Re: [syzbot] [kernel?] INFO: task hung in restrict_one_thread_callback

[syzbot <syzbot+7ea2f5e9dfd468201817@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

 team0: Port device team_slave_1 added
[   77.956359][ T5910] batman_adv: batadv0: Adding interface: batadv_slave_0
[   77.963600][ T5910] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   77.989888][ T5910] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   78.004522][ T5910] batman_adv: batadv0: Adding interface: batadv_slave_1
[   78.011605][ T5910] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   78.038002][ T5910] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   78.080982][ T5910] hsr_slave_0: entered promiscuous mode
[   78.087753][ T5910] hsr_slave_1: entered promiscuous mode
[   78.233618][ T5910] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   78.246125][ T5910] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   78.256883][ T5910] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   78.267118][ T5910] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   78.297441][ T5910] bridge0: port 2(bridge_slave_1) entered blocking state
[   78.304646][ T5910] bridge0: port 2(bridge_slave_1) entered forwarding state
[   78.312595][ T5910] bridge0: port 1(bridge_slave_0) entered blocking state
[   78.319734][ T5910] bridge0: port 1(bridge_slave_0) entered forwarding state
[   78.384207][ T5910] 8021q: adding VLAN 0 to HW filter on device bond0
[   78.404563][ T1004] bridge0: port 1(bridge_slave_0) entered disabled state
[   78.413314][ T1004] bridge0: port 2(bridge_slave_1) entered disabled state
[   78.428785][ T5910] 8021q: adding VLAN 0 to HW filter on device team0
[   78.443104][   T65] bridge0: port 1(bridge_slave_0) entered blocking state
[   78.450377][   T65] bridge0: port 1(bridge_slave_0) entered forwarding state
[   78.464952][   T12] bridge0: port 2(bridge_slave_1) entered blocking state
[   78.472313][   T12] bridge0: port 2(bridge_slave_1) entered forwarding state
[   78.645479][ T5910] 8021q: adding VLAN 0 to HW filter on device batadv0
[   78.696816][ T5910] veth0_vlan: entered promiscuous mode
[   78.709183][ T5910] veth1_vlan: entered promiscuous mode
[   78.745020][ T5910] veth0_macvtap: entered promiscuous mode
[   78.756102][ T5910] veth1_macvtap: entered promiscuous mode
[   78.779292][ T5910] batman_adv: batadv0: Interface activated: batadv_slave_0
[   78.795080][ T5910] batman_adv: batadv0: Interface activated: batadv_slave_1
[   78.812914][   T12] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   78.824397][   T12] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   78.840142][   T12] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   78.850096][   T12] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   78.975137][   T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   79.080924][   T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   79.141701][   T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[   79.219381][   T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
2026/02/24 04:06:47 executed programs: 0
[   79.336447][ T5143] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   79.347436][ T5143] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   79.355112][ T5143] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   79.363931][ T5143] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   79.372285][ T5143] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   79.509332][ T5936] chnl_net:caif_netlink_parms(): no params data found
[   79.580835][ T5936] bridge0: port 1(bridge_slave_0) entered blocking state
[   79.588539][ T5936] bridge0: port 1(bridge_slave_0) entered disabled state
[   79.596107][ T5936] bridge_slave_0: entered allmulticast mode
[   79.603587][ T5936] bridge_slave_0: entered promiscuous mode
[   79.613548][ T5936] bridge0: port 2(bridge_slave_1) entered blocking state
[   79.620886][ T5936] bridge0: port 2(bridge_slave_1) entered disabled state
[   79.628076][ T5936] bridge_slave_1: entered allmulticast mode
[   79.635811][ T5936] bridge_slave_1: entered promiscuous mode
[   79.673346][ T5936] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   79.687123][ T5936] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   79.721491][ T5936] team0: Port device team_slave_0 added
[   79.729676][ T5936] team0: Port device team_slave_1 added
[   79.759645][ T5936] batman_adv: batadv0: Adding interface: batadv_slave_0
[   79.766762][ T5936] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   79.793316][ T5936] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   79.806250][ T5936] batman_adv: batadv0: Adding interface: batadv_slave_1
[   79.816021][ T5936] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[   79.842146][ T5936] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   79.891341][ T5936] hsr_slave_0: entered promiscuous mode
[   79.898314][ T5936] hsr_slave_1: entered promiscuous mode
[   79.906509][ T5936] debugfs: 'hsr0' already exists in 'hsr'
[   79.913302][ T5936] Cannot create hsr debugfs directory
[   81.411273][   T51] Bluetooth: hci0: command tx timeout
[   81.652909][   T42] cfg80211: failed to load regulatory.db
[   81.863344][   T13] bridge_slave_1: left allmulticast mode
[   81.869093][   T13] bridge_slave_1: left promiscuous mode
[   81.875947][   T13] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.886804][   T13] bridge_slave_0: left allmulticast mode
[   81.895320][   T13] bridge_slave_0: left promiscuous mode
[   81.902418][   T13] bridge0: port 1(bridge_slave_0) entered disabled state
[   82.056915][   T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[   82.067689][   T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[   82.077661][   T13] bond0 (unregistering): Released all slaves
[   82.165586][   T13] hsr_slave_0: left promiscuous mode
[   82.171808][   T13] hsr_slave_1: left promiscuous mode
[   82.177965][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[   82.188972][   T13] batman_adv: batadv0: Removing interface: batadv_slave_0
[   82.201305][   T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[   82.208712][   T13] batman_adv: batadv0: Removing interface: batadv_slave_1
[   82.224168][   T13] veth1_macvtap: left promiscuous mode
[   82.229800][   T13] veth0_macvtap: left promiscuous mode
[   82.235949][   T13] veth1_vlan: left promiscuous mode
[   82.243307][   T13] veth0_vlan: left promiscuous mode
[   82.524939][   T13] team0 (unregistering): Port device team_slave_1 removed
[   82.542673][   T13] team0 (unregistering): Port device team_slave_0 removed
[   82.750272][    C1] list_del corruption, ffff88802a450890->next is NULL
[   82.757771][    C1] ------------[ cut here ]------------
[   82.763241][    C1] kernel BUG at lib/list_debug.c:53!
[   82.768569][    C1] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
[   82.774843][    C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) 
[   82.783771][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
[   82.793910][    C1] RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190
[   82.800835][    C1] Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 48 c7 c7 40 c1 29 8c 48 89 de e8 42 29 65 fc 90 <0f> 0b 48 c7 c7 a0 c1 29 8c 48 89 de e8 30 29 65 fc 90 0f 0b 4c 89
[   82.820420][    C1] RSP: 0018:ffffc90000a08d58 EFLAGS: 00010046
[   82.826480][    C1] RAX: 0000000000000033 RBX: ffff88802a450890 RCX: e58e7f17a2332a00
[   82.834525][    C1] RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000
[   82.842485][    C1] RBP: 0000000000000203 R08: ffffc90000a08ae7 R09: 1ffff9200014115c
[   82.850447][    C1] R10: dffffc0000000000 R11: fffff5200014115d R12: 1ffff1100548a112
[   82.858428][    C1] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
[   82.866388][    C1] FS:  0000000000000000(0000) GS:ffff888125109000(0000) knlGS:0000000000000000
[   82.875311][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   82.881921][    C1] CR2: 00007f396a9de368 CR3: 000000000e74c000 CR4: 00000000003526f0
[   82.889883][    C1] Call Trace:
[   82.893147][    C1]  <IRQ>
[   82.896012][    C1]  dst_destroy+0x202/0x5a0
[   82.900422][    C1]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   82.906213][    C1]  ? rcu_core+0x751/0x1070
[   82.910617][    C1]  ? __pfx_dst_destroy_rcu+0x10/0x10
[   82.915891][    C1]  rcu_core+0x7cd/0x1070
