syzbot

 sign-in | mailing list | source | docs
🐞 Open [453]
🐞 Fixed [21]
🐞 Invalid [126]
⬇ Missing Backports [18]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

INFO: task hung in filename_create

Status: upstream: reported on 2025/12/24 02:32
Reported-by: syzbot+ec2b95df7cbdc439bc15@syzkaller.appspotmail.com
First crash: 30d, last: 10d
▶ ▼ Similar bugs (15)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 INFO: task hung in filename_create 1 6 2257d 2356d 0/1 auto-closed as invalid on 2020/03/17 23:03
upstream INFO: task hung in filename_create (2) fs 1 11 2241d 2345d 0/29 auto-closed as invalid on 2020/03/04 11:54
android-49 INFO: task hung in filename_create 1 C 44 2706d 2477d 0/3 public: reported C repro on 2019/04/13 00:00
upstream INFO: task hung in filename_create (3) fs 1 16 1706d 1862d 0/29 auto-closed as invalid on 2021/08/20 18:08
linux-6.1 INFO: task hung in filename_create (2) origin:upstream missing-backport 1 C inconclusive 12 28d 423d 0/3 upstream: reported C repro on 2024/11/26 07:48
linux-4.19 INFO: task hung in filename_create (3) 1 3 1534d 1596d 0/1 auto-closed as invalid on 2022/03/11 04:15
android-44 INFO: task hung in filename_create 1 1 2839d 2839d 0/2 auto-closed as invalid on 2019/02/22 14:19
linux-4.19 INFO: task hung in filename_create (2) 1 1 1797d 1797d 0/1 auto-closed as invalid on 2021/06/20 16:38
linux-4.14 INFO: task hung in filename_create 1 2 2230d 2234d 0/1 auto-closed as invalid on 2020/04/14 04:42
linux-4.19 INFO: task hung in filename_create (4) 1 2 1167d 1231d 0/1 auto-obsoleted due to no activity on 2023/03/13 04:19
linux-5.15 INFO: task hung in filename_create missing-backport origin:upstream 1 C unreliable 51 18d 648d 0/3 upstream: reported C repro on 2024/04/15 05:31
android-44 INFO: task hung in filename_create (2) 1 1 2460d 2460d 0/2 auto-closed as invalid on 2019/10/25 08:49
upstream INFO: task hung in filename_create (4) fs 1 C error error 2416 13h36m 1493d 0/29 upstream: reported C repro on 2021/12/21 22:55
linux-6.1 INFO: task hung in filename_create 1 6 618d 643d 0/3 auto-obsoleted due to no activity on 2024/08/23 04:31
upstream INFO: task hung in filename_create fs 1 121 2550d 2835d 0/29 closed as dup on 2018/09/08 15:39

Sample crash report:
INFO: task syz-executor:10508 blocked for more than 143 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21104 pid:10508 ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
 rwsem_down_write_slowpath+0xbd2/0xfa0 kernel/locking/rwsem.c:1178
 __down_write_common kernel/locking/rwsem.c:1306 [inline]
 __down_write kernel/locking/rwsem.c:1315 [inline]
 down_write_nested+0x1b1/0x1f0 kernel/locking/rwsem.c:1690
 inode_lock_nested include/linux/fs.h:839 [inline]
 filename_create+0x1f6/0x460 fs/namei.c:3890
 do_mkdirat+0xa1/0x440 fs/namei.c:4136
 __do_sys_mkdirat fs/namei.c:4159 [inline]
 __se_sys_mkdirat fs/namei.c:4157 [inline]
 __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4157
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f20d6f8de97
RSP: 002b:00007fff4969c8a8 EFLAGS: 00000202 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007fff4969c900 RCX: 00007f20d6f8de97
RDX: 00000000000001ff RSI: 00007fff4969c900 RDI: 00000000ffffff9c
RBP: 0000000000000001 R08: 0000000000000017 R09: 00007fff4969c5f7
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007fff4969cd78 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:10513 blocked for more than 144 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21736 pid:10513 ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
 __mutex_lock_common kernel/locking/mutex.c:679 [inline]
 __mutex_lock+0x6b7/0xcc0 kernel/locking/mutex.c:747
 cgroup_lock include/linux/cgroup.h:369 [inline]
 cgroup_kn_lock_live+0xf2/0x230 kernel/cgroup/cgroup.c:1677
 cgroup_mkdir+0xb3/0xde0 kernel/cgroup/cgroup.c:5749
 kernfs_iop_mkdir+0x250/0x3d0 fs/kernfs/dir.c:1246
 vfs_mkdir+0x296/0x440 fs/namei.c:4121
 do_mkdirat+0x1d4/0x440 fs/namei.c:4144
 __do_sys_mkdirat fs/namei.c:4159 [inline]
 __se_sys_mkdirat fs/namei.c:4157 [inline]
 __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4157
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7faf5cd8de97
RSP: 002b:00007ffd90db06c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007ffd90db0720 RCX: 00007faf5cd8de97
RDX: 00000000000001ff RSI: 00007ffd90db0720 RDI: 00000000ffffff9c
RBP: 0000000000000001 R08: 0000000000000017 R09: 00007ffd90db0417
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffd90db0b98 R15: 0000000000000000
 </TASK>
INFO: task syz-executor:10515 blocked for more than 145 seconds.
