From: syzbot <syzbot+c15de43f1e7fffbb7b9b@syzkaller.appspotmail.com>
To: dhowells@redhat.com, jarkko@kernel.org, jmorris@namei.org,
keyrings@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-security-module@vger.kernel.org, paul@paul-moore.com,
serge@hallyn.com, syzkaller-bugs@googlegroups.com
Subject: [syzbot] [keyrings?] [lsm?] BUG: workqueue lockup in key_garbage_collector
Date: Sat, 17 Oct 2026 04:26:24 -0700 [thread overview]
Message-ID: <6ad35b60.7952420f.283480.0360.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 7a19f0cc94ad Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=16320f01580000
kernel config: https://syzkaller.appspot.com/x/.config?x=26d6221a572842ac
dashboard link: https://syzkaller.appspot.com/bug?extid=c15de43f1e7fffbb7b9b
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/296cd4b77dbf/disk-7a19f0cc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e57669ed895f/vmlinux-7a19f0cc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c679c1ad76d4/Image-7a19f0cc.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c15de43f1e7fffbb7b9b@syzkaller.appspotmail.com
BUG: workqueue lockup - pool cpus=0 node=0 flags=0x2 nice=0 stuck for 30s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x100
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=13 refcnt=14
in-flight: 10:key_garbage_collector for 51s ,1030:request_firmware_work_func for 87s
pending: nsim_dev_hwstats_traffic_work, 2*psi_avgs_work, vmstat_shepherd, 4*ovs_dp_masks_rebalance, 2*psi_avgs_work, delayed_vfree_work
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=12 refcnt=13
in-flight: 4831:nsim_fib_event_work for 56s ,26:nsim_fib_event_work for 56s
pending: 4*nsim_dev_hwstats_traffic_work, 2*psi_avgs_work, 2*ovs_dp_masks_rebalance, free_ipc, delayed_vfree_work
workqueue events_unbound: flags=0x2
pwq 8: cpus=0-1 flags=0x6 nice=0 active=5 refcnt=6
pending: toggle_allocation_gate, 2*nsim_dev_trap_report_work, flush_memcg_stats_dwork, nsim_dev_trap_report_work
pwq 8: cpus=0-1 flags=0x6 nice=0 active=24 refcnt=25
in-flight: 524:cfg80211_wiphy_work for 56s ,134:cfg80211_wiphy_work for 56s ,12:cfg80211_wiphy_work for 41s ,13:cfg80211_wiphy_work for 57s ,40:cfg80211_wiphy_work for 48s ,1395:cfg80211_wiphy_work for 48s ,41:cfg80211_wiphy_work for 56s ,1171:cfg80211_wiphy_work for 57s cfg80211_wiphy_work
pending: 5*cfg80211_wiphy_work, 2*nsim_dev_trap_report_work, 3*cfg80211_wiphy_work, crng_reseed, cfg80211_wiphy_work, 3*macvlan_process_broadcast
workqueue events_power_efficient: flags=0x82
pwq 8: cpus=0-1 flags=0x6 nice=0 active=6 refcnt=7
pending: neigh_periodic_work, wg_ratelimiter_gc_entries, neigh_managed_work, fb_flashcursor, neigh_managed_work, gc_worker
pwq 8: cpus=0-1 flags=0x6 nice=0 active=2 refcnt=3
pending: neigh_periodic_work, do_cache_clean
workqueue events_dfl_long: flags=0x2
pwq 8: cpus=0-1 flags=0x6 nice=0 active=5 refcnt=6
pending: 5*defense_work_handler
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: defense_work_handler
workqueue mm_percpu_wq: flags=0x108
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=3
pending: vmstat_update
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=2
pending: vmstat_update
workqueue writeback: flags=0x4a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=4 MAYDAY
pending: wb_workfn
workqueue iou_exit: flags=0x2
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: io_ring_exit_work
workqueue mld: flags=0x40108
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=3 MAYDAY
pending: mld_dad_work
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=70 MAYDAY
in-flight: 4816:mld_ifc_work for 7s
inactive: 3*mld_ifc_work, mld_dad_work, 11*mld_ifc_work, mld_dad_work, 6*mld_ifc_work, mld_dad_work, 8*mld_ifc_work, mld_dad_work, 10*mld_ifc_work, mld_dad_work, mld_ifc_work, 2*mld_dad_work, 2*mld_ifc_work, mld_dad_work, mld_ifc_work, mld_dad_work, 13*mld_ifc_work, 2*mld_dad_work
workqueue ipv6_addrconf: flags=0x6000a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=419 MAYDAY
pending: mayday_cursor_func, addrconf_dad_work
inactive: 413*addrconf_dad_work
workqueue bat_events: flags=0x6000a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=45 MAYDAY
in-flight: 2856(RESCUER):batadv_tt_purge for 8s
pending: mayday_cursor_func
inactive: 2*batadv_tt_purge, 4*batadv_mcast_mla_update, batadv_purge_orig, 3*batadv_iv_send_outstanding_bat_ogm_packet, batadv_purge_orig, 2*batadv_iv_send_outstanding_bat_ogm_packet, 2*batadv_purge_orig, batadv_iv_send_outstanding_bat_ogm_packet, batadv_purge_orig, batadv_iv_send_outstanding_bat_ogm_packet, batadv_mcast_mla_update, 8*batadv_iv_send_outstanding_bat_ogm_packet, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, 2*batadv_tt_purge
