syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 GPs behind) idle=e55c/1/0x4000000000000000 softirq=17280/17284 fqs=0
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P11/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=15105, q=359 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 7203 Comm: syz.4.461 Not tainted 6.14.0-rc3-syzkaller-00079-g87a132e73910 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:enqueue_hrtimer+0x129/0x3c0 kernel/time/hrtimer.c:1103
Code: 89 de 83 e6 10 31 ff e8 d5 98 12 00 83 e3 10 0f 84 b6 00 00 00 e8 c7 95 12 00 49 8d 6d 08 48 89 e8 48 c1 e8 03 42 0f b6 04 20 <84> c0 0f 85 e4 00 00 00 8b 6d 00 bf 20 00 00 00 89 ee e8 e0 99 12
RSP: 0018:ffffc90000a18d08 EFLAGS: 00000012
RAX: 0000000000000000 RBX: 0000000000000010 RCX: ffff88802fe0bc00
RDX: 0000000000010000 RSI: 0000000000000010 RDI: 0000000000000000
RBP: ffff8880b872c608 R08: ffffffff81af24bb R09: 1ffffffff2079cee
R10: dffffc0000000000 R11: fffffbfff2079cef R12: dffffc0000000000
R13: ffff8880b872c600 R14: ffff88805bb35340 R15: 1ffff110170e58c0
FS:  00007fa1bb9f66c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fcab9a76000 CR3: 000000007fae4000 CR4: 0000000000350ef0
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1818 [inline]
 __hrtimer_run_queues+0x6cb/0xd30 kernel/time/hrtimer.c:1865
 hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1927
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x112/0x420 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:seqcount_lockdep_reader_access+0x189/0x1e0 include/linux/seqlock.h:75
Code: 42 80 3c 23 00 74 08 4c 89 ff e8 72 f7 0c 00 f6 44 24 41 02 75 50 f7 44 24 18 00 02 00 00 74 01 fb 48 c7 44 24 20 0e 36 e0 45 <4b> c7 04 34 00 00 00 00 66 43 c7 44 34 09 00 00 43 c6 44 34 0b 00
RSP: 0018:ffffc9000c2ff200 EFLAGS: 00000206
RAX: 84da8b4a14865700 RBX: 1ffff9200185fe48 RCX: ffffffff819d265a
RDX: dffffc0000000000 RSI: ffffffff8c2aa440 RDI: ffffffff8c80ed80
RBP: ffffc9000c2ff2e0 R08: ffffffff945468ff R09: 1ffffffff28a8d1f
R10: dffffc0000000000 R11: fffffbfff28a8d20 R12: dffffc0000000000
R13: ffff88813fffbd58 R14: 1ffff9200185fe44 R15: ffffc9000c2ff240
 read_seqbegin include/linux/seqlock.h:836 [inline]
 zone_span_seqbegin include/linux/memory_hotplug.h:103 [inline]
 page_outside_zone_boundaries mm/page_alloc.c:437 [inline]
 bad_range+0x5f/0x280 mm/page_alloc.c:456
 rmqueue mm/page_alloc.c:3094 [inline]
 get_page_from_freelist+0x3640/0x37a0 mm/page_alloc.c:3474
 __alloc_frozen_pages_noprof+0x292/0x710 mm/page_alloc.c:4739
 alloc_pages_mpol+0x311/0x660 mm/mempolicy.c:2270
 folio_alloc_mpol_noprof+0x36/0x70 mm/mempolicy.c:2289
 shmem_alloc_folio mm/shmem.c:1863 [inline]
 shmem_alloc_and_add_folio+0x4a0/0x1090 mm/shmem.c:1902
 shmem_get_folio_gfp+0x621/0x1840 mm/shmem.c:2522
 shmem_get_folio mm/shmem.c:2628 [inline]
 shmem_write_begin+0x165/0x350 mm/shmem.c:3278
 generic_perform_write+0x348/0x990 mm/filemap.c:4189
 shmem_file_write_iter+0xf9/0x120 mm/shmem.c:3454
 new_sync_write fs/read_write.c:586 [inline]
 vfs_write+0xad1/0xd10 fs/read_write.c:679
 ksys_write+0x18f/0x2b0 fs/read_write.c:731
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa1bdb8b89f
Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48
RSP: 002b:00007fa1bb9f5df0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000001000000 RCX: 00007fa1bdb8b89f
RDX: 0000000001000000 RSI: 00007fa1b3400000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000000061c7
R10: 000000000000077c R11: 0000000000000293 R12: 0000000000000003
R13: 00007fa1bb9f5ef0 R14: 00007fa1bb9f5eb0 R15: 00007fa1b3400000
 </TASK>
task:kworker/u8:0    state:R  running task     stack:18872 pid:11    tgid:11    ppid:2      task_flags:0x4208060 flags:0x00004000
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0x190e/0x4c90 kernel/sched/core.c:6765
 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7087
 irqentry_exit+0x5e/0x90 kernel/entry/common.c:354
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:26 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:87 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:123 [inline]