      Not tainted syzkaller #0
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
task:syz-executor    state:D stack:21640 pid:10515 ppid:1      flags:0x00004004
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_preempt_disabled+0x13/0x20 kernel/sched/core.c:6833
 rwsem_down_write_slowpath+0xbd2/0xfa0 kernel/locking/rwsem.c:1178
 __down_write_common kernel/locking/rwsem.c:1306 [inline]
 __down_write kernel/locking/rwsem.c:1315 [inline]
 down_write_nested+0x1b1/0x1f0 kernel/locking/rwsem.c:1690
 inode_lock_nested include/linux/fs.h:839 [inline]
 filename_create+0x1f6/0x460 fs/namei.c:3890
 do_mkdirat+0xa1/0x440 fs/namei.c:4136
 __do_sys_mkdirat fs/namei.c:4159 [inline]
 __se_sys_mkdirat fs/namei.c:4157 [inline]
 __x64_sys_mkdirat+0x89/0xa0 fs/namei.c:4157
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7fac1338de97
RSP: 002b:00007ffed251d408 EFLAGS: 00000202 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 00007ffed251d460 RCX: 00007fac1338de97
RDX: 00000000000001ff RSI: 00007ffed251d460 RDI: 00000000ffffff9c
RBP: 0000000000000001 R08: 0000000000000017 R09: 00007ffed251d157
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffed251d8d8 R15: 0000000000000000
 </TASK>

Showing all locks held in the system:
1 lock held by khungtaskd/29:
 #0: ffffffff8cd2ffa0 (rcu_read_lock){....}-{1:2}, at: rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 #0: ffffffff8cd2ffa0 (rcu_read_lock){....}-{1:2}, at: rcu_read_lock include/linux/rcupdate.h:786 [inline]
 #0: ffffffff8cd2ffa0 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x55/0x290 kernel/locking/lockdep.c:6633
2 locks held by kworker/0:2/1193:
2 locks held by dhcpcd/5434:
 #0: ffff888019686690 (nlk_cb_mutex-ROUTE){+.+.}-{3:3}, at: __netlink_dump_start+0xf4/0x810 net/netlink/af_netlink.c:2336
 #1: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: netlink_dump+0x71f/0xde0 net/netlink/af_netlink.c:2263
2 locks held by getty/5530:
 #0: ffff88802d9650a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 drivers/tty/tty_ldisc.c:243
 #1: ffffc9000328b2f0 (&ldata->atomic_read_lock){+.+.}-{3:3}, at: n_tty_read+0x425/0x1380 drivers/tty/n_tty.c:2217
3 locks held by kworker/u4:27/10455:
 #0: ffff88802d014938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #0: ffff88802d014938 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #1: ffffc9000d067d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #1: ffffc9000d067d00 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #2: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: addrconf_verify_work+0x19/0x30 net/ipv6/addrconf.c:4718
3 locks held by kworker/u4:28/10458:
 #0: ffff888017871538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #0: ffff888017871538 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #1: ffffc9000d077d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #1: ffffc9000d077d00 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #2: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: linkwatch_event+0xe/0x60 net/core/link_watch.c:286
6 locks held by kworker/u4:29/10459:
 #0: ffff888017873938 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #0: ffff888017873938 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #1: ffffc9000d087d00 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:2609 [inline]
 #1: ffffc9000d087d00 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x957/0x15b0 kernel/workqueue.c:2711
 #2: ffffffff8dfa9250 (pernet_ops_rwsem){++++}-{3:3}, at: cleanup_net+0x136/0xb90 net/core/net_namespace.c:606
