syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P15542
	(detected by 0, t=10503 jiffies, g=180477, q=620)
task:syz.7.15703     state:R  running task     stack:23792 pid:15542 ppid: 11841 flags:0x0000400c
Call Trace:
 <IRQ>
 sched_show_task+0x459/0x580 kernel/sched/core.c:8659
 rcu_print_detail_task_stall_rnp kernel/rcu/tree_stall.h:233 [inline]
 print_other_cpu_stall+0xec5/0x1270 kernel/rcu/tree_stall.h:573
 check_cpu_stall kernel/rcu/tree_stall.h:745 [inline]
 rcu_pending kernel/rcu/tree.c:3936 [inline]
 rcu_sched_clock_irq+0x843/0x1120 kernel/rcu/tree.c:2619
 update_process_times+0x193/0x200 kernel/time/timer.c:1818
 tick_sched_handle kernel/time/tick-sched.c:254 [inline]
 tick_sched_timer+0x37d/0x560 kernel/time/tick-sched.c:1473
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x4ad/0xb70 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x3bb/0x8d0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
 __sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0x4d/0xc0 arch/x86/kernel/apic/apic.c:1108
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__read_once_word_nocheck+0x0/0x10 include/asm-generic/rwonce.h:67
Code: 38 c1 0f 8c c6 fc ff ff 4c 89 e7 e8 8a f1 88 00 48 ba 00 00 00 00 00 fc ff df e9 af fc ff ff 66 2e 0f 1f 84 00 00 00 00 00 90 <48> 8b 07 c3 00 00 cc cc 00 00 cc cc 00 00 cc cc 31 c0 81 ff 03 00
RSP: 0018:ffffc900000074e0 EFLAGS: 00000202
RAX: ffffc9000322f401 RBX: ffffc900000075a8 RCX: 1ffff92000000e01
RDX: 1ffffffff1cff744 RSI: ffffffff8e7fb9ea RDI: ffffc9000322f470
RBP: ffffc900000075f0 R08: 000000000000000a R09: 0000000000000019
R10: dffffc0000000000 R11: fffff52000000ec1 R12: 1ffffffff1cff744
R13: ffffc90003230000 R14: ffffc90003228000 R15: ffffc9000322f470
 deref_stack_reg arch/x86/kernel/unwind_orc.c:360 [inline]
 unwind_next_frame+0x9c4/0x1d90 arch/x86/kernel/unwind_orc.c:539
 arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc mm/kasan/common.c:513 [inline]
 __kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522
 kmalloc_reserve net/core/skbuff.c:356 [inline]
 __alloc_skb+0x22c/0x750 net/core/skbuff.c:427
 __netdev_alloc_skb+0x110/0x4c0 net/core/skbuff.c:494
 netdev_alloc_skb include/linux/skbuff.h:3024 [inline]
 dev_alloc_skb include/linux/skbuff.h:3037 [inline]
 hsr_init_skb+0xdc/0x580 net/hsr/hsr_device.c:269
 send_hsr_supervision_frame+0x13c/0xb80 net/hsr/hsr_device.c:312
 hsr_announce+0x168/0x310 net/hsr/hsr_device.c:405
 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x53a/0x7f0 kernel/time/timer.c:1767
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
 handle_softirqs+0x339/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:22 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:132 [inline]
RIP: 0010:preempt_schedule_irq+0xc1/0x160 kernel/sched/core.c:6800
Code: 0b 48 f7 03 08 00 00 00 74 7f bf 01 00 00 00 e8 e5 2f 8e f7 e8 70 19 bb f7 fb bf 01 00 00 00 e8 65 b5 ff ff 43 c6 44 37 08 00 <48> c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24 40 43 c6 44 37
RSP: 0018:ffffc9000322ecc0 EFLAGS: 00000246
RAX: 4a39c2ab86a66300 RBX: 0000000000000000 RCX: 4a39c2ab86a66300
RDX: dffffc0000000000 RSI: ffffffff8a2b2780 RDI: ffff8880258633d0
RBP: ffffc9000322ed60 R08: ffffffff901d118f R09: 1ffffffff203a231
R10: dffffc0000000000 R11: fffffbfff203a232 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000645d98
 irqentry_exit+0x63/0x70 kernel/entry/common.c:432
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:arch_stack_walk+0x11e/0x140 arch/x86/kernel/stacktrace.c:30
Code: c0 74 1e 48 89 df 48 89 c6 41 ff d6 84 c0 74 11 4c 89 ff e8 34 35 08 00 83 bd 78 ff ff ff 00 75 d5 65 48 8b 04 25 28 00 00 00 <48> 3b 45 d8 75 0d 48 83 c4 68 5b 41 5c 41 5e 41 5f 5d c3 e8 4a 11
RSP: 0018:ffffc9000322ee28 EFLAGS: 00000246
RAX: 4a39c2ab86a66300 RBX: ffffc9000322eee0 RCX: 4a39c2ab86a66300
