INFO: rcu detected stall in addr_doit

Status: upstream: reported on 2026/10/08 10:10
Reported-by: syzbot+57dfaf4929c6774a86ce@syzkaller.appspotmail.com
First crash: 12d, last: 12d

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
	(detected by 0, t=10502 jiffies, g=28241, q=1023)
rcu: All QSes seen, last rcu_preempt kthread activity 10502 (4294973110-4294962608), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g28241 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=20233
rcu: rcu_preempt kthread starved for 10502 jiffies! g28241 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:27472 pid:   15 ppid:     2 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5049 [inline]
 __schedule+0x11c3/0x4350 kernel/sched/core.c:6395
 schedule+0x11b/0x1e0 kernel/sched/core.c:6478
 schedule_timeout+0x184/0x2d0 kernel/time/timer.c:2117
 rcu_gp_fqs_loop+0x2be/0x11f0 kernel/rcu/tree.c:1972
 rcu_gp_kthread+0x9a/0x370 kernel/rcu/tree.c:2145
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 10658 Comm: syz.2.2380 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
 nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:166 [inline]
 rcu_check_gp_kthread_starvation+0x1cd/0x250 kernel/rcu/tree_stall.h:487
 print_other_cpu_stall+0x1110/0x1270 kernel/rcu/tree_stall.h:592
 check_cpu_stall kernel/rcu/tree_stall.h:745 [inline]
 rcu_pending kernel/rcu/tree.c:3936 [inline]
 rcu_sched_clock_irq+0x845/0x1120 kernel/rcu/tree.c:2619
 update_process_times+0x193/0x200 kernel/time/timer.c:2021
 tick_sched_handle kernel/time/tick-sched.c:254 [inline]
 tick_sched_timer+0x37d/0x560 kernel/time/tick-sched.c:1473
 __run_hrtimer kernel/time/hrtimer.c:1685 [inline]
 __hrtimer_run_queues+0x4b0/0xb60 kernel/time/hrtimer.c:1749
 hrtimer_interrupt+0x397/0x8b0 kernel/time/hrtimer.c:1811
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
 __sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0x4d/0xc0 arch/x86/kernel/apic/apic.c:1108
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194
Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 5f ce 86 f7 65 8b 05 e0 e4 36 76 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc90000007b40 EFLAGS: 00000206
RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: be6c9ad82e05a500
RDX: dffffc0000000000 RSI: ffffffff8a2b2be0 RDI: 0000000000000001
RBP: ffffc90000007bd8 R08: ffffffff910150c7 R09: 1ffffffff2202a18
R10: dffffc0000000000 R11: fffffbfff2202a19 R12: dffffc0000000000
R13: 0000000000000001 R14: ffffffff8d123400 R15: 1ffff92000000f68
 rcu_report_qs_rsp+0xad/0x1a0 kernel/rcu/tree.c:2170
 rcu_report_qs_rdp kernel/rcu/tree.c:2329 [inline]
 rcu_check_quiescent_state kernel/rcu/tree.c:2366 [inline]
 rcu_core+0x11c5/0x1650 kernel/rcu/tree.c:2747
 handle_softirqs+0x336/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:snprintf+0xbf/0x140 lib/vsprintf.c:2943
Code: c7 44 25 04 00 00 43 c6 44 25 06 00 ba 18 00 00 00 48 89 df 31 f6 e8 b0 ce b1 fd 48 b8 18 00 00 00 30 00 00 00 48 89 44 24 60 <48> 8d 45 10 48 89 44 24 68 48 8d 44 24 10 48 89 44 24 70 4c 89 ff
RSP: 0018:ffffc90003f7eb80 EFLAGS: 00000202
RAX: 0000003000000018 RBX: ffffc90003f7ebe0 RCX: 0000000000000000
RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffffc90003f7ebf8
RBP: ffffc90003f7ec70 R08: ffffc90003f7ebf7 R09: ffffc90003f7ebe0
R10: dffffc0000000000 R11: fffff520007efd7f R12: dffffc0000000000
R13: 1ffff920007efd78 R14: 000000000000000c R15: ffffc90003f7ecc0
 print_caller kernel/printk/printk.c:1283 [inline]