 #3: ffff888065d65250 (&devlink->lock_key#6){+.+.}-{3:3}, at: devl_lock net/devlink/core.c:60 [inline]
 #3: ffff888065d65250 (&devlink->lock_key#6){+.+.}-{3:3}, at: devlink_pernet_pre_exit+0xe1/0x340 net/devlink/core.c:285
 #4: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: nsim_destroy+0x3f/0x180 drivers/net/netdevsim/netdev.c:417
 #5: ffffffff8cbcb210 (cpu_hotplug_lock){++++}-{0:0}, at: flush_all_backlogs net/core/dev.c:5996 [inline]
 #5: ffffffff8cbcb210 (cpu_hotplug_lock){++++}-{0:0}, at: unregister_netdevice_many_notify+0x599/0x1810 net/core/dev.c:11099
2 locks held by kworker/u4:30/10460:
2 locks held by syz-executor/10508:
 #0: ffff88802e61c418 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffff888078ae55a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline]
 #1: ffff888078ae55a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x1f6/0x460 fs/namei.c:3890
3 locks held by syz-executor/10513:
 #0: ffff88802e61c418 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffff888078ae55a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline]
 #1: ffff888078ae55a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x1f6/0x460 fs/namei.c:3890
 #2: ffffffff8cd59a08 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_lock include/linux/cgroup.h:369 [inline]
 #2: ffffffff8cd59a08 (cgroup_mutex){+.+.}-{3:3}, at: cgroup_kn_lock_live+0xf2/0x230 kernel/cgroup/cgroup.c:1677
2 locks held by syz-executor/10515:
 #0: ffff88802e61c418 (sb_writers#10){.+.+}-{0:0}, at: mnt_want_write+0x41/0x90 fs/namespace.c:412
 #1: ffff888078ae55a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: inode_lock_nested include/linux/fs.h:839 [inline]
 #1: ffff888078ae55a0 (&type->i_mutex_dir_key#6/1){+.+.}-{3:3}, at: filename_create+0x1f6/0x460 fs/namei.c:3890
1 lock held by syz.5.1296/10624:
2 locks held by syz.5.1296/10625:
5 locks held by syz.5.1296/10626:
2 locks held by syz-executor/10862:
 #0: ffffffff8dfa9250 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x351/0x5e0 net/core/net_namespace.c:516
 #1: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: cangw_pernet_exit_batch+0x20/0x90 net/can/gw.c:1288
2 locks held by syz-executor/10887:
 #0: ffffffff8dfa9250 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x351/0x5e0 net/core/net_namespace.c:516
 #1: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x81/0x210 net/ipv4/nexthop.c:3636
2 locks held by syz-executor/10894:
 #0: ffffffff8dfa9250 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x351/0x5e0 net/core/net_namespace.c:516
 #1: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x81/0x210 net/ipv4/nexthop.c:3636
1 lock held by syz-executor/10896:
 #0: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
2 locks held by syz-executor/10904:
 #0: ffffffff8dfa9250 (pernet_ops_rwsem){++++}-{3:3}, at: copy_net_ns+0x351/0x5e0 net/core/net_namespace.c:516
 #1: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: register_nexthop_notifier+0x81/0x210 net/ipv4/nexthop.c:3636
1 lock held by syz-executor/10910:
 #0: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469
1 lock held by syz-executor/10916:
 #0: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock net/core/rtnetlink.c:78 [inline]
 #0: ffffffff8dfb6208 (rtnl_mutex){+.+.}-{3:3}, at: rtnetlink_rcv_msg+0x76f/0xf10 net/core/rtnetlink.c:6469

=============================================

NMI backtrace for cpu 1
CPU: 1 PID: 29 Comm: khungtaskd Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x39b/0x3d0 lib/nmi_backtrace.c:113
