[syzbot] [netfilter?] BUG: workqueue lockup in batadv_tt_purge

[syzbot] [netfilter?] BUG: workqueue lockup in batadv_tt_purge

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    5445d6419962 arm64: Don't read GMID_EL1 when MTE is disabled
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=1514428e580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=56ed23170c168d4c
dashboard link: https://syzkaller.appspot.com/bug?extid=61b202fdc410840f0198
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/e8b70e3bd109/disk-5445d641.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e5227e56ac93/vmlinux-5445d641.xz
kernel image: https://storage.googleapis.com/syzbot-assets/54905f78be59/Image-5445d641.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+61b202fdc410840f0198@syzkaller.appspotmail.com

BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=0 stuck for 37s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x100
  pwq 2: cpus=0 node=0 flags=0x0 nice=0 active=8 refcnt=9
    in-flight: 6264:reg_todo for 27s
    pending: 6*nsim_dev_hwstats_traffic_work, psi_avgs_work
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=11 refcnt=12
    pending: 4*nsim_dev_hwstats_traffic_work, 2*psi_avgs_work, 2*ovs_dp_masks_rebalance, free_obj_work, 2*psi_avgs_work
workqueue events_unbound: flags=0x2
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=20 refcnt=21
    in-flight: 56:cfg80211_wiphy_work for 64s cfg80211_wiphy_work ,4950:cfg80211_wiphy_work for 68s cfg80211_wiphy_work ,7165:nsim_dev_trap_report_work for 9s ,12:cfg80211_wiphy_work for 69s cfg80211_wiphy_work ,1457:cfg80211_wiphy_work for 63s cfg80211_wiphy_work
    pending: nsim_dev_trap_report_work, toggle_allocation_gate, 5*nsim_dev_trap_report_work, flush_memcg_stats_dwork, 3*nsim_dev_trap_report_work
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=8 refcnt=9
    in-flight: 52:cfg80211_wiphy_work for 67s cfg80211_wiphy_work ,13:cfg80211_wiphy_work for 67s cfg80211_wiphy_work ,40:cfg80211_wiphy_work for 62s cfg80211_wiphy_work ,264:cfg80211_wiphy_work for 34s cfg80211_wiphy_work
workqueue events_power_efficient: flags=0x82
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=8 refcnt=9
    in-flight: 1188:neigh_periodic_work for 41s ,7164:gc_worker for 2s
    pending: crda_timeout_work, neigh_periodic_work, wg_ratelimiter_gc_entries, reg_check_chans_work, 2*neigh_managed_work
workqueue events_dfl_long: flags=0x2
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=6 refcnt=7
    pending: 6*defense_work_handler
workqueue mm_percpu_wq: flags=0x108
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=1 refcnt=2
    pending: vmstat_update
workqueue bat_events: flags=0x6000a
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=45 MAYDAY
    in-flight: 2852(RESCUER):batadv_tt_purge for 11s
    pending: mayday_cursor_func
    inactive: 2*batadv_tt_purge, batadv_dat_purge, 2*batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, 4*batadv_mcast_mla_update, 2*batadv_iv_send_outstanding_bat_ogm_packet, 2*batadv_purge_orig, 6*batadv_iv_send_outstanding_bat_ogm_packet, 2*batadv_purge_orig, batadv_dat_purge, batadv_bla_periodic_work, 4*batadv_iv_send_outstanding_bat_ogm_packet, batadv_purge_orig, batadv_tt_purge, batadv_mcast_mla_update, 3*batadv_iv_send_outstanding_bat_ogm_packet, batadv_tt_purge
workqueue wg-kex-wg0: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg1: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg2: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
    pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg0: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg1: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-crypt-wg2: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
    pending: wg_packet_encrypt_worker, wg_packet_decrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg0: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg1: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=3 refcnt=4
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg2: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg0: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg1: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-crypt-wg2: flags=0x128
  pwq 6: cpus=1 node=0 flags=0x0 nice=0 active=2 refcnt=3
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker
pool 2: cpus=0 node=0 flags=0x0 nice=0 hung=0s workers=10 idle: 4833 9 4790 6306 5581 4834 6772 10 1009
pool 8: cpus=0-1 flags=0x6 nice=0 hung=2s workers=12 manager: 7166
Showing backtraces of busy workers in stalled worker pools:
pool 6: no worker in running state, cpu=1 is busy (nr_workers=11 nr_idle=11)
The pool might have trouble waking an idle worker.
Backtrace of last woken worker:
task:kworker/1:1     state:R  running task     stack:0     pid:26    tgid:26    ppid:2      task_flags:0x4208060 flags:0x00000010
Workqueue:  0x0 (wg-crypt-wg0)
Call trace:
 __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T)
 context_switch kernel/sched/core.c:5520 [inline]
 __schedule+0x1370/0x2d80 kernel/sched/core.c:7270
 __schedule_loop kernel/sched/core.c:7347 [inline]
 schedule+0x13c/0x20c kernel/sched/core.c:7362
 worker_thread+0x924/0xbd0 kernel/workqueue.c:3566
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 2852 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026
Workqueue: bat_events batadv_tt_purge
pstate: 03400005 (nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : in_softirq_really kernel/kcov.c:167 [inline]
pc : check_kcov_mode+0x18/0x54 kernel/kcov.c:179
lr : write_comp_data+0x38/0x84 kernel/kcov.c:242
sp : ffff80008ec46dd0
x29: ffff80008ec46dd0 x28: dfff800000000000 x27: 000000000000224e
x26: dfff800000000000 x25: ffff700011d88dc8 x24: 1ffff00011d88dfa
x23: ffff0000c8e9d880 x22: 0000000000000007 x21: 0000000000000002
x20: ffff000023a0f400 x19: ffff800085709eb4 x18: 0000000011264820
x17: 0000000001320140 x16: 0140000800000000 x15: 0000000000000000
x14: 00000000850ade10 x13: 0000000000000007 x12: 0000000000000000
x11: 0000000000000000 x10: 000000000000000f x9 : 0000000000000101
x8 : ffff0000c8e9d880 x7 : 0000000000000000 x6 : 000000000000003f
x5 : 0000000000000040 x4 : 0000000000000000 x3 : ffff800085709eb4
x2 : ffff000023a0f400 x1 : ffff0000c8e9d880 x0 : 0000000000000003
Call trace:
 preempt_count arch/arm64/include/asm/preempt.h:12 [inline] (P)
 in_softirq_really kernel/kcov.c:167 [inline] (P)
 check_kcov_mode+0x18/0x54 kernel/kcov.c:179 (P)
 __sanitizer_cov_trace_const_cmp8+0x24/0x30 kernel/kcov.c:317
 __xfrm_decode_session+0x484/0x8a8 net/xfrm/xfrm_policy.c:3524
 xfrm_decode_session include/net/xfrm.h:1357 [inline]
 ip_route_me_harder+0x7c4/0xd80 net/ipv4/netfilter.c:67
 synproxy_send_tcp+0x2d4/0x5a4 net/netfilter/nf_synproxy_core.c:434
 synproxy_send_client_synack+0x3b0/0x640 net/netfilter/nf_synproxy_core.c:487
 nft_synproxy_eval_v4+0x16c/0x278 net/netfilter/nft_synproxy.c:59
 nft_synproxy_do_eval+0x2d8/0x4a4 net/netfilter/nft_synproxy.c:141
 nft_synproxy_eval+0x34/0x48 net/netfilter/nft_synproxy.c:247
 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline]
 nft_do_chain+0x418/0x13c8 net/netfilter/nf_tables_core.c:285
 nft_do_chain_inet+0x284/0x3d4 net/netfilter/nft_chain_filter.c:162
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc8/0x224 net/netfilter/core.c:619
 nf_hook include/linux/netfilter.h:280 [inline]
 NF_HOOK+0x1f0/0x398 include/linux/netfilter.h:323
 ip_local_deliver+0x128/0x188 net/ipv4/ip_input.c:262
 dst_input include/net/dst.h:480 [inline]
 ip_rcv_finish+0x20c/0x230 net/ipv4/ip_input.c:492
 NF_HOOK+0x308/0x398 include/linux/netfilter.h:325
 ip_rcv+0x7c/0x9c net/ipv4/ip_input.c:612
 __netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6264
 __netif_receive_skb+0x34/0x128 net/core/dev.c:6377
 process_backlog+0x5f4/0x16f8 net/core/dev.c:6728
 __napi_poll+0xb4/0x328 net/core/dev.c:7787
 napi_poll net/core/dev.c:7850 [inline]
 net_rx_action+0x5b0/0xc14 net/core/dev.c:8007
 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83
 do_softirq+0x90/0xf8 kernel/softirq.c:546
 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 batadv_tt_global_purge net/batman-adv/translation-table.c:2390 [inline]
 batadv_tt_purge+0x3e4/0x7b4 net/batman-adv/translation-table.c:3754
 process_one_work kernel/workqueue.c:3387 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470
 rescuer_thread+0x68c/0xd90 kernel/workqueue.c:3694
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

