INFO: trying to register non-static key in dst_destroy

Status: upstream: reported syz repro on 2026/10/18 03:13
Subsystems: net
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+de0b38c748fd9021e85f@syzkaller.appspotmail.com
First crash: 15h42m, last: 15h42m
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
d94871b1 assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ INFO: trying to register non-static key in dst_destroy 2026/10/17 16:33 2026/10/17 16:33 2026/10/17 17:04 432c0077
▶ ▼ Discussions (1)
Title Replies (including bot) Last reply
[syzbot] [net?] INFO: trying to register non-static key in dst_destroy 0 (1) 2026/10/18 03:13

Sample crash report:
nvme nvme0: request 0x1a genctr mismatch (got 0xc expected 0x2)
nvme nvme0: invalid id 49178 completed on queue 0
nvme nvme0: request 0x1b genctr mismatch (got 0xc expected 0x2)
nvme nvme0: invalid id 49179 completed on queue 0
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 0 UID: 0 PID: 4383 Comm: kworker/0:3 Tainted: G   M                syzkaller #0 PREEMPT 
Tainted: [M]=MACHINE_CHECK
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: rcu_gp process_srcu
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 dump_stack+0x1c/0x28 lib/dump_stack.c:129
 assign_lock_key+0xcc/0xdc kernel/locking/lockdep.c:1028
 register_lock_class+0xf8/0x31c kernel/locking/lockdep.c:1343
 __lock_acquire+0x140/0x2b08 kernel/locking/lockdep.c:5162
 lock_acquire+0x13c/0x320 kernel/locking/lockdep.c:5942
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:155 [inline]
 _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:181
 ref_tracker_free+0x114/0x6b4 lib/ref_tracker.c:310
 netdev_tracker_free include/linux/netdevice.h:4551 [inline]
 netdev_put include/linux/netdevice.h:4568 [inline]
 dst_destroy+0xf4/0x2c0 net/core/dst.c:115
 dst_destroy_rcu+0x20/0x30 net/core/dst.c:133
 rcu_do_batch kernel/rcu/tree.c:2650 [inline]
 rcu_core+0x790/0xfbc kernel/rcu/tree.c:2919
 rcu_core_si+0x10/0x1c kernel/rcu/tree.c:2936
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83
 invoke_softirq kernel/softirq.c:526 [inline]
 __irq_exit_rcu+0x10c/0x318 kernel/softirq.c:758
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:775
 __el1_irq arch/arm64/kernel/entry-common.c:569 [inline]
 el1_interrupt+0x40/0x60 arch/arm64/kernel/entry-common.c:581
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:586
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:602
 __daif_local_irq_enable arch/arm64/include/asm/irqflags.h:26 [inline] (P)
 arch_local_irq_enable arch/arm64/include/asm/irqflags.h:48 [inline] (P)
 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:219 [inline] (P)
 _raw_spin_unlock_irq+0x34/0x80 kernel/locking/spinlock.c:229 (P)
 try_check_zero+0xf8/0x4f0 kernel/rcu/srcutree.c:1132
 srcu_advance_state kernel/rcu/srcutree.c:1845 [inline]
 process_srcu+0x2f8/0x13b8 kernel/rcu/srcutree.c:1954
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
list_add corruption. prev is NULL.
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:26!
Internal error: Oops - BUG: 00000000f2000800 [#1]  SMP
Modules linked in:
CPU: 0 UID: 0 PID: 4383 Comm: kworker/0:3 Tainted: G   M                syzkaller #0 PREEMPT 
Tainted: [M]=MACHINE_CHECK
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: rcu_gp process_srcu
pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : __list_add_valid_or_report+0xcc/0x148 lib/list_debug.c:25
lr : __list_add_valid_or_report+0xcc/0x148 lib/list_debug.c:25
sp : ffff80008f7e7b40
x29: ffff80008f7e7b40 x28: 1fffe000191988ed x27: ffff0000c8cc4768
x26: ffff0000c8cc4760 x25: dfff800000000000 x24: ffff700011efcf74
x23: 1fffe0001ac2ca28 x22: 0000000000000000 x21: ffff0000d6165140
x20: 0000000000000000 x19: ffff0000c8cc4700 x18: 00000000ffffffff
x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
x14: 00000000000006b6 x13: 0000000000000001 x12: 0000000000000003
x11: 0000000000000000 x10: 0000000000000103 x9 : 10c42bc48b746e00
x8 : 10c42bc48b746e00 x7 : 0000000000000001 x6 : ffff800080483084
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff80008048db84
x2 : 0000000000000102 x1 : ffff0000c6ecd880 x0 : 0000000000000022
Call trace:
 __list_add_valid_or_report+0xcc/0x148 lib/list_debug.c:25 (P)
 __list_add_valid include/linux/list.h:104 [inline]
 __list_add include/linux/list.h:169 [inline]
 list_add_tail include/linux/list.h:206 [inline]
 list_move_tail include/linux/list.h:357 [inline]
 ref_tracker_free+0x248/0x6b4 lib/ref_tracker.c:329
 dst_des

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/17 16:33 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7a19f0cc94ad 432c0077 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 INFO: trying to register non-static key in dst_destroy
* Struck through repros no longer work on HEAD.