From: syzbot <syzbot+61b202fdc410840f0198@syzkaller.appspotmail.com>
To: antonio@mandelbit.com, b.a.t.m.a.n@lists.open-mesh.org,
davem@davemloft.net, linux-kernel@vger.kernel.org,
marek.lindner@mailbox.org, netdev@vger.kernel.org,
omermetekaya0@gmail.com, sven@narfation.org,
sw@simonwunderlich.de, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [arm?] BUG: workqueue lockup in batadv_tt_purge
Date: Sun, 08 Nov 2026 00:01:02 -0800 [thread overview]
Message-ID: <6af02c3e.4dd4714a.f8d02.000e.GAE@google.com> (raw)
In-Reply-To: <2056587.PYKUYFuaPT@sven-l14>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
BUG: workqueue lockup in nsim_fib_event_work
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:aa:aa:aa:aa:aa:0c, vlan:0)
BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=0 stuck for 34s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x100
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=4 refcnt=5
pending: nsim_dev_hwstats_traffic_work, vmstat_shepherd, 2*ovs_dp_masks_rebalance
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=33 refcnt=34
in-flight: 26:nsim_fib_event_work for 35s nsim_fib_event_work ,4951:nsim_fib_event_work for 31s ,1503:nsim_fib_event_work for 22s ,1091:nsim_fib_event_work for 15s
pending: 3*nsim_dev_hwstats_traffic_work, 2*ovs_dp_masks_rebalance, psi_avgs_work, 3*ovs_dp_masks_rebalance, psi_avgs_work, drm_fb_helper_damage_work, 2*l2cap_info_timeout, psi_avgs_work, 2*l2cap_info_timeout, 4*ovs_dp_masks_rebalance, 3*rht_deferred_worker, psi_avgs_work, reg_todo, 3*nsim_fib_event_work
workqueue events_unbound: flags=0x2
pwq 8: cpus=0-1 flags=0x6 nice=0 active=5 refcnt=6
in-flight: 14:nsim_dev_trap_report_work for 5s
pending: 2*nsim_dev_trap_report_work, toggle_allocation_gate, flush_memcg_stats_dwork
pwq 8: cpus=0-1 flags=0x6 nice=0 active=15 refcnt=16
in-flight: 5376:cfg80211_wiphy_work for 25s cfg80211_wiphy_work ,1178:cfg80211_wiphy_work for 32s cfg80211_wiphy_work ,1372:cfg80211_wiphy_work for 35s cfg80211_wiphy_work ,5377:nsim_dev_trap_report_work for 7s ,58:cfg80211_wiphy_work for 33s cfg80211_wiphy_work ,49:cfg80211_wiphy_work for 23s cfg80211_wiphy_work ,40:cfg80211_wiphy_work for 31s cfg80211_wiphy_work
pending: 2*macvlan_process_broadcast
workqueue events_power_efficient: flags=0x82
pwq 8: cpus=0-1 flags=0x6 nice=0 active=4 refcnt=5
pending: fb_flashcursor, wg_ratelimiter_gc_entries, 2*neigh_managed_work
pwq 8: cpus=0-1 flags=0x6 nice=0 active=3 refcnt=4
in-flight: 1350:gc_worker for 16s ,144:neigh_periodic_work for 20s
pending: do_cache_clean
workqueue events_dfl_long: flags=0x2
pwq 8: cpus=0-1 flags=0x6 nice=0 active=11 refcnt=12
pending: 11*defense_work_handler
workqueue netns: flags=0x6000a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=4
in-flight: 12:cleanup_net for 36s
workqueue mm_percpu_wq: flags=0x108
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: vmstat_update
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: vmstat_update
workqueue writeback: flags=0x4a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=4 MAYDAY
in-flight: 33(RESCUER):wb_workfn for 31s
workqueue mld: flags=0x40108
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=4
pending: mld_dad_work
inactive: 2*mld_dad_work
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=108
pending: mld_dad_work
inactive: mld_dad_work, 8*mld_ifc_work, 4*mld_dad_work, mld_ifc_work, mld_dad_work, 10*mld_ifc_work, mld_dad_work, 3*mld_ifc_work, mld_dad_work, 11*mld_ifc_work, mld_dad_work, mld_ifc_work, mld_dad_work, mld_ifc_work, 3*mld_dad_work, 10*mld_ifc_work, 3*mld_dad_work, 7*mld_ifc_work, 2*mld_dad_work, 3*mld_ifc_work, mld_dad_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_dad_work, 17*mld_ifc_work, mld_dad_work, 3*mld_ifc_work, 5*mld_dad_work
workqueue ipv6_addrconf: flags=0x6000a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=248 MAYDAY