Re: [syzbot] [arm?] BUG: workqueue lockup in batadv_tt_purge

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit:    7a19f0cc94ad Merge branch 'for-next/core' into for-kernelci
git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=16fb34e1580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=26d6221a572842ac
dashboard link: https://syzkaller.appspot.com/bug?extid=61b202fdc410840f0198
compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
userspace arch: arm64
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=11329bd1580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/296cd4b77dbf/disk-7a19f0cc.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e57669ed895f/vmlinux-7a19f0cc.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c679c1ad76d4/Image-7a19f0cc.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+61b202fdc410840f0198@syzkaller.appspotmail.com

bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=-20 stuck for 32s!
Showing busy workqueues and worker pools:
workqueue events: flags=0x100
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=9 refcnt=10
    pending: free_ipc, rht_deferred_worker, 2*nsim_dev_hwstats_traffic_work, vmstat_shepherd, 2*psi_avgs_work, 2*ovs_dp_masks_rebalance
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=11 refcnt=12
    in-flight: 1503:request_firmware_work_func for 147s
    pending: 3*nsim_dev_hwstats_traffic_work, 2*psi_avgs_work, drm_fb_helper_damage_work, 4*ovs_dp_masks_rebalance
workqueue events_unbound: flags=0x2
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=9 refcnt=10
    in-flight: 5092:call_usermodehelper_exec_work for 84s ,13:nsim_dev_trap_report_work for 17s ,5097:nsim_dev_trap_report_work for 5s ,196:cfg80211_wiphy_work for 25s
    pending: 2*nsim_dev_trap_report_work, flush_memcg_stats_dwork, toggle_allocation_gate, nsim_dev_trap_report_work
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=13 refcnt=14
    in-flight: 5096:cfg80211_wiphy_work for 85s cfg80211_wiphy_work ,5095:cfg80211_wiphy_work for 90s cfg80211_wiphy_work ,49:cfg80211_wiphy_work for 93s cfg80211_wiphy_work ,61:cfg80211_wiphy_work for 94s cfg80211_wiphy_work ,12:linkwatch_event for 93s ,1428:cfg80211_wiphy_work for 93s cfg80211_wiphy_work ,1214:cfg80211_wiphy_work for 91s cfg80211_wiphy_work
workqueue events_power_efficient: flags=0x82
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=6 refcnt=7
    in-flight: 1187:neigh_periodic_work for 2s
    pending: 2*neigh_managed_work, fb_flashcursor, gc_worker, wg_ratelimiter_gc_entries
workqueue events_dfl_long: flags=0x2
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=6 refcnt=7
    pending: 6*defense_work_handler
workqueue rcu_gp: flags=0x108
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=4 MAYDAY
    pending: process_srcu
workqueue mm_percpu_wq: flags=0x108
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=3 MAYDAY
    pending: vmstat_update
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=4 MAYDAY
    pending: mayday_cursor_func, vmstat_update
workqueue writeback: flags=0x4a
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=3 MAYDAY
    pending: wb_workfn
workqueue kblockd: flags=0x118
  pwq 7: cpus=1 node=0 flags=0x0 nice=-20 active=1 refcnt=2
    pending: blk_mq_timeout_work
workqueue mld: flags=0x40108
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=4 MAYDAY
    pending: mld_ifc_work
    inactive: mld_ifc_work
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=97 MAYDAY
    in-flight: 2824(RESCUER):mld_ifc_work for 2s
    pending: mayday_cursor_func
    inactive: 3*mld_ifc_work, mld_dad_work, 5*mld_ifc_work, mld_dad_work, 5*mld_ifc_work, mld_dad_work, 2*mld_ifc_work, mld_dad_work, 5*mld_ifc_work, mld_dad_work, 10*mld_ifc_work, mld_dad_work, 3*mld_ifc_work, mld_dad_work, 4*mld_ifc_work, 3*mld_dad_work, mld_ifc_work, mld_dad_work, 6*mld_ifc_work, mld_dad_work, 5*mld_ifc_work, mld_dad_work, 11*mld_ifc_work, mld_dad_work, 4*mld_ifc_work, mld_dad_work, 5*mld_ifc_work, 2*mld_dad_work, 4*mld_ifc_work, 2*mld_dad_work, mld_ifc_work
