syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (1 GPs behind) idle=60ac/1/0x4000000000000000 softirq=70485/70486 fqs=2
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P15806/1:b..l P5139/1:b..l
rcu: 	(detected by 1, t=10505 jiffies, g=112921, q=321 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 16039 Comm: syz.5.2634 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:__lock_release kernel/locking/lockdep.c:5438 [inline]
RIP: 0010:lock_release+0x22c/0x8c0 kernel/locking/lockdep.c:5774
Code: 44 89 7c 24 3c 44 89 fa 85 c0 0f 84 d7 01 00 00 4d 85 e4 0f 84 01 03 00 00 4d 8d 74 24 24 4c 89 f0 48 c1 e8 03 42 0f b6 04 28 <84> c0 0f 85 9d 04 00 00 41 83 3e 00 0f 85 ca 03 00 00 4d 8d 74 24
RSP: 0018:ffffc90000007ae0 EFLAGS: 00000807
RAX: 0000000000000000 RBX: 000000000000000a RCX: 0000000000000001
RDX: 0000000000000002 RSI: ffffffff974a8030 RDI: ffff888029da0b30
RBP: ffffc90000007bf0 R08: ffffffff8e8b19af R09: 1ffffffff1d16335
R10: dffffc0000000000 R11: fffffbfff1d16336 R12: ffff888029da0b30
R13: dffffc0000000000 R14: ffff888029da0b54 R15: 0000000000000002
FS:  00007f8ba1c8d6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555622b668e0 CR3: 0000000027182000 CR4: 00000000003506f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:149 [inline]
 _raw_spin_unlock_irqrestore+0x71/0x120 kernel/locking/spinlock.c:194
 debug_object_activate+0x304/0x4f0 lib/debugobjects.c:727
 debug_hrtimer_activate kernel/time/hrtimer.c:450 [inline]
 debug_activate kernel/time/hrtimer.c:505 [inline]
 enqueue_hrtimer+0x30/0x370 kernel/time/hrtimer.c:1108
 __run_hrtimer kernel/time/hrtimer.c:1767 [inline]
 __hrtimer_run_queues+0x63a/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_interrupt+0x3c9/0x9c0 kernel/time/hrtimer.c:1876
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__refcount_sub_and_test include/linux/refcount.h:277 [inline]
RIP: 0010:__refcount_dec_and_test include/linux/refcount.h:315 [inline]
RIP: 0010:refcount_dec_and_test+0x22/0x70 include/linux/refcount.h:333
Code: 00 00 00 00 0f 1f 40 00 41 56 53 49 89 fe e8 95 8f 13 f9 4c 89 f7 be 04 00 00 00 e8 98 c8 6b f9 bb ff ff ff ff f0 41 0f c1 1e <bf> 01 00 00 00 89 de e8 22 93 13 f9 83 fb 01 75 07 e8 68 8f 13 f9
RSP: 0018:ffffc90004d876e0 EFLAGS: 00000213
RAX: ffffffff88739201 RBX: 0000000000000002 RCX: ffffffff88739278
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffff888078d76ea4
RBP: 0000000000000002 R08: ffff888078d76ea7 R09: 1ffff1100f1aedd4
R10: dffffc0000000000 R11: ffffed100f1aedd5 R12: 1ffff920009b0ef0
R13: dffffc0000000000 R14: ffff888078d76ea4 R15: dffffc0000000000
 skb_unref include/linux/skbuff.h:1249 [inline]
 consume_skb+0xcf/0x110 net/core/skbuff.c:1280
 __unix_dgram_recvmsg+0x9fa/0xd80 net/unix/af_unix.c:2490
 sock_recvmsg_nosec+0x82/0xd0 net/socket.c:1046
 ____sys_recvmsg+0x4e8/0x5e0 net/socket.c:2811
 ___sys_recvmsg+0x216/0x590 net/socket.c:2855
 do_recvmmsg+0x39a/0x870 net/socket.c:2949
 __sys_recvmmsg net/socket.c:3028 [inline]
 __do_sys_recvmmsg net/socket.c:3051 [inline]
 __se_sys_recvmmsg net/socket.c:3044 [inline]
 __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3044
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8ba0d9cdd9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8ba1c8d028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f8ba1016090 RCX: 00007f8ba0d9cdd9
RDX: 00000000080002c1 RSI: 0000200000000040 RDI: 0000000000000004
RBP: 00007f8ba0e32d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f8ba1016128 R14: 00007f8ba1016090 R15: 00007ffdab9c5648
 </TASK>
task:udevd           state:R  running task     stack:23048 pid:5139  ppid:1      flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x1553/0x45a0 kernel/sched/core.c:6700
 preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6867
 preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6891