in-flight: 2822(RESCUER):addrconf_dad_work for 0s
pending: mayday_cursor_func
inactive: 242*addrconf_dad_work
workqueue bat_events: flags=0x6000a
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=50 MAYDAY
in-flight: 2854(RESCUER):batadv_dat_purge for 7s
inactive: batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_iv_send_outstanding_bat_ogm_packet, batadv_mcast_mla_update, 4*batadv_iv_send_outstanding_bat_ogm_packet, batadv_purge_orig, 2*batadv_iv_send_outstanding_bat_ogm_packet, 4*batadv_purge_orig, 4*batadv_iv_send_outstanding_bat_ogm_packet, 2*batadv_tt_purge, 4*batadv_iv_send_outstanding_bat_ogm_packet, 3*batadv_tt_purge, batadv_mcast_mla_update, batadv_purge_orig, batadv_iv_send_outstanding_bat_ogm_packet, batadv_tt_purge, 4*batadv_mcast_mla_update, batadv_dat_purge
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg1: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg2: flags=0x124
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3
in-flight: 4767:wg_packet_handshake_receive_worker for 21s
pending: wg_packet_handshake_receive_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3
in-flight: 932:wg_packet_decrypt_worker for 22s
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg2: flags=0x124
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-kex-wg2: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=3 refcnt=4
in-flight: 4813:wg_packet_encrypt_worker for 14s
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x6
pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg2: flags=0x124
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg1: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg2: flags=0x124
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x128
pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=1 refcnt=2
pending: wg_packet_encrypt_worker
pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker
pool 2: cpus=0 node=0 flags=0x0 nice=0 hung=14s workers=6 idle: 4847 9 10
pool 6: cpus=1 node=0 flags=0x0 nice=0 hung=34s workers=9 idle: 24 4738 5269 5303 4950
pool 8: cpus=0-1 flags=0x6 nice=0 hung=0s workers=12 manager: 5378
Showing backtraces of busy workers in stalled worker pools:
pool 6:
task:kworker/1:1 state:R running task stack:0 pid:26 tgid:26 ppid:2 task_flags:0x4208060 flags:0x00000010
Workqueue: events nsim_fib_event_work
Call trace:
Tested on:
commit: 532df11b batman-adv: tt: batch BH re-enable during TT ..
git tree: https://git.open-mesh.org/batadv.git disable-bh
console output: https://syzkaller.appspot.com/x/log.txt?x=137967a5580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a3c0ea8c3fd76353
dashboard link: https://syzkaller.appspot.com/bug?extid=61b202fdc410840f0198
compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
Note: no patches were applied.
next prev parent reply other threads:[~2026-11-08 8:01 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-08 0:01 [PATCH batadv-next v3] batman-adv: tt: batch BH re-enable during TT hash walks Ömer Mete Kaya
2026-11-08 7:35 ` Sven Eckelmann
2026-11-08 8:01 ` syzbot [this message]
[not found] <20261029135633.206144-1-omermetekaya0@gmail.com>
2026-10-29 13:58 ` [syzbot] [arm?] BUG: workqueue lockup in batadv_tt_purge syzbot
-- strict thread matches above, loose matches on Subject: below --
2026-09-15 15:10 [syzbot] [netfilter?] " syzbot
2026-10-17 10:43 ` [syzbot] [arm?] " syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6af02c3e.4dd4714a.f8d02.000e.GAE@google.com \
--to=syzbot+61b202fdc410840f0198@syzkaller.appspotmail.com \
--cc=antonio@mandelbit.com \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=marek.lindner@mailbox.org \
--cc=netdev@vger.kernel.org \
--cc=omermetekaya0@gmail.com \
--cc=sven@narfation.org \
--cc=sw@simonwunderlich.de \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.