 info_print_prefix+0x1fa/0x360 kernel/printk/printk.c:1302
 record_print_text kernel/printk/printk.c:1349 [inline]
 console_unlock+0x650/0x10f0 kernel/printk/printk.c:2725
 vprintk_emit+0xc0/0x150 kernel/printk/printk.c:2274
 _printk+0xda/0x130 kernel/printk/printk.c:2299
 validate_nla lib/nlattr.c:401 [inline]
 __nla_validate_parse+0xc7f/0x27b0 lib/nlattr.c:613
 __nla_parse+0x3c/0x50 lib/nlattr.c:710
 __nlmsg_parse include/net/netlink.h:744 [inline]
 nlmsg_parse_deprecated include/net/netlink.h:783 [inline]
 addr_doit+0x1fc/0x4e0 net/phonet/pn_netlink.c:70
 rtnetlink_rcv_msg+0x7f1/0xf10 net/core/rtnetlink.c:5698
 netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2519
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:706 [inline]
 __sock_sendmsg net/socket.c:718 [inline]
 ____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
 __sys_sendmsg net/socket.c:2529 [inline]
 __do_sys_sendmsg net/socket.c:2538 [inline]
 __se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9f4b7f8199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9f49a50028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f9f4ba7ffa0 RCX: 00007f9f4b7f8199
RDX: 0000000020000800 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007f9f4b88f888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9f4ba80038 R14: 00007f9f4ba7ffa0 R15: 00007fffd39d0fe8
 </TASK>
NMI backtrace for cpu 0
CPU: 0 PID: 10658 Comm: syz.2.2380 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:kasan_check_range+0x1b0/0x290 mm/kasan/generic.c:-1
Code: f3 4d 01 f3 49 89 df 49 8d 5f 07 4d 85 ff 49 0f 49 df 48 83 e3 f8 49 29 df 74 0e 41 80 3b 00 75 69 49 ff c3 49 ff cf 75 f2 5b <41> 5c 41 5e 41 5f 5d c3 45 84 ff 0f 85 91 00 00 00 41 f7 c7 00 ff
RSP: 0018:ffffc90000006f38 EFLAGS: 00000056
RAX: 0000000000000001 RBX: ffff88803b58bb80 RCX: ffffffff815daa54
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff910150c0
RBP: 0000000000000009 R08: ffffffff910150c7 R09: 1ffffffff2202a18
R10: dffffc0000000000 R11: fffffbfff2202a19 R12: dffffc0000000001
R13: dffffc0000000000 R14: 1ffffffff2202a18 R15: 0000000000000001
FS:  00007f9f49a506c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f1df2d59ff8 CR3: 00000000201b4000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <IRQ>
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
 hlock_class kernel/locking/lockdep.c:197 [inline]
 mark_lock+0x94/0x320 kernel/locking/lockdep.c:4642
 mark_usage kernel/locking/lockdep.c:4585 [inline]
 __lock_acquire+0xdb9/0x7d40 kernel/locking/lockdep.c:5074
 lock_acquire+0x19f/0x400 kernel/locking/lockdep.c:5737
 rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:313
 rcu_read_lock include/linux/rcupdate.h:740 [inline]
 __perf_output_begin kernel/events/ring_buffer.c:163 [inline]
 perf_output_begin_forward+0xa5/0xa30 kernel/events/ring_buffer.c:271
 __perf_event_output kernel/events/core.c:7814 [inline]
 perf_event_output_forward+0x19b/0x2e0 kernel/events/core.c:7832
 __perf_event_overflow+0x35f/0x550 kernel/events/core.c:9525
 perf_swevent_overflow kernel/events/core.c:9601 [inline]
 perf_swevent_event+0x4b8/0x540 kernel/events/core.c:9639
 perf_tp_event+0x324/0xbe0 kernel/events/core.c:10057
 perf_trace_run_bpf_submit+0xf3/0x1c0 kernel/events/core.c:10031
 perf_trace_preemptirq_template+0x2aa/0x360 include/trace/events/preemptirq.h:14
 trace_irq_enable_rcuidle+0x108/0x180 include/trace/events/preemptirq.h:40
 trace_hardirqs_on+0x57/0x80 kernel/trace/trace_preemptirq.c:44
