BUG: soft lockup in corrupted

Status: upstream: reported C repro on 2021/12/26 20:46
Reported-by: syzbot+f5eb7dfea68ab16bc032@syzkaller.appspotmail.com
First crash: 1679d, last: 1491d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Similar bugs (17)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-5-15 BUG: soft lockup in corrupted origin:upstream 1 syz, C error 33 686d 842d 0/2 upstream: reported C repro on 2024/04/11 09:01
upstream BUG: workqueue lockup (5) prio:low wireguard arm 1 syz, C done 17086 11m 2391d 0/29 upstream: reported C repro on 2020/01/14 22:04
linux-4.14 BUG: soft lockup in corrupted 1 syz, C error 12 1462d 1945d 0/1 upstream: reported C repro on 2021/04/04 06:30
linux-6.1 INFO: rcu detected stall in corrupted origin:upstream missing-backport 1 syz, C inconclusive 4052 9h02m 1237d 0/3 upstream: reported C repro on 2023/03/13 04:03
upstream INFO: task hung in inet_rtm_newaddr prio:normal net 1 syz, C done 156 1d12h 583d 0/29 upstream: reported C repro on 2024/12/26 09:45
upstream INFO: task hung in exit_aio (4) fs 1 6 596d 662d 0/29 auto-obsoleted due to no activity on 2025/03/13 05:51
upstream INFO: task hung in nsim_destroy (4) prio:high net 1 syz, C error error 447 13d 792d 0/29 upstream: reported C repro on 2024/05/31 11:16
upstream INFO: task hung in hub_port_init (3) prio:low usb 1 syz, C error 1151 2d03h 1222d 0/29 upstream: reported C repro on 2023/03/28 12:23
upstream INFO: task hung in reg_process_self_managed_hints prio:high wireless 1 syz, C done 1281 11h40m 1076d 0/29 upstream: reported C repro on 2023/08/21 16:36
linux-6.6 INFO: rcu detected stall in corrupted origin:lts-only 1 syz, C done 118 27d 404d 0/2 upstream: reported C repro on 2025/06/23 09:19
upstream INFO: rcu detected stall in corrupted (4) prio:low tipc 1 syz, C done inconclusive 832 5d09h 2157d 0/29 upstream: reported C repro on 2020/09/04 18:49
upstream INFO: task hung in reg_check_chans_work (7) prio:normal wireless 1 syz, C error 1068 1d00h 677d 0/29 upstream: reported C repro on 2024/09/23 08:39
android-6-12 INFO: rcu detected stall in corrupted origin:lts 1 syz 2 159d 280d 0/1 auto-obsoleted due to no activity on 2026/05/24 04:58
upstream INFO: task hung in linkwatch_event (4) prio:low net 1 syz, C done 3653 23h59m 735d 0/29 upstream: reported C repro on 2024/07/27 06:21
linux-4.19 INFO: rcu detected stall in corrupted 1 syz, C error 2 1654d 2361d 0/1 upstream: reported C repro on 2020/02/13 05:06
upstream INFO: task hung in uevent_show (2) kernel 1 syz, C inconclusive 8325 392d 630d 29/29 fixed on 2025/07/17 21:22
linux-5.15 INFO: rcu detected stall in corrupted origin:lts-only 1 syz, C error 151 1h54m 1014d 0/3 upstream: reported C repro on 2023/10/23 02:41

Sample crash report:
IPVS: ftp: loaded support on port[0] = 21
IPVS: ftp: loaded support on port[0] = 21
watchdog: BUG: soft lockup - CPU#0 stuck for 23s! [kworker/u4:4:2944]
Modules linked in:
watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [kworker/u4:0:7]
irq event stamp: 109387
Modules linked in:
hardirqs last  enabled at (109386): [<ffffffff8129070b>] kvm_wait arch/x86/kernel/kvm.c:799 [inline]
hardirqs last  enabled at (109386): [<ffffffff8129070b>] kvm_wait+0x14b/0x240 arch/x86/kernel/kvm.c:779
