CC+: linux-crypto and rhashtable maintainers, On Sep 12, 2026 / 18:31, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: a9d7ced84989 Add linux-next specific files for 20260908 > git tree: linux-next > console output: https://syzkaller.appspot.com/x/log.txt?x=10880f49580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=17eeb09695a2b3c9 > dashboard link: https://syzkaller.appspot.com/bug?extid=4d0e4d2db6dfde01b52f > compiler: Debian clang version 22.1.8 > (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > > Unfortunately, I don't have any reproducer for this issue yet. > > Downloadable assets: > disk image: > https://storage.googleapis.com/syzbot-assets/4f470407358e/disk-a9d7ced8.raw.xz > vmlinux: > https://storage.googleapis.com/syzbot-assets/858b9d7ba687/vmlinux-a9d7ced8.xz > kernel image: > https://storage.googleapis.com/syzbot-assets/ef971d22d75f/bzImage-a9d7ced8.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: [email protected] > > ------------[ cut here ]------------ > Looking for class "&ht->mutex" with key xfrm_policy_init.__key.84, but found > a different class "key" with the same key > WARNING: kernel/locking/lockdep.c:958 at look_up_lock_class+0x8c/0x110 > kernel/locking/lockdep.c:955, CPU#1: kworker/1:6/5751 > Modules linked in: > CPU: 1 UID: 0 PID: 5751 Comm: kworker/1:6 Tainted: G L > syzkaller #0 PREEMPT(full) > Tainted: [L]=SOFTLOCKUP > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS > Google 07/24/2026 > Workqueue: usb_hub_wq hub_event > RIP: 0010:look_up_lock_class+0x9a/0x110 kernel/locking/lockdep.c:955 > Code: 00 00 49 3b 46 18 0f 84 82 00 00 00 49 81 3e d0 44 58 94 74 79 48 8d 3d > 44 f2 94 04 49 8b 16 49 8b 76 18 48 8b 8b b8 00 00 00 <67> 48 0f b9 3a eb 5d > 90 89 f3 e8 67 0a f4 f8 e8 32 5c be f5 48 c7 > RSP: 0018:ffffc90000a38070 EFLAGS: 00010002 > RAX: ffffffff8c6bb940 RBX: ffffffff94478508 RCX: ffffffff8c6bb940 > RDX: ffffffff9af23440 RSI: ffffffff8c6bb900 RDI: ffffffff907ddb20 > RBP: 00000000ffffffff R08: 0000000000000100 R09: 0000000000000004 > R10: 0000000000000003 R11: 0000000000000300 R12: 0000000000000246 > R13: ffff8880307a8000 R14: ffffffff9af232c8 R15: ffffffff9af23440 > FS: 0000000000000000(0000) GS:ffff888124db7000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000001b3401aff8 CR3: 0000000074540000 CR4: 00000000003526f0 > Call Trace: > <IRQ> > match_held_lock+0x9a/0x120 kernel/locking/lockdep.c:5364 > __lock_is_held kernel/locking/lockdep.c:5654 [inline] > lock_is_held_type+0x89/0x150 kernel/locking/lockdep.c:6016 > __rhashtable_lookup include/linux/rhashtable.h:623 [inline] > rhashtable_lookup include/linux/rhashtable.h:668 [inline] > xfrm_policy_inexact_lookup_rcu+0x60/0x750 net/xfrm/xfrm_policy.c:2068 > xfrm_policy_lookup_bytype+0xb35/0x1840 net/xfrm/xfrm_policy.c:2193 ...
