linux-kernel - [syzbot] [net?] [virt?] [kvm?] BUG: soft lockup in vsock_loopback

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <69240d50.a70a0220.d98e3.007d.GAE@google.com>
Date: Sun, 23 Nov 2025 23:46:24 -0800
From: syzbot <syzbot+c3a176bfafbec366d774@...kaller.appspotmail.com>
To: davem@...emloft.net, edumazet@...gle.com, eperezma@...hat.com, 
	horms@...nel.org, jasowang@...hat.com, kuba@...nel.org, kvm@...r.kernel.org, 
	linux-kernel@...r.kernel.org, mst@...hat.com, netdev@...r.kernel.org, 
	pabeni@...hat.com, sgarzare@...hat.com, stefanha@...hat.com, 
	syzkaller-bugs@...glegroups.com, virtualization@...ts.linux.dev, 
	xuanzhuo@...ux.alibaba.com
Subject: [syzbot] [net?] [virt?] [kvm?] BUG: soft lockup in vsock_loopback_work

Hello,

syzbot found the following issue on:

HEAD commit:    e7c375b18160 Merge tag 'vfs-6.18-rc7.fixes' of gitolite.ke..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=121cfb42580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=c473789166ef75a5
dashboard link: https://syzkaller.appspot.com/bug?extid=c3a176bfafbec366d774
compiler:       arm-linux-gnueabi-gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/98a89b9f34e4/non_bootable_disk-e7c375b1.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/474d6d613c09/vmlinux-e7c375b1.xz
kernel image: https://storage.googleapis.com/syzbot-assets/9cfbda18d15c/zImage-e7c375b1.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+c3a176bfafbec366d774@...kaller.appspotmail.com

watchdog: BUG: soft lockup - CPU#1 stuck for 460s! [kworker/1:6:18885]
Modules linked in:
CPU: 1 UID: 0 PID: 18885 Comm: kworker/1:6 Not tainted syzkaller #0 PREEMPT 
Hardware name: ARM-Versatile Express
Workqueue: vsock-loopback vsock_loopback_work
PC is at arch_spin_lock arch/arm/include/asm/spinlock.h:74 [inline]
PC is at do_raw_spin_lock include/linux/spinlock.h:187 [inline]
PC is at __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline]
PC is at _raw_spin_lock_bh+0x40/0x58 kernel/locking/spinlock.c:178
LR is at get_lock_parent_ip include/linux/ftrace.h:1102 [inline]
LR is at preempt_latency_start kernel/sched/core.c:5775 [inline]
LR is at preempt_count_add+0x12c/0x150 kernel/sched/core.c:5800
pc : [<81a6de50>]    lr : [<8028fe9c>]    psr: 80000013
sp : df9cdda8  ip : df9cdd80  fp : df9cddbc
r10: 846a8b70  r9 : 83c92c05  r8 : 838f5400
r7 : 829faaf0  r6 : 85b91880  r5 : 85b91970  r4 : 85b91970
r3 : 00000008  r2 : 00000009  r1 : 00000000  r0 : 00000000
Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 30c5387d  Table: 848af1c0  DAC: 00000000
Call trace: 
[<81a6de10>] (_raw_spin_lock_bh) from [<8155efe8>] (spin_lock_bh include/linux/spinlock.h:356 [inline])
[<81a6de10>] (_raw_spin_lock_bh) from [<8155efe8>] (lock_sock_nested+0x1c/0x48 net/core/sock.c:3723)
 r5:85b91970 r4:85b91880
[<8155efcc>] (lock_sock_nested) from [<819eaefc>] (lock_sock include/net/sock.h:1679 [inline])
[<8155efcc>] (lock_sock_nested) from [<819eaefc>] (virtio_transport_recv_pkt+0x350/0xa4c net/vmw_vsock/virtio_transport_common.c:1631)
 r5:8ddf7780 r4:85b918e4
[<819eabac>] (virtio_transport_recv_pkt) from [<819eb7b4>] (vsock_loopback_work+0xf4/0x128 net/vmw_vsock/vsock_loopback.c:133)
 r10:846a8b70 r9:83c92c05 r8:829faaf0 r7:00000000 r6:00000000 r5:df9cde98
 r4:8ddf7780
[<819eb6c0>] (vsock_loopback_work) from [<802785a0>] (process_one_work+0x1b4/0x4f4 kernel/workqueue.c:3263)
 r8:838f5400 r7:ddde3d80 r6:83c92c00 r5:82c3de40 r4:830cf000
[<802783ec>] (process_one_work) from [<802791e8>] (process_scheduled_works kernel/workqueue.c:3346 [inline])
[<802783ec>] (process_one_work) from [<802791e8>] (worker_thread+0x1fc/0x3d8 kernel/workqueue.c:3427)
 r10:61c88647 r9:838f5400 r8:830cf02c r7:82804d40 r6:ddde3d80 r5:ddde3da0
 r4:830cf000
[<80278fec>] (worker_thread) from [<8028020c>] (kthread+0x12c/0x280 kernel/kthread.c:463)
 r10:00000000 r9:830cf000 r8:80278fec r7:dfb79e60 r6:8db08900 r5:838f5400
 r4:00000001
[<802800e0>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:137)
Exception stack(0xdf9cdfb0 to 0xdf9cdff8)
dfa0:                                     00000000 00000000 00000000 00000000
dfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
dfe0: 00000000 00000000 00000000 00000000 00000013 00000000
 r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:802800e0
 r4:849cc940
Sending NMI from CPU 1 to CPUs 0:


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@...glegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup