From: 白烁冉 <baishuoran@hrbeu.edu.cn>
To: "David S. Miller" <davem@davemloft.net>,
"Jakub Kicinski" <kuba@kernel.org>
Cc: "Kun Hu" <huk23@m.fudan.edu.cn>,
"Jiaji Qin" <jjtan24@m.fudan.edu.cn>,
"Eric Dumazet" <edumazet@google.com>,
"Paolo Abeni" <pabeni@redhat.com>,
netdev@vger.kernel.org, syzkaller@googlegroups.com,
linux-kernel@vger.kernel.org
Subject: hung task in rtnl_newlink
Date: Thu, 22 Jan 2026 15:56:43 +0800 (GMT+08:00) [thread overview]
Message-ID: <39db9ec8.c5b0.19be4b4a8d5.Coremail.baishuoran@hrbeu.edu.cn> (raw)
Dear Maintainers,
When using our customized Syzkaller to fuzz the latest Linux kernel, the following crash was triggered.
HEAD commit: 6537cfb395f352782918d8ee7b7f10ba2cc3cbf2
git tree: upstream
Output:https:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/9%20hung%20task%20in%20rtnl_newlink/report9.txt
Kernel config: https://github.com/pghk13/Kernel-Bug/blob/main/0219_6.13rc7_todo/config.txt
C reproducer:https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/9%20hung%20task%20in%20rtnl_newlink/9repro.txt
Syzlang reproducer: https://github.com/pghk13/Kernel-Bug/blob/main/0702_6.14/9%20hung%20task%20in%20rtnl_newlink/9repro.c
The hung-task is primarily associated with the linkwatch workqueue callback. Specifically, linkwatch_event() processes batches of devices while holding RTNL (rtnl_lock()), during which it repeatedly invokes linkwatch_do_dev() and further calls paths such as dev_activate(), dev_deactivate(), and netdev_state_change(), which may involve relatively time-consuming or blocking operations (link_watch.c:285–287, 194–254, 166–187). At the same time, messages sent from userspace via sendmsg enter the kernel synchronously through netlink_unicast_kernel() in af_netlink.c (af_netlink.c:1312) and are handled in the protocol callback invoked from netlink_rcv_skb() (af_netlink.c:2533). As a result, when RTNL is held by linkwatch for an extended period, a large number of rtnetlink requests may block while attempting to acquire RTNL, enter the D state, and eventually trigger hung-task reports.
We have reproduced this issue several times on 6.19-rc4 again.
If you fix this issue, please add the following tag to the commit:
Reported-by: Kun Hu <huk23@m.fudan.edu.cn>, Jiaji Qin <jjtan24@m.fudan.edu.cn>, Shuoran Bai <baishuoran@hrbeu.edu.cn>
[ 579.240159][ T46] </TASK>
[ 579.241133][ T46] INFO: task syz-executor:10690 blocked for more than 183 seconds.
[ 579.243486][ T46] Not tainted 6.19.0-rc4 #1
[ 579.245045][ T46] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 579.247776][ T46] task:syz-executor state:D stack:11296 pid:10690 tgid:10690 ppid:1 task_flags:0x400140 flags:0x00080002
[ 579.251394][ T46] Call Trace:
[ 579.252443][ T46] <TASK>
[ 579.253371][ T46] __schedule+0xe62/0x1fa0
[ 579.254791][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.256666][ T46] ? schedule+0xb6/0xe0
[ 579.258063][ T46] schedule+0x34/0xe0
[ 579.259368][ T46] schedule_preempt_disabled+0xf/0x20
[ 579.261101][ T46] __mutex_lock+0x810/0x1240
[ 579.262603][ T46] ? __sanitizer_cov_trace_pc+0x1c/0x50
[ 579.264341][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.266153][ T46] ? rtnl_newlink+0x4cb/0x760
[ 579.267639][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.269590][ T46] ? rtnl_newlink+0x4cb/0x760
[ 579.271070][ T46] rtnl_newlink+0x4cb/0x760
[ 579.272516][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.274280][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.276178][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.277919][ T46] ? __pfx_rtnl_newlink+0x10/0x10
[ 579.279488][ T46] rtnetlink_rcv_msg+0x6af/0xae0
[ 579.281023][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.282754][ T46] ? __sanitizer_cov_trace_pc+0x1c/0x50
[ 579.284506][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.286346][ T46] ? ref_tracker_free+0x157/0x2e0
[ 579.287958][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.289777][ T46] netlink_rcv_skb+0x7d/0x1c0
[ 579.291270][ T46] ? __pfx_rtnetlink_rcv_msg+0x10/0x10
[ 579.293003][ T46] netlink_unicast+0x2bc/0x3d0
[ 579.294555][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.296425][ T46] netlink_sendmsg+0x340/0x690
[ 579.298010][ T46] __sock_sendmsg+0x11b/0x130
[ 579.299505][ T46] __sys_sendto+0x18d/0x210
[ 579.301045][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.302777][ T46] ? xfd_validate_state+0x3b/0xe0
[ 579.304392][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.306225][ T46] ? __sanitizer_cov_trace_pc+0x1c/0x50
[ 579.307979][ T46] ? srso_alias_return_thunk+0x5/0xfbef5
[ 579.309720][ T46] ? write_comp_data+0x29/0x80
[ 579.311228][ T46] __x64_sys_sendto+0x26/0x30
[ 579.312726][ T46] do_syscall_64+0xc3/0x11e0
[ 579.314233][ T46] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 579.316176][ T46] RIP: 0033:0x7f947bd1ee04
[ 579.317561][ T46] RSP: 002b:00007ffca283d060 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
[ 579.320127][ T46] RAX: ffffffffffffffda RBX: 00007f947cad4620 RCX: 00007f947bd1ee04
[ 579.322503][ T46] RDX: 000000000000002c RSI: 00007f947cad4670 RDI: 0000000000000003
[ 579.324925][ T46] RBP: 0000000000000000 R08: 00007ffca283d0bc R09: 000000000000000c
[ 579.327410][ T46] R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000000
thanks,
Kun Hu
next reply other threads:[~2026-01-22 7:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-22 7:56 白烁冉 [this message]
2026-01-22 8:07 ` Eric Dumazet
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=39db9ec8.c5b0.19be4b4a8d5.Coremail.baishuoran@hrbeu.edu.cn \
--to=baishuoran@hrbeu.edu.cn \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=huk23@m.fudan.edu.cn \
--cc=jjtan24@m.fudan.edu.cn \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®