workqueue ipv6_addrconf: flags=0x6000a
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=386
    in-flight: 40:addrconf_dad_work for 94s
    inactive: 382*addrconf_dad_work
workqueue bat_events: flags=0x6000a
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=40 MAYDAY
    in-flight: 2857(RESCUER):batadv_tt_purge for 0s
    pending: mayday_cursor_func
    inactive: 3*batadv_iv_send_outstanding_bat_ogm_packet, 2*batadv_purge_orig, 2*batadv_iv_send_outstanding_bat_ogm_packet, batadv_purge_orig, 6*batadv_iv_send_outstanding_bat_ogm_packet, 3*batadv_mcast_mla_update, 2*batadv_dat_purge, 2*batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_dat_purge, batadv_bla_periodic_work, batadv_tt_purge, 2*batadv_mcast_mla_update, 2*batadv_purge_orig, 2*batadv_tt_purge
workqueue wg-kex-wg0: flags=0x124
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=2
    in-flight: 4784:wg_packet_handshake_receive_worker for 47s
workqueue wg-crypt-wg0: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=3 MAYDAY
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=5 MAYDAY
    pending: wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-crypt-wg1: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=3 MAYDAY
    pending: wg_packet_decrypt_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=5 MAYDAY
    pending: mayday_cursor_func, wg_packet_decrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg2: flags=0x124
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=2
    in-flight: 5067:wg_packet_handshake_receive_worker for 30s
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=2
    in-flight: 5074:wg_packet_handshake_receive_worker for 41s
workqueue wg-kex-wg2: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=4 MAYDAY
    pending: wg_packet_encrypt_worker, wg_packet_tx_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
    pending: wg_packet_tx_worker, wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg0: flags=0x124
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_receive_worker
workqueue wg-kex-wg0: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=4 MAYDAY
    pending: wg_packet_tx_worker, wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
    pending: wg_packet_decrypt_worker, wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x124
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg1: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=4 MAYDAY
    pending: wg_packet_tx_worker, wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
    pending: mayday_cursor_func, wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg2: flags=0x124
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=3
    in-flight: 866:wg_packet_handshake_receive_worker for 31s
    pending: wg_packet_handshake_receive_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=3
    in-flight: 24:wg_packet_handshake_receive_worker for 44s
    pending: wg_packet_handshake_receive_worker
workqueue wg-kex-wg0: flags=0x124
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_receive_worker
workqueue wg-kex-wg0: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg0: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=3 MAYDAY
    pending: wg_packet_tx_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
    pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker, wg_packet_tx_worker
workqueue wg-kex-wg1: flags=0x124
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=3
    in-flight: 4794:wg_packet_handshake_receive_worker for 67s wg_packet_handshake_receive_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=3
    in-flight: 4833:wg_packet_handshake_receive_worker for 47s
    pending: wg_packet_handshake_receive_worker