[   82.920126][    C1]  ? __pfx_rcu_core+0x10/0x10
[   82.924791][    C1]  ? sched_balance_domains+0x13a/0x950
[   82.930242][    C1]  handle_softirqs+0x22a/0x870
[   82.935088][    C1]  ? __irq_exit_rcu+0x5f/0x150
[   82.939842][    C1]  __irq_exit_rcu+0x5f/0x150
[   82.944421][    C1]  irq_exit_rcu+0x9/0x30
[   82.948653][    C1]  sysvec_apic_timer_interrupt+0xa6/0xc0
[   82.954279][    C1]  </IRQ>
[   82.957194][    C1]  <TASK>
[   82.960106][    C1]  asm_sysvec_apic_timer_interrupt+0x1a/0x20
[   82.966079][    C1] RIP: 0010:pv_native_safe_halt+0xf/0x20
[   82.971695][    C1] Code: ee 73 02 c3 cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 43 5d 10 00 fb f4 <e9> 7c ea 02 00 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
[   82.991282][    C1] RSP: 0018:ffffc90000197e20 EFLAGS: 00000242
[   82.997334][    C1] RAX: 0000000000045cc1 RBX: ffffffff819ad30d RCX: 0000000080000001
[   83.005293][    C1] RDX: 0000000000000001 RSI: ffffffff8e013334 RDI: ffffffff8c29be00
[   83.013439][    C1] RBP: ffffc90000197f10 R08: ffff8880b853395b R09: 1ffff110170a672b
[   83.021511][    C1] R10: dffffc0000000000 R11: ffffed10170a672c R12: ffffffff9033b6b0
[   83.029470][    C1] R13: 1ffff11003b5e000 R14: 0000000000000001 R15: 0000000000000001
[   83.037433][    C1]  ? do_idle+0x1bd/0x500
[   83.041683][    C1]  default_idle+0x9/0x20
[   83.045914][    C1]  default_idle_call+0x72/0xb0
[   83.050753][    C1]  do_idle+0x1bd/0x500
[   83.054807][    C1]  ? _raw_spin_unlock_irqrestore+0x4c/0x80
[   83.060598][    C1]  ? __pfx_do_idle+0x10/0x10
[   83.065174][    C1]  ? _raw_spin_unlock_irqrestore+0x30/0x80
[   83.071057][    C1]  cpu_startup_entry+0x43/0x60
[   83.075812][    C1]  start_secondary+0x101/0x110
[   83.080648][    C1]  common_startup_64+0x13e/0x147
[   83.085576][    C1]  </TASK>
[   83.088575][    C1] Modules linked in:
[   83.092472][    C1] ---[ end trace 0000000000000000 ]---
[   83.097909][    C1] RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190
[   83.104866][    C1] Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc cc 48 c7 c7 40 c1 29 8c 48 89 de e8 42 29 65 fc 90 <0f> 0b 48 c7 c7 a0 c1 29 8c 48 89 de e8 30 29 65 fc 90 0f 0b 4c 89
[   83.124458][    C1] RSP: 0018:ffffc90000a08d58 EFLAGS: 00010046
[   83.130525][    C1] RAX: 0000000000000033 RBX: ffff88802a450890 RCX: e58e7f17a2332a00
[   83.138482][    C1] RDX: 0000000000000100 RSI: 0000000000000102 RDI: 0000000000000000
[   83.146435][    C1] RBP: 0000000000000203 R08: ffffc90000a08ae7 R09: 1ffff9200014115c
[   83.154477][    C1] R10: dffffc0000000000 R11: fffff5200014115d R12: 1ffff1100548a112
[   83.162435][    C1] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000
[   83.170390][    C1] FS:  0000000000000000(0000) GS:ffff888125109000(0000) knlGS:0000000000000000
[   83.179304][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   83.185872][    C1] CR2: 00007f396a9de368 CR3: 000000000e74c000 CR4: 00000000003526f0
[   83.193840][    C1] Kernel panic - not syncing: Fatal exception in interrupt
[   83.201135][    C1] Kernel Offset: disabled
[   83.205437][    C1] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3187194119=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 1e62d19825
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e62d1982527c3b4e18df04d61f2560fa1f434cc -X github.com/google/syzkaller/prog.gitRevisionDate=20260213-152336"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e62d1982527c3b4e18df04d61f2560fa1f434cc -X github.com/google/syzkaller/prog.gitRevisionDate=20260213-152336"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=1e62d1982527c3b4e18df04d61f2560fa1f434cc -X github.com/google/syzkaller/prog.gitRevisionDate=20260213-152336"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"1e62d1982527c3b4e18df04d61f2560fa1f434cc\"
/usr/bin/ld: /tmp/ccAQ1hzd.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=11c2155a580000


Tested on:

commit:         779cae95 Add linux-next specific files for 20260223
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=ee920513e4deca5f
dashboard link: https://syzkaller.appspot.com/bug?extid=7ea2f5e9dfd468201817
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1782455a580000