RDX: 0000000000000002 RSI: ffffffff8a2b3a20 RDI: ffffffff8a79f780
RBP: ffffc9000322eeb0 R08: ffffffff8d89d8af R09: 1ffffffff1b13b15
R10: dffffc0000000000 R11: fffffbfff1b13b16 R12: ffff888025861dc0
R13: ffff8881411d4280 R14: ffffffff81679ee0 R15: ffffc9000322ee28
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0x9c/0xd0 mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc+0x100/0x290 mm/slub.c:3238
 dst_alloc+0x101/0x160 net/core/dst.c:88
 rt_dst_alloc net/ipv4/route.c:1658 [inline]
 __mkroute_output net/ipv4/route.c:2631 [inline]
 ip_route_output_key_hash_rcu+0x15ee/0x24d0 net/ipv4/route.c:2854
 ip_route_output_key_hash+0x1c6/0x300 net/ipv4/route.c:2683
 __ip_route_output_key include/net/route.h:126 [inline]
 ip_route_output_flow+0x26/0x150 net/ipv4/route.c:2913
 tcp_v4_connect+0xdab/0x1a80 net/ipv4/tcp_ipv4.c:292
 __inet_stream_connect+0x244/0xd70 net/ipv4/af_inet.c:672
 tcp_sendmsg_fastopen+0x38f/0x600 net/ipv4/tcp.c:1195
 tcp_sendmsg_locked+0x30cc/0x35f0 net/ipv4/tcp.c:1237
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1457
 sock_sendmsg_nosec net/socket.c:706 [inline]
 __sock_sendmsg net/socket.c:718 [inline]
 ____sys_sendmsg+0x5b7/0x8f0 net/socket.c:2445
 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2499
 __sys_sendmsg net/socket.c:2528 [inline]
 __do_sys_sendmsg net/socket.c:2537 [inline]
 __se_sys_sendmsg+0x1af/0x290 net/socket.c:2535
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7fcd237d0cb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcd21a0b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fcd23a4c090 RCX: 00007fcd237d0cb9
RDX: 000000003000c085 RSI: 0000200000000080 RDI: 0000000000000009
RBP: 00007fcd2383ebf7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcd23a4c128 R14: 00007fcd23a4c090 R15: 00007ffd9e766758
 </TASK>
rcu: rcu_preempt kthread starved for 201 jiffies! g180477 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:26896 pid:   15 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11ef/0x43c0 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_timeout+0x184/0x2d0 kernel/time/timer.c:1914
 rcu_gp_fqs_loop+0x2be/0x11d0 kernel/rcu/tree.c:1972
 rcu_gp_kthread+0x9b/0x370 kernel/rcu/tree.c:2145
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 15544 Comm: syz.0.15705 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:perf_event_output_forward+0x0/0x2e0 kernel/events/core.c:7821
Code: a0 00 00 00 75 12 48 89 d8 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 1d eb 23 08 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 <55> 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec e0 00
RSP: 0018:ffffc90000dd0318 EFLAGS: 00000046
RAX: ffffffff8197fdb0 RBX: ffff88806978c7a0 RCX: ffff88801de3d940
RDX: ffffc90000dd08b8 RSI: ffffc90000dd0400 RDI: ffff88806978c7a0
RBP: ffffc90000dd0400 R08: ffff8880b9133d77 R09: 1ffff110172267ae
R10: dffffc0000000000 R11: ffffed10172267af R12: dffffc0000000000
R13: 0000000000000000 R14: 0000000000000000 R15: ffffc90000dd08b8
FS:  00007f9281e3b6c0(0000) GS:ffff8880b9100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7be3a77000 CR3: 000000007d41b000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 __perf_event_overflow+0x364/0x530 kernel/events/core.c:9515
 perf_swevent_hrtimer+0x41b/0x5b0 kernel/events/core.c:10934
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x4ad/0xb70 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x3bb/0x8d0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
 __sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0x4d/0xc0 arch/x86/kernel/apic/apic.c:1108
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194
Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 8f 0b 8d f7 65 8b 05 10 18 3d 76 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc90000dd0960 EFLAGS: 00000206
RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: 8c1fc383d08af500
RDX: dffffc0000000000 RSI: ffffffff8a2b2780 RDI: 0000000000000001
RBP: ffffc90000dd09f0 R08: ffffffff901d1157 R09: 1ffffffff203a22a
R10: dffffc0000000000 R11: fffffbfff203a22b R12: dffffc0000000000
R13: ffff8880b91280c0 R14: ffff8880b91280c0 R15: 1ffff920001ba12c
 __mod_timer+0x8ee/0xd20 kernel/time/timer.c:1065
 addrconf_mod_rs_timer+0x51/0xe0 net/ipv6/addrconf.c:328
 addrconf_rs_timer+0x3b2/0x630 net/ipv6/addrconf.c:3965
 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1451
 expire_timers kernel/time/timer.c:1496 [inline]
 __run_timers+0x53a/0x7f0 kernel/time/timer.c:1767
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
 handle_softirqs+0x339/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:finish_lock_switch+0x134/0x280 kernel/sched/core.c:4804
Code: be ff ff ff ff e8 4c 80 67 08 85 c0 74 4a 4d 85 ff 75 66 0f 1f 44 00 00 48 89 df e8 b6 eb 70 08 e8 41 e0 2a 00 fb 48 83 c4 08 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 48 89 df e8 c9 09 fe ff 43 80 3c
RSP: 0018:ffffc9000333f368 EFLAGS: 00000282
RAX: 8c1fc383d08af500 RBX: ffff8880b913a340 RCX: 8c1fc383d08af500
RDX: dffffc0000000000 RSI: ffffffff8a2b2780 RDI: ffffffff8a79f780
RBP: 1ffff11017227613 R08: ffff8880b913a343 R09: 1ffff11017227468
R10: dffffc0000000000 R11: ffffed1017227469 R12: 1ffff110172275c1
R13: dffffc0000000000 R14: ffff8880b913ae08 R15: 0000000000000000
 finish_task_switch+0x12f/0x640 kernel/sched/core.c:4921
 context_switch kernel/sched/core.c:5052 [inline]
 __schedule+0x11f7/0x43c0 kernel/sched/core.c:6395
 preempt_schedule_irq+0xbb/0x160 kernel/sched/core.c:6799
 irqentry_exit+0x63/0x70 kernel/entry/common.c:432
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:lock_acquire+0x208/0x400 kernel/locking/lockdep.c:5627
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3d 04 f8 0f 85 f1 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 43 c7 44 3d 08 00 00 00 00 65 48 8b 04
RSP: 0018:ffffc9000333f740 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 8c1fc383d08af500
RDX: 0000000000000000 RSI: ffffffff8a2b3a20 RDI: ffffffff8a79f780
RBP: ffffc9000333f850 R08: dffffc0000000000 R09: 1ffffffff203a218
R10: dffffc0000000000 R11: fffffbfff203a219 R12: ffffffff8c31eaa0
R13: 1ffff92000667ef4 R14: 0000000000000246 R15: dffffc0000000000
 rcu_lock_acquire+0x20/0x30 include/linux/rcupdate.h:313
 rcu_read_lock include/linux/rcupdate.h:740 [inline]
 percpu_ref_put_many include/linux/percpu-refcount.h:317 [inline]
 percpu_ref_put+0x16/0x150 include/linux/percpu-refcount.h:338
 css_put include/linux/cgroup.h:405 [inline]
 obj_cgroup_uncharge_pages mm/memcontrol.c:2998 [inline]
 refill_obj_stock+0x28f/0x470 mm/memcontrol.c:3259
 memcg_slab_free_hook+0x157/0x1f0 mm/slab.h:364
 do_slab_free mm/slub.c:3437 [inline]
 ___cache_free+0x63/0x120 mm/slub.c:3511
 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xd0 mm/kasan/common.c:444
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc+0x100/0x290 mm/slub.c:3238
 sk_prot_alloc+0x57/0x210 net/core/sock.c:1860
 sk_alloc+0x2f/0x310 net/core/sock.c:1922
 inet_create+0x728/0xef0 net/ipv4/af_inet.c:322
 __sock_create+0x47b/0x900 net/socket.c:1495
 sock_create net/socket.c:1551 [inline]
 __sys_socket+0xe2/0x170 net/socket.c:1593
 __do_sys_socket net/socket.c:1602 [inline]
 __se_sys_socket net/socket.c:1600 [inline]
 __x64_sys_socket+0x76/0x80 net/socket.c:1600
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9283c00cb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9281e3b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 00007f9283e7c090 RCX: 00007f9283c00cb9
RDX: 0000000000000000 RSI: 0200000000000001 RDI: 0000000000000002
RBP: 00007f9283c6ebf7 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9283e7c128 R14: 00007f9283e7c090 R15: 00007ffe5ebb18f8
 </TASK>