workqueue wg-kex-wg1: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=4 MAYDAY
    pending: wg_packet_decrypt_worker, wg_packet_tx_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
    pending: wg_packet_tx_worker, wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg2: flags=0x124
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=3
    in-flight: 5091:wg_packet_handshake_receive_worker for 22s
    pending: wg_packet_handshake_receive_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=3
    in-flight: 4847:wg_packet_handshake_receive_worker for 41s
    pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg2: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=5 MAYDAY
    in-flight: 10:wg_packet_decrypt_worker for 1s
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=4 MAYDAY
    pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg0: flags=0x124
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=2
    in-flight: 4955:wg_packet_handshake_receive_worker for 5s
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_receive_worker
workqueue wg-crypt-wg0: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=3 MAYDAY
    pending: wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
    pending: wg_packet_decrypt_worker, wg_packet_tx_worker, wg_packet_encrypt_worker
workqueue wg-kex-wg1: flags=0x124
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_receive_worker
workqueue wg-kex-wg1: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg1: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=3 refcnt=5 MAYDAY
    pending: wg_packet_decrypt_worker, wg_packet_tx_worker, wg_packet_encrypt_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=3 refcnt=6 MAYDAY
    pending: wg_packet_tx_worker, wg_packet_encrypt_worker, wg_packet_decrypt_worker
workqueue wg-kex-wg2: flags=0x124
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=2 refcnt=3
    in-flight: 9:wg_packet_handshake_receive_worker for 31s wg_packet_handshake_receive_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=3
    in-flight: 26:wg_packet_handshake_receive_worker for 47s
    pending: wg_packet_handshake_receive_worker
workqueue wg-kex-wg2: flags=0x6
  pwq 8: cpus=0-1 flags=0x6 nice=0 active=1 refcnt=2
    pending: wg_packet_handshake_send_worker
workqueue wg-crypt-wg2: flags=0x128
  pwq 2: cpus=0 node=0 flags=0x2 nice=0 active=1 refcnt=4 MAYDAY
    pending: wg_packet_decrypt_worker
  pwq 6: cpus=1 node=0 flags=0x2 nice=0 active=2 refcnt=4 MAYDAY
    pending: wg_packet_decrypt_worker, wg_packet_encrypt_worker
pool 2: cpus=0 node=0 flags=0x2 nice=0 hung=1s workers=8 manager: 5019
pool 6: cpus=1 node=0 flags=0x2 nice=0 hung=2s workers=8 manager: 1091
pool 8: cpus=0-1 flags=0x6 nice=0 hung=0s workers=14 manager: 5099
Showing backtraces of busy workers in stalled worker pools:
pool 7: no worker in running state, cpu=1 is busy (nr_workers=2 nr_idle=2)
The pool might have trouble waking an idle worker.
Backtrace of last woken worker:
task:kworker/1:1H    state:R  running task     stack:0     pid:4356  tgid:4356  ppid:2      task_flags:0x4208060 flags:0x00000010
Workqueue:  0x0 (kblockd)
Call trace:
 __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T)
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x135c/0x2b00 kernel/sched/core.c:7284
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0x13c/0x20c kernel/sched/core.c:7376
 worker_thread+0x924/0xbd0 kernel/workqueue.c:3575
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 2857 Comm: kworker/R-bat_e Not tainted syzkaller #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/23/2026
Workqueue: bat_events batadv_tt_purge
pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : check_kcov_mode+0x30/0x54 kernel/kcov.c:179
lr : __sanitizer_cov_trace_pc+0x28/0x5c kernel/kcov.c:213
sp : ffff80008f7f6480
x29: ffff80008f7f6480 x28: ffff0000d7c37cdf x27: dfff800000000000