RIP: 0010:lock_release+0x190/0xa30 kernel/locking/lockdep.c:5868
Code: 00 00 00 4c 89 f3 48 c1 eb 03 42 80 3c 3b 00 74 08 4c 89 f7 e8 51 22 8c 00 4c 89 6c 24 50 48 c7 84 24 b0 00 00 00 00 00 00 00 <9c> 8f 84 24 b0 00 00 00 42 80 3c 3b 00 74 08 4c 89 f7 e8 39 21 8c
RSP: 0018:ffffc90000107980 EFLAGS: 00000246
RAX: ffffffff940b6710 RBX: 1ffff92000020f46 RCX: ffffffff819cd570
RDX: 0000000000000000 RSI: ffffffff8c80ed60 RDI: ffffffff8c80ed20
RBP: ffffc90000107aa8 R08: ffffffff903ce777 R09: 1ffffffff2079cee
R10: dffffc0000000000 R11: fffffbfff2079cef R12: 1ffff92000020f3c
R13: ffffffff8bd38e7b R14: ffffc90000107a30 R15: dffffc0000000000
 rcu_lock_release include/linux/rcupdate.h:347 [inline]
 rcu_read_unlock include/linux/rcupdate.h:880 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:412 [inline]
 batadv_nc_worker+0x28b/0x610 net/batman-adv/network-coding.c:719
 process_one_work kernel/workqueue.c:3236 [inline]
 process_scheduled_works+0xac0/0x18e0 kernel/workqueue.c:3317
 worker_thread+0x870/0xd30 kernel/workqueue.c:3398
 kthread+0x7ab/0x920 kernel/kthread.c:464
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
rcu: rcu_preempt kthread starved for 10502 jiffies! g15105 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:26104 pid:17    tgid:17    ppid:2      task_flags:0x208040 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0x190e/0x4c90 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6857
 schedule_timeout+0x15a/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x2df/0x1330 kernel/rcu/tree.c:2024
 rcu_gp_kthread+0xa7/0x3b0 kernel/rcu/tree.c:2226
 kthread+0x7ab/0x920 kernel/kthread.c:464
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 7226 Comm: syz.3.471 Not tainted 6.14.0-rc3-syzkaller-00079-g87a132e73910 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:csd_lock_wait kernel/smp.c:340 [inline]
RIP: 0010:smp_call_function_many_cond+0x1bae/0x2d30 kernel/smp.c:885
Code: 89 e6 83 e6 01 31 ff e8 30 f5 0b 00 41 83 e4 01 4c 8b 64 24 68 75 07 e8 e0 f0 0b 00 eb 41 f3 90 48 b8 00 00 00 00 00 fc ff df <0f> b6 04 03 84 c0 75 11 41 f7 45 00 01 00 00 00 74 1e e8 bb f0 0b
RSP: 0018:ffffc9000b90f880 EFLAGS: 00000293
RAX: dffffc0000000000 RBX: 1ffff110170e88f9 RCX: ffff8880462d1e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000b90fa80 R08: ffffffff81b5c9a0 R09: 1ffffffff28a8d08
R10: dffffc0000000000 R11: fffffbfff28a8d09 R12: ffff8880b863fb48
R13: ffff8880b87447c8 R14: ffff8880b863fb40 R15: 0000000000000001
FS:  0000555558b20500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c246e15 CR3: 0000000044594000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 </IRQ>
 <TASK>
 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1052
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:2118 [inline]
 text_poke_bp_batch+0x352/0xb30 arch/x86/kernel/alternative.c:2328
 text_poke_flush arch/x86/kernel/alternative.c:2519 [inline]
 text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2526
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 static_key_disable_cpuslocked+0xd2/0x1c0 kernel/jump_label.c:240
 static_key_disable+0x1a/0x20 kernel/jump_label.c:248
 tracepoint_remove_func kernel/tracepoint.c:370 [inline]
 tracepoint_probe_unregister+0x83c/0xa10 kernel/tracepoint.c:504
 bpf_raw_tp_link_release+0x45/0x70 kernel/bpf/syscall.c:3614
 bpf_link_free+0xff/0x3a0 kernel/bpf/syscall.c:3136
 bpf_link_put_direct kernel/bpf/syscall.c:3179 [inline]
 bpf_link_release+0x78/0x90 kernel/bpf/syscall.c:3186
 __fput+0x3eb/0x9f0 fs/file_table.c:464
 task_work_run+0x251/0x310 kernel/task_work.c:227
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x13f/0x340 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fcdb618cde9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff7f9f3d68 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 000000000001f7ff RCX: 00007fcdb618cde9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007fcdb63a7ba0 R08: 0000000000000001 R09: 000000047f9f405f
R10: 00007fcdb6000000 R11: 0000000000000246 R12: 00007fcdb63a5fac
R13: 00007fcdb63a5fa0 R14: ffffffffffffffff R15: 00007fff7f9f3e80
 </TASK>