syzbot
INFO: rcu detected stall in kjournald2 (2)
Status:
upstream: reported on 2026/10/16 23:20
Reported-by: syzbot+5cfd0f158a484830941a@syzkaller.appspotmail.com
First crash: 18d, last: 18d
Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5102/1:b..l P8549/1:b..l
rcu: (detected by 1, t=10502 jiffies, g=22001, q=838 ncpus=2)
task:syz.3.855 state:R running task stack:27048 pid:8549 ppid:5775 flags:0x00004004
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6868
preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6892
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
__raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
_raw_spin_unlock+0x3a/0x40 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:391 [inline]
zap_pte_range mm/memory.c:1523 [inline]
zap_pmd_range mm/memory.c:1571 [inline]
zap_pud_range mm/memory.c:1600 [inline]
zap_p4d_range mm/memory.c:1621 [inline]
unmap_page_range+0x2577/0x32f0 mm/memory.c:1642
unmap_vmas+0x286/0x3f0 mm/memory.c:1732
exit_mmap+0x238/0xb90 mm/mmap.c:3302
__mmput+0x118/0x3a0 kernel/fork.c:1362
exit_mm+0x23f/0x340 kernel/exit.c:576
do_exit+0x909/0x2530 kernel/exit.c:877
do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
get_signal+0x12a6/0x1390 kernel/signal.c:2915
arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
__syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f06c559e559
RSP: 002b:00007ffc919335b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: 0000000000000001 RBX: 00000000000000f0 RCX: 00007f06c559e559
RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f06c5826098
RBP: 0000000000000095 R08: 0000000000000002 R09: 0000000000000000
R10: 00007f06c5825fa0 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f06c582609c R14: 00007f06c5826098 R15: 00007f06c5826090
</TASK>
task:jbd2/sda1-8 state:R running task stack:25512 pid:5102 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5382 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6701
preempt_schedule_irq+0xbf/0x150 kernel/sched/core.c:7011
irqentry_exit+0x67/0x70 kernel/entry/common.c:441
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:filter_irq_stacks+0x68/0x90 kernel/stacktrace.c:395
Code: 04 de 48 3d e0 01 a0 8a 0f 93 c1 48 3d f0 15 a0 8a 0f 92 c2 84 d1 75 27 48 3d c0 eb 9c 8a 0f 92 c1 48 3d cb eb 9c 8a 0f 93 c0 <08> c8 74 11 48 ff c3 49 83 c7 08 49 39 dc 75 ae 44 89 e3 eb 06 ff
RSP: 0018:ffffc9001081f2f8 EFLAGS: 00000297
RAX: ffffffff81e01300 RBX: 0000000000000004 RCX: 0000000000000001
RDX: 0000000000002801 RSI: 0000000000000010 RDI: ffffc9001081f3c0
RBP: 0000000000002800 R08: ffffc9001081f310 R09: 000000000000000f
R10: 0000000000000004 R11: 0000000000000000 R12: 0000000000000010
R13: dffffc0000000000 R14: ffffc9001081f3c0 R15: ffffc9001081f3e0
__stack_depot_save+0x1f/0x660 lib/stackdepot.c:377
save_stack+0x133/0x230 mm/page_owner.c:129
__reset_page_owner+0x4e/0x190 mm/page_owner.c:149
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1182 [inline]
free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459
discard_slab mm/slub.c:2127 [inline]
__unfreeze_partials+0x1cf/0x210 mm/slub.c:2667
put_cpu_partial+0x17c/0x250 mm/slub.c:2743
__slab_free+0x319/0x400 mm/slub.c:3700
qlink_free mm/kasan/quarantine.c:166 [inline]
qlist_free_all+0x75/0xd0 mm/kasan/quarantine.c:185
kasan_quarantine_reduce+0x143/0x160 mm/kasan/quarantine.c:292
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:306
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook+0x6a/0x4d0 mm/slab.h:770
slab_alloc_node mm/slub.c:3495 [inline]
slab_alloc mm/slub.c:3503 [inline]
__kmem_cache_alloc_lru mm/slub.c:3510 [inline]
kmem_cache_alloc+0x17e/0x2c0 mm/slub.c:3519
kmem_cache_zalloc include/linux/slab.h:711 [inline]
alloc_buffer_head+0x2d/0x280 fs/buffer.c:3031
jbd2_journal_write_metadata_buffer+0xc0/0x14b0 fs/jbd2/journal.c:352
jbd2_journal_commit_transaction+0x165e/0x5ad0 fs/jbd2/commit.c:664
kjournald2+0x40f/0x810 fs/jbd2/journal.c:201
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:cc:4f:e9:f3:0b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:cc:4f:e9:f3:0b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:cc:4f:e9:f3:0b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:cc:4f:e9:f3:0b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:cc:4f:e9:f3:0b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:cc:4f:e9:f3:0b, vlan:0)
bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:cc:4f:e9:f3:0b, vlan:0)
bridge0: received packet on veth0_to_bridge with own address as source address (addr:92:cc:4f:e9:f3:0b, vlan:0)
* Struck through repros no longer work on HEAD.