x26: 1fffe0001af86f99 x25: 0000000000000000 x24: 0000000000000001
x23: 0000000000000003 x22: ffff0000d7c37cc8 x21: 00000000fffffffd
x20: ffff0000c989bb00 x19: ffff800085770458 x18: ffff80011b89c000
x17: 0000000000020010 x16: 0038dd8600000000 x15: 0000000000000001
x14: 000000000453af90 x13: 0000000000000002 x12: 0000000000000000
x11: ffff80008f7f6740 x10: 000000000000003f x9 : 0000000000000101
x8 : 0000000000000000 x7 : ffff80008f7f6750 x6 : 0000000000000003
x5 : ffff80008f7f6750 x4 : ffff80008f7f6740 x3 : ffff800085770444
x2 : 00000000fffffffd x1 : ffff0000c989bb00 x0 : 0000000000000002
Call trace:
 check_kcov_mode+0x30/0x54 kernel/kcov.c:179 (P)
 find_match+0x1b4/0xacc net/ipv6/route.c:790
 __find_rr_leaf+0x1d8/0x634 net/ipv6/route.c:873
 find_rr_leaf net/ipv6/route.c:894 [inline]
 rt6_select net/ipv6/route.c:938 [inline]
 fib6_table_lookup+0x3a4/0x8e8 net/ipv6/route.c:2261
 ip6_pol_route+0x224/0xec4 net/ipv6/route.c:2298
 ip6_pol_route_input+0x74/0x98 net/ipv6/route.c:2357
 pol_lookup_func include/net/ip6_fib.h:670 [inline]
 fib6_rule_lookup+0x1a0/0x474 net/ipv6/fib6_rules.c:123
 ip6_route_input_lookup+0xa8/0xdc net/ipv6/route.c:2369
 ip6_route_input+0x578/0x860 net/ipv6/route.c:2672
 ip6_rcv_finish_core+0x200/0x3a4 net/ipv6/ip6_input.c:106
 ip6_rcv_finish+0x120/0x204 net/ipv6/ip6_input.c:117
 ip_sabotage_in+0x1bc/0x220 net/bridge/br_netfilter_hooks.c:988
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xc8/0x224 net/netfilter/core.c:619
 nf_hook include/linux/netfilter.h:280 [inline]
 NF_HOOK+0x1f0/0x398 include/linux/netfilter.h:323
 ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:351
 __netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6297
 __netif_receive_skb+0x34/0x128 net/core/dev.c:6410
 netif_receive_skb_internal net/core/dev.c:6496 [inline]
 netif_receive_skb+0x1e0/0x888 net/core/dev.c:6555
 br_netif_receive_skb+0x138/0x184 net/bridge/br_input.c:30
 NF_HOOK+0xa8/0x3a0 include/linux/netfilter.h:325
 br_pass_frame_up+0x28c/0x41c net/bridge/br_input.c:70
 br_handle_frame_finish+0xed0/0x14c4 net/bridge/br_input.c:-1
 br_nf_hook_thresh+0x344/0x3e8 net/bridge/br_netfilter_hooks.c:-1
 br_nf_pre_routing_finish_ipv6+0x7ac/0xaa4 net/bridge/br_netfilter_ipv6.c:-1
 NF_HOOK include/linux/netfilter.h:325 [inline]
 br_nf_pre_routing_ipv6+0x2c4/0x5f8 net/bridge/br_netfilter_ipv6.c:183
 br_nf_pre_routing+0x6e0/0x1168 net/bridge/br_netfilter_hooks.c:513
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xeb0/0x10dc net/bridge/br_input.c:451
 __netif_receive_skb_core+0x848/0x2a3c net/core/dev.c:6184
 __netif_receive_skb_one_core+0x70/0x110 net/core/dev.c:6295
 __netif_receive_skb+0x34/0x128 net/core/dev.c:6410
 process_backlog+0x588/0x14e0 net/core/dev.c:6761
 __napi_poll+0xb4/0x328 net/core/dev.c:7830
 napi_poll net/core/dev.c:7893 [inline]
 net_rx_action+0x5b0/0xc14 net/core/dev.c:8050
 handle_softirqs+0x324/0xcbc kernel/softirq.c:645
 __do_softirq+0x14/0x20 kernel/softirq.c:679
 ____do_softirq+0x10/0x1c arch/arm64/kernel/irq.c:78
 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:901
 do_softirq_own_stack+0x1c/0x28 arch/arm64/kernel/irq.c:83
 do_softirq+0x90/0xf8 kernel/softirq.c:546
 __local_bh_enable_ip+0x190/0x234 kernel/softirq.c:473
 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline]
 _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245
 spin_unlock_bh include/linux/spinlock.h:407 [inline]
 batadv_tt_local_purge+0x274/0x2f0 net/batman-adv/translation-table.c:1402
 batadv_tt_purge+0x44/0x7b4 net/batman-adv/translation-table.c:3753
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3479
 rescuer_thread+0x68c/0xd90 kernel/workqueue.c:3703
 kthread+0x304/0x3d4 kernel/kthread.c:436
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854
net_ratelimit: 106525 callbacks suppressed
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

