mmap_write_lock include/linux/mmap_lock.h:71 [inline]
 #6: ffff88802b2e4728 (&mm->mmap_lock){++++}-{3:3}, at: mpol_rebind_mm+0x33/0x2c0 mm/mempolicy.c:381
4 locks held by syz-executor/4332:
 #0: ffffffff8d294cd0 (cb_lock){++++}-{3:3}, at: genl_rcv+0x15/0x40 net/netlink/genetlink.c:802
 #1: ffffffff8d294b28 (genl_mutex){+.+.}-{3:3}, at: genl_lock net/netlink/genetlink.c:33 [inline]
 #1: ffffffff8d294b28 (genl_mutex){+.+.}-{3:3}, at: genl_rcv_msg+0x137/0xf40 net/netlink/genetlink.c:790
 #2: ffffffff8d238048 (rtnl_mutex){+.+.}-{3:3}, at: wg_set_device+0xf2/0x1e70 drivers/net/wireguard/netlink.c:504
 #3: ffff8880790193e8 (&wg->device_update_lock){+.+.}-{3:3}, at: wg_set_device+0x10a/0x1e70 drivers/net/wireguard/netlink.c:505
3 locks held by kworker/1:5/4398:
 #0: ffff88814c11f138 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work+0x760/0x1000 kernel/workqueue.c:-1
 #1: ffffc90002ebfd00 ((work_completion)(&(&ifa->dad_work)->work)){+.+.}-{0:0}, at: process_one_work+0x7a3/0x1000 kernel/workqueue.c:2285
 #2: ffffffff8d238048 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_dad_work+0xc4/0x1520 net/ipv6/addrconf.c:4110

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 27 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x397/0x3d0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:148 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:212 [inline]
 watchdog+0xe0f/0xe50 kernel/hung_task.c:369
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 867 Comm: kworker/u4:3 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: bat_events batadv_nc_worker
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:132 [inline]
RIP: 0010:lock_release+0x55e/0x870 kernel/locking/lockdep.c:5646
Code: 48 c7 c7 c0 2a 0b 8a e8 80 80 4c 08 b8 ff ff ff ff 65 0f c1 05 33 fa a5 7e 83 f8 01 75 75 48 c7 84 24 80 00 00 00 00 00 00 00 <9c> 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 75 75 f7 44 24 50
RSP: 0018:ffffc9000436fa00 EFLAGS: 00000046
RAX: 0000000000000001 RBX: 18f62d8b2df283a7 RCX: 2fb39e0bfb583900
RDX: 0000000000000002 RSI: ffffffff8a0b2ac0 RDI: ffffffff8a59a480
RBP: ffffc9000436fb20 R08: dffffc0000000000 R09: fffffbfff1ad323e
R10: fffffbfff1ad323e R11: 1ffffffff1ad323d R12: ffff88801fee0b40
R13: dffffc0000000000 R14: ffff88801fee0ae0 R15: 1ffff9200086df4c
FS:  0000000000000000(0000) GS:ffff8880b9000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f70215a5fe8 CR3: 000000002542c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:174 [inline]
 _raw_spin_unlock_bh+0x17/0x30 kernel/locking/spinlock.c:210
 spin_unlock_bh include/linux/spinlock.h:408 [inline]
 batadv_nc_purge_paths+0x316/0x3b0 net/batman-adv/network-coding.c:475
 batadv_nc_worker+0x327/0x5c0 net/batman-adv/network-coding.c:726
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Crashes (131):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/09/25 07:31 linux-5.15.y 43bb85222e53 0abd0691 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in addrconf_dad_work
2025/09/11 06:09 linux-5.15.y de9476bb4f1b fdeaa69b .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in addrconf_dad_work
2024/10/16 16:24 linux-5.15.y 3a5928702e71 bde2d81c .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/11/08 07:38 linux-5.15.y 72244eab0dad 179b040e .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/11/01 05:53 linux-5.15.y 72244eab0dad 96eb609f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/09/26 18:40 linux-5.15.y 3a5928702e71 9314348a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in addrconf_dad_work
2024/09/16 18:49 linux-5.15.y 3a5928702e71 c673ca06 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/09/13 11:00 linux-5.15.y 3a5928702e71 73e8a465 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/09/13 05:09 linux-5.15.y 3a5928702e71 73e8a465 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/09/03 12:44 linux-5.15.y fa93fa65db6e 326f9c5a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/09/03 00:43 linux-5.15.y fa93fa65db6e 8045124c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/08/23 03:46 linux-5.15.y fa93fa65db6e ce8a9099 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/08/13 15:53 linux-5.15.y 7e89efd3ae1c f21a18ca .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/08/09 16:16 linux-5.15.y 7e89efd3ae1c a83d9288 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/07/18 20:29 linux-5.15.y 7c6d66f0266f 71884c12 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/07/04 09:44 linux-5.15.y 4878aadf2d15 3f2748a3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/07/03 19:52 linux-5.15.y 4878aadf2d15 f76a75f3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/07/03 06:34 linux-5.15.y 4878aadf2d15 1ecfa2d8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/23 06:04 linux-5.15.y 4878aadf2d15 edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/21 18:36 linux-5.15.y 4878aadf2d15 edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/21 10:51 linux-5.15.y 4878aadf2d15 dac2aa43 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/20 11:38 linux-5.15.y 4878aadf2d15 dac2aa43 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/20 04:37 linux-5.15.y 4878aadf2d15 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/19 04:28 linux-5.15.y 4878aadf2d15 41b7e219 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/18 11:41 linux-5.15.y 4878aadf2d15 639d6cdf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/18 07:38 linux-5.15.y 4878aadf2d15 ce6011bc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/17 22:37 linux-5.15.y 4878aadf2d15 1f11cfd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/17 19:23 linux-5.15.y 4878aadf2d15 1f11cfd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/17 16:28 linux-5.15.y 4878aadf2d15 1f11cfd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/17 13:13 linux-5.15.y 4878aadf2d15 1f11cfd7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/17 04:51 linux-5.15.y 4878aadf2d15 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/17 00:46 linux-5.15.y 4878aadf2d15 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: task hung in addrconf_dad_work
2024/06/16 21:24 linux-5.15.y 4878aadf2d15 f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/15 12:34 linux-5.15.y c61bd26ae81a f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/15 09:24 linux-5.15.y c61bd26ae81a f429ab00 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/14 15:32 linux-5.15.y c61bd26ae81a 8d849073 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/14 00:17 linux-5.15.y c61bd26ae81a a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/14 00:12 linux-5.15.y c61bd26ae81a a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/13 17:57 linux-5.15.y c61bd26ae81a a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/13 16:07 linux-5.15.y c61bd26ae81a a9616ff5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/13 06:16 linux-5.15.y c61bd26ae81a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/13 02:15 linux-5.15.y c61bd26ae81a 2aa5052f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/12 15:57 linux-5.15.y c61bd26ae81a f815599d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/06/12 13:59 linux-5.15.y c61bd26ae81a f815599d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
2024/01/20 08:08 linux-5.15.y ddcaf4999061 9bd8dcda .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan INFO: task hung in addrconf_dad_work
* Struck through repros no longer work on HEAD.