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=4 refcnt=7 MAYDAY
in-flight: 4824:wg_packet_tx_worker for 57s wg_packet_tx_worker
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_tx_worker, wg_packet_decrypt_worker, wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=5 MAYDAY
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_decrypt_worker, wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker, wg_packet_tx_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=3
pending: wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=3
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_decrypt_worker, wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=5 MAYDAY
pending: wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=5 MAYDAY
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_tx_worker, wg_packet_encrypt_worker, wg_packet_decrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=4 MAYDAY
pending: wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=2 refcnt=3
pending: 2*wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_decrypt_worker, wg_packet_tx_worker, wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=5 MAYDAY
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=4 MAYDAY
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=4 MAYDAY
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=4
pending: wg_packet_decrypt_worker, wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker, wg_packet_tx_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
in-flight: 4832:wg_packet_tx_worker for 56s wg_packet_tx_worker
pending: wg_packet_encrypt_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_tx_worker, wg_packet_encrypt_worker, wg_packet_decrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=5 MAYDAY
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
pending: wg_packet_decrypt_worker, wg_packet_tx_worker, wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=4 MAYDAY
pending: wg_packet_encrypt_worker
pool 2: cpus=0 node=0 flags=0x2 nice=0 hung=30s workers=6 manager: 4872 idle: 4314 9 4802
pool 6: cpus=1 node=0 flags=0x2 nice=0 hung=7s workers=9 manager: 4925 idle: 24 4817 866
pool 8: cpus=0-1 flags=0x6 nice=0 hung=8s workers=9 manager: 1461
Showing backtraces of busy workers in stalled worker pools:
pool 2:
task:kworker/0:1 state:R running task stack:0 pid:10 tgid:10 ppid:2 task_flags:0x4208060 flags:0x00000010
Workqueue: events key_garbage_collector
Call trace:
__switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T)
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x135c/0x2b00 kernel/sched/core.c:7284
__schedule_loop kernel/sched/core.c:7361 [inline]
schedule+0x13c/0x20c kernel/sched/core.c:7376
schedule_timeout+0xc0/0x28c kernel/time/sleep_timeout.c:75
do_wait_for_common kernel/sched/completion.c:100 [inline]
__wait_for_common kernel/sched/completion.c:121 [inline]
wait_for_common+0x220/0x394 kernel/sched/completion.c:132
wait_for_completion+0x18/0x24 kernel/sched/completion.c:153
synchronize_rcu_normal+0x28c/0x350 kernel/rcu/tree.c:3355
synchronize_rcu+0x1f4/0x258 kernel/rcu/tree.c:3413
key_garbage_collector+0x728/0x894 security/keys/gc.c:297
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
pool 2:
task:kworker/0:2 state:R running task stack:0 pid:1030 tgid:1030 ppid:2 task_flags:0x4208060 flags:0x00000010
Workqueue: events request_firmware_work_func
Call trace:
__switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T)
context_switch kernel/sched/core.c:5533 [inline]
__schedule+0x135c/0x2b00 kernel/sched/core.c:7284
preempt_schedule_common+0xd4/0x190 kernel/sched/core.c:7463
preempt_schedule+0x60/0x78 kernel/sched/core.c:7487
__local_bh_enable_ip+0x16c/0x234 kernel/softirq.c:480
__raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
_raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245
spin_unlock_bh include/linux/spinlock.h:407 [inline]
restore_regulatory_settings+0x6f0/0x1650 net/wireless/reg.c:3555
regdb_fw_cb+0x14c/0x1a8 net/wireless/reg.c:1026
request_firmware_work_func+0xe8/0x24c drivers/base/firmware_loader/main.c:1164
process_one_work kernel/workqueue.c:3396 [inline]
process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
worker_thread+0x798/0xbd0 kernel/workqueue.c:3560
kthread+0x304/0x3d4 kernel/kthread.c:436
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-10-17 11:26 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6ad35b60.7952420f.283480.0360.GAE@google.com \
--to=syzbot+c15de43f1e7fffbb7b9b@syzkaller.appspotmail.com \
--cc=dhowells@redhat.com \
--cc=jarkko@kernel.org \
--cc=jmorris@namei.org \
--cc=keyrings@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=serge@hallyn.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.