Forwarded: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Author: omermetekaya0@gmail.com

From c6056a11b2100b30f1ea3b921055a40a48010bfb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=96mer=20Mete=20Kaya?= <omermetekaya0@gmail.com>
Date: Wed, 28 Oct 2026 21:38:11 +0300
Subject: [PATCH] batman-adv: batch softirq drain in tt_purge to fix workqueue
 lockup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace per-bucket spin_lock_bh()/spin_unlock_bh() with outer
local_bh_disable()/enable() and periodic drain every 64 buckets
to avoid excessive softirq processing during TT purge.

Add may_sleep parameter to batadv_tt_local_purge() since it is
called both from workqueue context (where cond_resched is safe)
and under commit_lock spinlock in batadv_tt_local_resize_to_mtu()
(where sleeping is not allowed).

Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Reported-by: syzbot+61b202fdc410840f0198@syzkaller.appspotmail.com
Signed-off-by: Ömer Mete Kaya <omermetekaya0@gmail.com>
---
 net/batman-adv/translation-table.c | 30 +++++++++++++++++++++++-------
 1 file changed, 23 insertions(+), 7 deletions(-)

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 68f79853032e..915f5589e056 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -1386,21 +1386,29 @@ static void batadv_tt_local_purge_list(struct batadv_priv *bat_priv,
  *  inactive or not
  */
 static void batadv_tt_local_purge(struct batadv_priv *bat_priv,
-				  int timeout)
+				  int timeout, bool may_sleep)
 {
 	spinlock_t *list_lock; /* protects write access to the hash lists */
 	struct batadv_hashtable *hash = bat_priv->tt.local_hash;
 	struct hlist_head *head;
 	u32 i;

+	local_bh_disable();
 	for (i = 0; i < hash->size; i++) {
 		head = &hash->table[i];
 		list_lock = &hash->list_locks[i];

-		spin_lock_bh(list_lock);
+		spin_lock(list_lock);
 		batadv_tt_local_purge_list(bat_priv, head, timeout);
-		spin_unlock_bh(list_lock);
+		spin_unlock(list_lock);
+
+		if (may_sleep && (i & 63) == 63) {
+			local_bh_enable();
+			cond_resched();
+			local_bh_disable();
+		}
 	}
+	local_bh_enable();
 }

 /**
@@ -2363,11 +2371,12 @@ static void batadv_tt_global_purge(struct batadv_priv *bat_priv)
 	char *msg = NULL;
 	u32 i;

+	local_bh_disable();
 	for (i = 0; i < hash->size; i++) {
 		head = &hash->table[i];
 		list_lock = &hash->list_locks[i];

-		spin_lock_bh(list_lock);
+		spin_lock(list_lock);
 		hlist_for_each_entry_safe(tt_common, node_tmp, head,
 					  hash_entry) {
 			tt_global = container_of(tt_common,
@@ -2387,8 +2396,15 @@ static void batadv_tt_global_purge(struct batadv_priv *bat_priv)

 			batadv_tt_global_entry_put(tt_global);
 		}
-		spin_unlock_bh(list_lock);
+		spin_unlock(list_lock);
+
+		if ((i & 63) == 63) {
+			local_bh_enable();
+			cond_resched();
+			local_bh_disable();
+		}
 	}
+	local_bh_enable();
 }

 /**
@@ -3750,7 +3766,7 @@ static void batadv_tt_purge(struct work_struct *work)
 	priv_tt = container_of(delayed_work, struct batadv_priv_tt, work);
 	bat_priv = container_of(priv_tt, struct batadv_priv, tt);

-	batadv_tt_local_purge(bat_priv, BATADV_TT_LOCAL_TIMEOUT);
+	batadv_tt_local_purge(bat_priv, BATADV_TT_LOCAL_TIMEOUT, true);
 	batadv_tt_global_purge(bat_priv);
 	batadv_tt_req_purge(bat_priv);
 	batadv_tt_roam_purge(bat_priv);
@@ -4156,7 +4172,7 @@ void batadv_tt_local_resize_to_mtu(struct net_device *mesh_iface)
 		if (packet_size_max >= table_size)
 			break;

-		batadv_tt_local_purge(bat_priv, timeout);
+		batadv_tt_local_purge(bat_priv, timeout, false);
 		batadv_tt_local_purge_pending_clients(bat_priv);

 		timeout /= 2;
--
2.56.0

Forwarded: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Author: valigurasm@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
master

Forwarded: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Author: tristmd@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

>From fa9693d02a6d2e2fda72504085400c761d5eec1f Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Sat, 18 Apr 2026 13:39:03 +0000
Subject: [PATCH] hfsplus: zero-initialize buffer in hfs_bnode_read

hfs_bnode_read() can return early without initializing the output
buffer when the offset is invalid or the requested length is
corrected to zero by check_and_correct_requested_length().  Callers
such as hfs_bnode_read_u16() pass stack-allocated buffers and use the
result unconditionally, leading to KMSAN uninit-value reports.