irq event stamp: 196799
hardirqs last disabled at (109387): [<ffffffff81003d00>] trace_hardirqs_off_thunk+0x1a/0x1c
hardirqs last  enabled at (196798): [<ffffffff81003ce4>] trace_hardirqs_on_thunk+0x1a/0x1c
softirqs last  enabled at (98718): [<ffffffff87bb0285>] spin_unlock_bh include/linux/spinlock.h:374 [inline]
softirqs last  enabled at (98718): [<ffffffff87bb0285>] tipc_conn_kref_release net/tipc/topsrv.c:149 [inline]
softirqs last  enabled at (98718): [<ffffffff87bb0285>] kref_put include/linux/kref.h:70 [inline]
softirqs last  enabled at (98718): [<ffffffff87bb0285>] conn_put+0x2c5/0x3a0 net/tipc/topsrv.c:155
hardirqs last disabled at (196799): [<ffffffff81003d00>] trace_hardirqs_off_thunk+0x1a/0x1c
softirqs last disabled at (98724): [<ffffffff87bb003a>] spin_lock_bh include/linux/spinlock.h:334 [inline]
softirqs last disabled at (98724): [<ffffffff87bb003a>] tipc_conn_kref_release net/tipc/topsrv.c:137 [inline]
softirqs last disabled at (98724): [<ffffffff87bb003a>] kref_put include/linux/kref.h:70 [inline]
softirqs last disabled at (98724): [<ffffffff87bb003a>] conn_put+0x7a/0x3a0 net/tipc/topsrv.c:155
CPU: 0 PID: 2944 Comm: kworker/u4:4 Not tainted 4.19.211-syzkaller #0
softirqs last  enabled at (191468): [<ffffffff87b996b1>] tipc_shutdown+0x121/0x310 net/tipc/socket.c:2603
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
softirqs last disabled at (191470): [<ffffffff87bb4683>] spin_lock_bh include/linux/spinlock.h:334 [inline]
softirqs last disabled at (191470): [<ffffffff87bb4683>] tipc_topsrv_stop net/tipc/topsrv.c:702 [inline]
softirqs last disabled at (191470): [<ffffffff87bb4683>] tipc_topsrv_exit_net+0x283/0x5c0 net/tipc/topsrv.c:722
Workqueue: tipc_rcv tipc_conn_recv_work
CPU: 1 PID: 7 Comm: kworker/u4:0 Not tainted 4.19.211-syzkaller #0
RIP: 0010:native_safe_halt+0xe/0x10 arch/x86/include/asm/irqflags.h:61
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022
Code: 48 89 df e8 f4 20 7f f9 e9 2e ff ff ff 48 89 df e8 e7 20 7f f9 eb 82 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 14 43 4e 00 fb f4 <c3> 90 e9 07 00 00 00 0f 00 2d 04 43 4e 00 f4 c3 90 90 41 56 41 55
Workqueue: netns cleanup_net
RSP: 0018:ffff8880abedfbb8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x50 kernel/kcov.c:100
RAX: 1ffffffff13e3054 RBX: ffff888098506610 RCX: 1ffff110157da52f
Code: e8 11 dd 35 00 e9 ab fe ff ff 4c 89 ef e8 04 dd 35 00 e9 23 fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 8b 34 24 <65> 48 8b 04 25 c0 df 01 00 65 8b 15 cc 59 9f 7e 81 e2 00 01 1f 00
RDX: dffffc0000000000 RSI: ffff8880abed2958 RDI: ffff8880abed2904
RBP: 0000000000000003 R08: 0000000000000001 R09: 0000000000000000
RSP: 0018:ffff8880b5a47bc0 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000286
R13: ffffed10130a0cc2 R14: 0000000000000001 R15: ffff8880ba02be00
RAX: 0000000000000000 RBX: 000000002c477fc7 RCX: ffffffff87bb46ad
FS:  0000000000000000(0000) GS:ffff8880ba000000(0000) knlGS:0000000000000000
RDX: 1ffff110130a0cc1 RSI: ffffffff87eef67e RDI: ffff8880985065c0
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
RBP: ffff8880985065c0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000005 R11: 0000000000000000 R12: 000000002c477fc7
CR2: 00007ffea72972d8 CR3: 00000000a886a000 CR4: 00000000003406f0
R13: ffffed10130a0cc9 R14: ffff88808dfdd980 R15: 0000000000000046
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880ba100000(0000) knlGS:0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
 arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
 kvm_wait arch/x86/kernel/kvm.c:799 [inline]
 kvm_wait+0x179/0x240 arch/x86/kernel/kvm.c:779
CR2: 00007f05b239b01d CR3: 00000000a98d0000 CR4: 00000000003406e0
 pv_wait arch/x86/include/asm/paravirt.h:689 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:471 [inline]
 __pv_queued_spin_lock_slowpath+0x86a/0xae0 kernel/locking/qspinlock.c:474
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 radix_tree_lookup+0xe/0x20 lib/radix-tree.c:1099
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:679 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:53 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:88 [inline]
 do_raw_spin_lock+0x189/0x220 kernel/locking/spinlock_debug.c:113
 tipc_topsrv_stop net/tipc/topsrv.c:698 [inline]
 tipc_topsrv_exit_net+0x25e/0x5c0 net/tipc/topsrv.c:722
 spin_lock_bh include/linux/spinlock.h:334 [inline]
 tipc_conn_kref_release net/tipc/topsrv.c:137 [inline]
 kref_put include/linux/kref.h:70 [inline]
 conn_put+0x7a/0x3a0 net/tipc/topsrv.c:155
 ops_exit_list+0xa5/0x150 net/core/net_namespace.c:153
 process_one_work+0x864/0x1570 kernel/workqueue.c:2153
 cleanup_net+0x3b4/0x8b0 net/core/net_namespace.c:554
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
 process_one_work+0x864/0x1570 kernel/workqueue.c:2153
 kthread+0x33f/0x460 kernel/kthread.c:259
 worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
 kthread+0x33f/0x460 kernel/kthread.c:259
----------------
Code disassembly (best guess):
   0:	48 89 df             	mov    %rbx,%rdi
   3:	e8 f4 20 7f f9       	callq  0xf97f20fc
   8:	e9 2e ff ff ff       	jmpq   0xffffff3b
   d:	48 89 df             	mov    %rbx,%rdi
  10:	e8 e7 20 7f f9       	callq  0xf97f20fc
  15:	eb 82                	jmp    0xffffff99
  17:	90                   	nop
  18:	90                   	nop
  19:	90                   	nop
  1a:	90                   	nop
  1b:	90                   	nop
  1c:	e9 07 00 00 00       	jmpq   0x28
  21:	0f 00 2d 14 43 4e 00 	verw   0x4e4314(%rip)        # 0x4e433c
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	c3                   	retq <-- trapping instruction
  2b:	90                   	nop
  2c:	e9 07 00 00 00       	jmpq   0x38
  31:	0f 00 2d 04 43 4e 00 	verw   0x4e4304(%rip)        # 0x4e433c
  38:	f4                   	hlt
  39:	c3                   	retq
  3a:	90                   	nop
  3b:	90                   	nop
  3c:	41 56                	push   %r14
  3e:	41 55                	push   %r13

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2022/07/02 19:45 linux-4.19.y 3f8a27f9e27b 1434eec0 .config console log report syz C ci2-linux-4-19 BUG: soft lockup in corrupted
2022/06/08 14:27 linux-4.19.y 3f8a27f9e27b b2706118 .config console log report syz C ci2-linux-4-19 BUG: soft lockup in corrupted
2021/12/26 20:45 linux-4.19.y 3f8a27f9e27b e4f103c4 .config console log report syz C ci2-linux-4-19 BUG: soft lockup in corrupted
* Struck through repros no longer work on HEAD.