FYI, I also observed the WARN at look_up_lock_class() and match_held_lock() called in the rhashtable_lookup() context [1]. I used the kernel next-20260909. The WARN was observed during the run of blktests test case block/008 on dm- flakey device, but this test workload does not look related to the WARN. I tried to reproduce the WARN by repeating the test workload hundreds of times, and succeeded only once. The WARN looks rare, but I'm sure the WARN happned. The call trace that syzbot reported and that I observed look rather different. The common part across them is the rhashtable_lookup() call. So I think it is the better to involve rhashtable experts. I took the liberty CC to them. [1] WARN observed at blktests block/008 for dm-flakey WARNING: kernel/locking/lockdep.c:955 at look_up_lock_class+0xa8/0x170, CPU#14: kworker/14:1/309662 Modules linked in: dm_flakey iscsi_target_mod tcm_loop target_core_pscsi target_core_file target_core_iblock xfs target_core_user target_core_mod nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject qrtr nft_ct nft_chain_nat ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle rfkill iptable_raw iptable_security nf_tables ip6table_filter ip6_tables iptable_filter ip_tables irdma ice sunrpc libie_fwlog gnss idpf libeth_xdp libie_pci libie_cp libeth ib_core intel_rapl_msr intel_rapl_common intel_uncore_frequency intel_uncore_frequency_common skx_edac skx_edac_common nfit libnvdimm x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel spi_nor mtd kvm i40e irqbypass iTCO_wdt rapl intel_pmc_bxt vfat ses intel_cstate libie fat intel_uncore libie_adminq enclosure i2c_i801 spi_intel_pci spi_intel i2c_smbus lpc_ich mei_me mei intel_pch_thermal wmi joydev ioatdma acpi_pad acpi_power_meter dca fuse dm_multipath zram lz4hc_compress zstd_compress ast drm_client_lib i2c_algo_bit drm_shmem_helper drm_kms_helper nvme drm nvme_core mpi3mr nvme_keyring nvme_auth scsi_transport_sas scsi_dh_alua pkcs8_key_parser scsi_dh_emc scsi_dh_rdac i2c_dev [last unloaded: null_blk] CPU: 14 UID: 0 PID: 309662 Comm: kworker/14:1 Tainted: G W 7.3.0-rc2-next-20260909-kts+ #1 PREEMPT(lazy) Tainted: [W]=WARN Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.5 05/18/2021 Workqueue: events drm_fb_helper_damage_work [drm_kms_helper] RIP: 0010:look_up_lock_class+0xa8/0x170 Code: 39 6b 40 75 ed 48 8b 8b b8 00 00 00 49 8b 74 24 18 48 39 f1 74 34 49 8b 14 24 48 81 fa f0 31 7f 9a 74 27 48 8d 3d b8 66 4a 02 <67> 48 0f b9 3a 48 89 d8 48 8b 6c 24 10 4c 8b 64 24 18 48 8b 5c 24 RSP: 0018:ffff888e40108088 EFLAGS: 00010002 RAX: 0000000000000001 RBX: ffffffff9e852a78 RCX: ffffffff97838ae0 RDX: ffffffffc271a2a0 RSI: ffffffff97838a60 RDI: ffffffff997aa470 RBP: ffffffffc271a2a0 R08: 0000000000000001 R09: ffff888133ab3018 R10: 0000000000000004 R11: ffff888e40108360 R12: ffff88812d59e1f8 R13: 0000000000000003 R14: 0000000000000246 R15: 00000000ffffffff FS: 0000000000000000(0000) GS:ffff888ea59d3000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055dba25b8c90 CR3: 00000002a6911004 CR4: 00000000007726f0 