Rather than initializing at each individual call site, zero the buffer
at the start of hfs_bnode_read() before any validation checks.  This
ensures the buffer is always in a known state regardless of which
early-return path is taken.

Reported-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Tested-by: syzbot+217eb327242d08197efb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=217eb327242d08197efb
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/hfsplus/bnode.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/hfsplus/bnode.c b/fs/hfsplus/bnode.c
index f8b5a8ae58ff5..14d1af2c7ba93 100644
--- a/fs/hfsplus/bnode.c
+++ b/fs/hfsplus/bnode.c
@@ -25,6 +25,8 @@ void hfs_bnode_read(struct hfs_bnode *node, void *buf, u32 off, u32 len)
 	struct page **pagep;
 	u32 l;
 
+	memset(buf, 0, len);
+
 	if (!is_bnode_offset_valid(node, off))
 		return;
 
-- 
2.47.3

Forwarded: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Author: tristmd@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

>From 9c3f65e66c3a938b75d165bec0686e05db473070 Mon Sep 17 00:00:00 2001
From: Tristan Madani <tristan@talencesecurity.com>
Date: Thu, 30 Apr 2026 23:57:44 +0000
Subject: [PATCH] jffs2: fix GC thread BUG_ON during reconfigure via fspick

jffs2_do_remount_fs() uses fc->sb_flags to decide whether to start
the garbage collection thread.  However, when called via fspick(2)
followed by fsconfig(FSCONFIG_CMD_RECONFIGURE), fc->sb_flags does
not reflect the current mount state -- it only contains flags being
explicitly changed (as indicated by fc->sb_flags_mask).

When fspick() is called with flags=0 on a read-only mount,
fc->sb_flags has SB_RDONLY clear (since SB_RDONLY is not in
sb_flags_mask).  This causes jffs2_start_garbage_collect_thread()
to be called even though the filesystem remains read-only.  On the
second reconfigure, BUG_ON(c->gc_task) fires because the thread
from the first call is still running.

Fix this by computing the effective read-only state using both
fc->sb_flags and fc->sb_flags_mask.  Also unconditionally call
jffs2_stop_garbage_collect_thread() before potentially restarting
it, which is safe when gc_task is NULL and prevents the BUG_ON.

Reported-by: syzbot+61a9d95630970eece39d@syzkaller.appspotmail.com
Fixes: ec10a24f10c8f ("vfs: Convert jffs2 to use the new mount API")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
---
 fs/jffs2/fs.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 6ada8369a7622..33574312b7abe 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -396,28 +396,28 @@ void jffs2_dirty_inode(struct inode *inode, int flags)
 int jffs2_do_remount_fs(struct super_block *sb, struct fs_context *fc)
 {
 	struct jffs2_sb_info *c = JFFS2_SB_INFO(sb);
+	bool new_ro;
 
 	if (c->flags & JFFS2_SB_FLAG_RO && !sb_rdonly(sb))
 		return -EROFS;
 
-	/* We stop if it was running, then restart if it needs to.
-	   This also catches the case where it was stopped and this
-	   is just a remount to restart it.
-	   Flush the writebuffer, if necessary, else we loose it */
+	new_ro = (fc->sb_flags_mask & SB_RDONLY) ?
+		 (fc->sb_flags & SB_RDONLY) : sb_rdonly(sb);
+
+	jffs2_stop_garbage_collect_thread(c);
+
 	if (!sb_rdonly(sb)) {
-		jffs2_stop_garbage_collect_thread(c);
 		mutex_lock(&c->alloc_sem);
 		jffs2_flush_wbuf_pad(c);
 		mutex_unlock(&c->alloc_sem);
 	}
 
-	if (!(fc->sb_flags & SB_RDONLY))
+	if (!new_ro)
 		jffs2_start_garbage_collect_thread(c);
 
 	fc->sb_flags |= SB_NOATIME;
 	return 0;
 }
-
 /* jffs2_new_inode: allocate a new inode and inocache, add it to the hash,
    fill in the raw_inode while you're at it. */
 struct inode *jffs2_new_inode (struct inode *dir_i, umode_t mode, struct jffs2_raw_inode *ri)
-- 
2.47.3