 nmi_trigger_cpumask_backtrace+0x17a/0x2f0 lib/nmi_backtrace.c:62
 trigger_all_cpu_backtrace include/linux/nmi.h:160 [inline]
 check_hung_uninterruptible_tasks kernel/hung_task.c:222 [inline]
 watchdog+0xf41/0xf80 kernel/hung_task.c:379
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 10625 Comm: syz.5.1296 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:lockdep_hardirqs_off+0x53/0x100 kernel/locking/lockdep.c:4451
Code: 65 8b 05 c8 ac 9b 75 a9 00 00 f0 00 74 68 83 3d 72 cb 81 0c 00 75 15 48 c7 04 24 00 00 00 00 9c 8f 04 24 f7 04 24 00 02 00 00 <75> 79 65 8b 05 8c 7d 9a 75 85 c0 74 56 65 4c 8b 35 88 ac 9b 75 48
RSP: 0018:ffffc90000006698 EFLAGS: 00000046
RAX: 0000000000000000 RBX: ffffffff8a67fe8e RCX: 90bfd796d5b98900
RDX: 0000000000000000 RSI: ffffffff8aaabd00 RDI: ffffffff8afc73a0
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f8ae13586c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe2df201520 CR3: 0000000021ae5000 CR4: 00000000003506f0
DR0: 0000200000000300 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 irqentry_enter+0x2b/0x50 kernel/entry/common.c:-1
 sysvec_apic_timer_interrupt+0xe/0xc0 arch/x86/kernel/apic/apic.c:1088
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:skip_atoi+0x63/0xe0 lib/vsprintf.c:168
Code: 33 49 8d 6e 01 45 31 ff 48 8b 04 24 42 80 3c 20 00 74 08 48 89 df e8 7c c0 83 f7 48 89 2b 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 <84> c0 75 38 44 0f b6 6d ff 49 ff c6 4c 89 f0 48 c1 e8 03 42 0f b6
RSP: 0018:ffffc90000006798 EFLAGS: 00000a06
RAX: 0000000000000005 RBX: ffffc90000006810 RCX: ffff888031cbbc00
RDX: 0000000000000100 RSI: 00000000000000fc RDI: ffffc90000006810
RBP: ffffffff8aab7e49 R08: ffff888031cbbc00 R09: 0000000000000005
R10: 0000000000000030 R11: 0000000000000100 R12: dffffc0000000000
R13: 1ffffffff1556fc9 R14: ffffffff8aab7e48 R15: 0000000000000000
 format_decode+0x8ad/0x13d0 lib/vsprintf.c:2591
 vsnprintf+0xea/0x1a40 lib/vsprintf.c:2775
 sprintf+0xda/0x120 lib/vsprintf.c:3027
 print_time kernel/printk/printk.c:1327 [inline]
 info_print_prefix+0x156/0x300 kernel/printk/printk.c:1353
 record_print_text+0x155/0x420 kernel/printk/printk.c:1402
 printk_get_next_message+0x282/0x8e0 kernel/printk/printk.c:2876
 console_emit_next_record kernel/printk/printk.c:2911 [inline]
 console_flush_all+0x3ad/0xd00 kernel/printk/printk.c:3000
 console_unlock+0xae/0x340 kernel/printk/printk.c:3069
 vprintk_emit+0x477/0x600 kernel/printk/printk.c:2341
 _printk+0xd0/0x110 kernel/printk/printk.c:2366
 br_fdb_update+0x5c5/0x630 net/bridge/br_fdb.c:867
 br_handle_frame_finish+0x5ce/0x1950 net/bridge/br_input.c:141
 br_nf_hook_thresh+0x3b6/0x480 net/bridge/br_netfilter_hooks.c:1184
 br_nf_pre_routing_finish_ipv6+0x9e3/0xd90 net/bridge/br_netfilter_ipv6.c:-1
 NF_HOOK include/linux/netfilter.h:304 [inline]
 br_nf_pre_routing_ipv6+0x34d/0x680 net/bridge/br_netfilter_ipv6.c:184
 nf_hook_entry_hookfn include/linux/netfilter.h:144 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:277 [inline]
 br_handle_frame+0x957/0x14c0 net/bridge/br_input.c:424
 __netif_receive_skb_core+0xf6b/0x3ac0 net/core/dev.c:5532
 __netif_receive_skb_one_core net/core/dev.c:5636 [inline]
 __netif_receive_skb+0x74/0x290 net/core/dev.c:5752
 process_backlog+0x385/0x6f0 net/core/dev.c:6080
 __napi_poll+0xc0/0x460 net/core/dev.c:6642
 napi_poll net/core/dev.c:6709 [inline]
 net_rx_action+0x5ea/0xc00 net/core/dev.c:6846
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:end_of_stack include/linux/sched/task_stack.h:32 [inline]
RIP: 0010:schedule_debug kernel/sched/core.c:5938 [inline]
RIP: 0010:__schedule+0x116/0x44d0 kernel/sched/core.c:6591
Code: 03 00 48 89 d8 48 c1 e8 03 48 89 44 24 60 42 80 3c 30 00 74 08 48 89 df e8 77 1a 6d f7 48 89 5c 24 40 48 8b 03 48 89 44 24 18 <48> 8d 58 20 48 89 d8 48 c1 e8 03 42 80 3c 30 00 74 08 48 89 df e8
RSP: 0018:ffffc90003656a60 EFLAGS: 00000246
RAX: ffff888031cbbc00 RBX: ffff8880b8e3ca20 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003656be0
RBP: ffffc90003656c50 R08: ffffc90003656bdf R09: 0000000000000000
R10: ffffc90003656bd0 R11: fffff520006cad7c R12: 0000000000000001
R13: ffff8880b8e00000 R14: dffffc0000000000 R15: 1ffff920006cad68
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7010
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:slab_update_freelist mm/slub.c:617 [inline]
RIP: 0010:__slab_free+0x233/0x410 mm/slub.c:3682
Code: 75 33 48 89 f7 4c 89 d6 4c 89 ea 48 89 d9 4d 89 f8 e8 51 df ff ff 41 89 c7 eb 55 4c 89 f9 4c 89 d0 4c 89 ea f0 48 0f c7 4e 20 <0f> 84 86 00 00 00 e9 9b fe ff ff 48 89 6c 24 08 48 89 f5 4c 89 64
RSP: 0018:ffffc90003656dd8 EFLAGS: 00000242
RAX: ffff88803f4fc000 RBX: ffff88803f4fe000 RCX: 0000000080040000
RDX: 0000000080040001 RSI: ffffea0000fd3e00 RDI: 0000000000000000
RBP: ffff888017842140 R08: 0000000000000001 R09: 0000000000000000
R10: ffff88803f4fc000 R11: fffffbfff21b2ca6 R12: ffff888017842140
R13: 0000000080040001 R14: 0000000080040000 R15: 0000000080040000
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x75/0xe0 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
 ____kasan_kmalloc mm/kasan/common.c:341 [inline]
 __kasan_kmalloc+0x22/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:198 [inline]
 __do_kmalloc_node mm/slab_common.c:1007 [inline]
 __kmalloc_node_track_caller+0xb2/0x230 mm/slab_common.c:1027
 __do_krealloc mm/slab_common.c:1402 [inline]
 krealloc+0x86/0x120 mm/slab_common.c:1435
 copy_array+0x64/0xf0 kernel/bpf/verifier.c:1573
 copy_stack_state kernel/bpf/verifier.c:1627 [inline]
 copy_func_state kernel/bpf/verifier.c:1756 [inline]
 copy_verifier_state+0x7f3/0xd20 kernel/bpf/verifier.c:1797
 push_stack+0x1b9/0x500 kernel/bpf/verifier.c:2060
 check_cond_jmp_op+0xdd0/0x2680 kernel/bpf/verifier.c:14637
 do_check+0x672e/0xdbe0 kernel/bpf/verifier.c:17360
 do_check_common+0xadb/0x13e0 kernel/bpf/verifier.c:19706
 do_check_main kernel/bpf/verifier.c:19769 [inline]
 bpf_check+0x649f/0xe970 kernel/bpf/verifier.c:20437
 bpf_prog_load+0x11cb/0x16d0 kernel/bpf/syscall.c:2753
 __sys_bpf+0x55a/0x800 kernel/bpf/syscall.c:5476
 __do_sys_bpf kernel/bpf/syscall.c:5580 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5578 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5578
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8ae058f749
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8ae1358038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f8ae07e6090 RCX: 00007f8ae058f749
RDX: 0000000000000048 RSI: 00002000000017c0 RDI: 0000000000000005
RBP: 00007f8ae0613f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8ae07e6128 R14: 00007f8ae07e6090 R15: 00007ffef29a9fe8
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/01/13 08:03 linux-6.6.y c596736dadab d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan-perf INFO: task hung in filename_create
2025/12/24 02:32 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: task hung in filename_create
* Struck through repros no longer work on HEAD.