PKRU: 55555554 Call Trace: <IRQ> match_held_lock+0xdb/0x130 lock_is_held_type+0xb0/0x180 nft_rhash_lookup+0x541/0x7e0 [nf_tables] ? find_held_lock+0x2b/0x80 ? __lock_release.isra.0+0x69/0x1a0 ? lock_release.part.0+0x1c/0x50 ? __pfx_nft_rhash_lookup+0x10/0x10 [nf_tables] nft_set_do_lookup+0x1ac/0x2a0 [nf_tables] ? fib_lookup_good_nhc+0x104/0x380 nft_lookup_eval+0xcc/0x590 [nf_tables] ? lock_is_held_type+0xb0/0x180 nft_do_chain+0x2a9/0x1680 [nf_tables] ? __lock_acquire+0x690/0xd00 ? __pfx_nft_do_chain+0x10/0x10 [nf_tables] ? lock_acquire.part.0+0xc8/0x240 ? find_held_lock+0x2b/0x80 ? __local_bh_enable_ip+0xb4/0x150 ? ipt_do_table+0xa10/0x11e0 [ip_tables] ? ipt_do_table+0xa15/0x11e0 [ip_tables] nft_do_chain_inet+0xdc/0x4a0 [nf_tables] ? __pfx_nft_do_chain_inet+0x10/0x10 [nf_tables] ? __pfx_ipt_do_table+0x10/0x10 [ip_tables] nf_hook_slow+0xbe/0x210 ? lock_is_held_type+0xb0/0x180 ip_local_deliver+0x2d0/0x4a0 ? __pfx_ip_local_deliver+0x10/0x10 ? __pfx_ip_local_deliver_finish+0x10/0x10 ? ip_rcv_finish_core+0x75b/0x1470 ? lock_is_held_type+0xb0/0x180 ip_list_rcv_finish+0x7f8/0xbb0 ? ip_sublist_rcv+0x106/0x2f0 ? __pfx_ip_list_rcv_finish+0x10/0x10 ? __lock_release.isra.0+0x69/0x1a0 ip_sublist_rcv+0x8b/0x2f0 ? __pfx_ip_sublist_rcv+0x10/0x10 ? __pfx_ip_rcv_finish+0x10/0x10 ? ip_rcv_core+0x619/0xd00 ? kasan_save_stack+0x2f/0x50 ip_list_rcv+0x2dd/0x440 ? asm_common_interrupt+0x26/0x40 ? __pfx_ip_list_rcv+0x10/0x10 ? drm_atomic_helper_commit_planes+0x3bd/0x1040 [drm_kms_helper] ? commit_tail+0x204/0x4b0 [drm_kms_helper] ? __lock_acquire+0x691/0xd00 __netif_receive_skb_list_core+0x6bf/0xa10 ? __pfx___netif_receive_skb_list_core+0x10/0x10 ? lock_acquire.part.0+0xc8/0x240 ? netif_receive_skb_list_internal+0x382/0xc90 ? lock_acquire+0x11a/0x140 netif_receive_skb_list_internal+0x603/0xc90 ? dev_gro_receive+0x1e0/0x15f0 ? __pfx_netif_receive_skb_list_internal+0x10/0x10 ? napi_build_skb+0x55/0x1e0 ? i40e_process_skb_fields+0x4a6/0xea0 [i40e] ? i40e_clean_rx_irq+0x96f/0x2140 [i40e] napi_complete_done+0x1a4/0x900 ? __pfx_napi_complete_done+0x10/0x10 i40e_napi_poll+0x408/0xb70 [i40e] ? __pfx_i40e_napi_poll+0x10/0x10 [i40e] __napi_poll+0x351/0x520 net_rx_action+0x446/0xc30 ? __pfx_net_rx_action+0x10/0x10 ? do_raw_spin_unlock+0x59/0x230 ? lock_release.part.0+0x1c/0x50 ? sched_clock_cpu+0x69/0x630 ? mark_held_locks+0x40/0x70 handle_softirqs+0x1de/0x830 ? __pfx_handle_softirqs+0x10/0x10 ? irqtime_account_irq+0x3e/0x2d0 __irq_exit_rcu+0x164/0x290 irq_exit_rcu+0xe/0x20 common_interrupt+0x85/0xa0 </IRQ> <TASK> asm_common_interrupt+0x26/0x40 RIP: 0010:memcpy_toio+0xa3/0x120 Code: 5c e9 d1 59 9f 01 48 85 db 74 ee 40 f6 c5 01 75 49 48 83 fb 01 76 06 40 f6 c5 02 75 29 48 89 d9 48 89 ef 4c 89 e6 48 c1 e9 02 <f3> a5 f6 c3 02 74 02 66 a5 f6 c3 01 74 01 a4 48 83 c4 18 5b 5d 41 RSP: 0018:ffff88811b3a7538 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 0000000000001000 RCX: 00000000000003f0