 asm_sysvec_irq_work+0x16/0x20 arch/x86/include/asm/idtentry.h:713
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xbc/0x120 kernel/locking/spinlock.c:194
Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 5f ce 86 f7 65 8b 05 e0 e4 36 76 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc90000007b40 EFLAGS: 00000206
RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: be6c9ad82e05a500
RDX: dffffc0000000000 RSI: ffffffff8a2b2be0 RDI: 0000000000000001
RBP: ffffc90000007bd8 R08: ffffffff910150c7 R09: 1ffffffff2202a18
R10: dffffc0000000000 R11: fffffbfff2202a19 R12: dffffc0000000000
R13: 0000000000000001 R14: ffffffff8d123400 R15: 1ffff92000000f68
 rcu_report_qs_rsp+0xad/0x1a0 kernel/rcu/tree.c:2170
 rcu_report_qs_rdp kernel/rcu/tree.c:2329 [inline]
 rcu_check_quiescent_state kernel/rcu/tree.c:2366 [inline]
 rcu_core+0x11c5/0x1650 kernel/rcu/tree.c:2747
 handle_softirqs+0x336/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:snprintf+0xbf/0x140 lib/vsprintf.c:2943
Code: c7 44 25 04 00 00 43 c6 44 25 06 00 ba 18 00 00 00 48 89 df 31 f6 e8 b0 ce b1 fd 48 b8 18 00 00 00 30 00 00 00 48 89 44 24 60 <48> 8d 45 10 48 89 44 24 68 48 8d 44 24 10 48 89 44 24 70 4c 89 ff
RSP: 0018:ffffc90003f7eb80 EFLAGS: 00000202
RAX: 0000003000000018 RBX: ffffc90003f7ebe0 RCX: 0000000000000000
RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffffc90003f7ebf8
RBP: ffffc90003f7ec70 R08: ffffc90003f7ebf7 R09: ffffc90003f7ebe0
R10: dffffc0000000000 R11: fffff520007efd7f R12: dffffc0000000000
R13: 1ffff920007efd78 R14: 000000000000000c R15: ffffc90003f7ecc0
 print_caller kernel/printk/printk.c:1283 [inline]
 info_print_prefix+0x1fa/0x360 kernel/printk/printk.c:1302
 record_print_text kernel/printk/printk.c:1349 [inline]
 console_unlock+0x650/0x10f0 kernel/printk/printk.c:2725
 vprintk_emit+0xc0/0x150 kernel/printk/printk.c:2274
 _printk+0xda/0x130 kernel/printk/printk.c:2299
 validate_nla lib/nlattr.c:401 [inline]
 __nla_validate_parse+0xc7f/0x27b0 lib/nlattr.c:613
 __nla_parse+0x3c/0x50 lib/nlattr.c:710
 __nlmsg_parse include/net/netlink.h:744 [inline]
 nlmsg_parse_deprecated include/net/netlink.h:783 [inline]
 addr_doit+0x1fc/0x4e0 net/phonet/pn_netlink.c:70
 rtnetlink_rcv_msg+0x7f1/0xf10 net/core/rtnetlink.c:5698
 netlink_rcv_skb+0x1e9/0x430 net/netlink/af_netlink.c:2519
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x78f/0x940 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x8ba/0xbe0 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:706 [inline]
 __sock_sendmsg net/socket.c:718 [inline]
 ____sys_sendmsg+0x5be/0x8f0 net/socket.c:2446
 ___sys_sendmsg+0x236/0x2e0 net/socket.c:2500
 __sys_sendmsg net/socket.c:2529 [inline]
 __do_sys_sendmsg net/socket.c:2538 [inline]
 __se_sys_sendmsg+0x1b7/0x2a0 net/socket.c:2536
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f9f4b7f8199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9f49a50028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f9f4ba7ffa0 RCX: 00007f9f4b7f8199
RDX: 0000000020000800 RSI: 0000200000000080 RDI: 0000000000000005
RBP: 00007f9f4b88f888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9f4ba80038 R14: 00007f9f4ba7ffa0 R15: 00007fffd39d0fe8
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/08 10:09 linux-5.15.y a051a4bf909f 4f6a9fcf .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan-perf INFO: rcu detected stall in addr_doit
* Struck through repros no longer work on HEAD.