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x3a/0x40 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 copy_pte_range mm/memory.c:1107 [inline]
 copy_pmd_range mm/memory.c:1168 [inline]
 copy_pud_range mm/memory.c:1205 [inline]
 copy_p4d_range mm/memory.c:1229 [inline]
 copy_page_range+0x2ba0/0x3670 mm/memory.c:1323
 dup_mmap kernel/fork.c:768 [inline]
 dup_mm kernel/fork.c:1693 [inline]
 copy_mm+0x1281/0x1d80 kernel/fork.c:1742
 copy_process+0x16f7/0x3d80 kernel/fork.c:2507
 kernel_clone+0x24b/0x8a0 kernel/fork.c:2915
 __do_sys_clone kernel/fork.c:3058 [inline]
 __se_sys_clone kernel/fork.c:3042 [inline]
 __x64_sys_clone+0x1b7/0x230 kernel/fork.c:3042
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1584cf1636
RSP: 002b:00007fffd6c44fb0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007fffd6c44fb8 RCX: 00007f1584cf1636
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000555622b3f910 R08: 0000000000000000 R09: 0000555622b478e0
R10: 00007f1585393b50 R11: 0000000000000246 R12: 00007fffd6c45370
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>
task:syz.7.2588      state:R  running task     stack:22888 pid:15806 ppid:15288  flags:0x00004006
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x1553/0x45a0 kernel/sched/core.c:6700
 preempt_schedule_irq+0xbf/0x150 kernel/sched/core.c:7010
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:arch_stack_walk+0x2c/0x190 arch/x86/kernel/stacktrace.c:17
Code: 1f 00 55 48 89 e5 41 57 41 56 41 54 53 48 83 ec 68 49 89 cf 49 89 d4 48 89 f3 49 89 fe 65 48 8b 04 25 28 00 00 00 48 89 45 d8 <e8> 6f 80 54 00 4d 85 ff 74 1f 49 8b b7 80 00 00 00 48 89 df 41 ff
RSP: 0018:ffffc9000479f5a8 EFLAGS: 00000292
RAX: 460ccbc4a388f900 RBX: ffffc9000479f660 RCX: 0000000000000000
RDX: ffff888029b08000 RSI: ffffc9000479f660 RDI: ffffffff8175c250
RBP: ffffc9000479f630 R08: ffffc9000479f79f R09: 0000000000000000
R10: ffffc9000479f720 R11: fffff520008f3ef4 R12: ffff888029b08000
R13: 1ffff110053610ae R14: ffffffff8175c250 R15: 0000000000000000
 stack_trace_save+0xaa/0x100 kernel/stacktrace.c:122
 save_stack+0x125/0x230 mm/page_owner.c:128
 __reset_page_owner+0x4e/0x190 mm/page_owner.c:149
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1181 [inline]
 free_unref_page_prepare+0x7b2/0x8c0 mm/page_alloc.c:2365
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2458
 vfree+0x1a6/0x320 mm/vmalloc.c:2868
 kcov_put kernel/kcov.c:438 [inline]
 kcov_close+0x2b/0x50 kernel/kcov.c:534
 __fput+0x234/0x970 fs/file_table.c:384
 task_work_run+0x1d4/0x260 kernel/task_work.c:245
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x95a/0x2460 kernel/exit.c:883
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 get_signal+0x12fc/0x13f0 kernel/signal.c:2902
 arch_do_signal_or_restart+0xc2/0x800 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
 irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:315
 exc_page_fault+0x8c/0x100 arch/x86/mm/fault.c:1519
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7fe6b399cde1
RSP: 002b:0000000000000030 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007fe6b3c15fa0 RCX: 00007fe6b399cdd9
RDX: 0000000000000000 RSI: 0000000000000030 RDI: 0000000000000600
RBP: 00007fe6b3a32d69 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007fe6b3c16038 R14: 00007fe6b3c15fa0 R15: 00007fffafa31d38
 </TASK>
rcu: rcu_preempt kthread starved for 10495 jiffies! g112921 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27592 pid:17    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0x1553/0x45a0 kernel/sched/core.c:6700
 schedule+0xbd/0x170 kernel/sched/core.c:6774
 schedule_timeout+0x188/0x2d0 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x313/0x1590 kernel/rcu/tree.c:1667
 rcu_gp_kthread+0x9d/0x3b0 kernel/rcu/tree.c:1866
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 PID: 8390 Comm: kworker/u4:24 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:311 [inline]
RIP: 0010:smp_call_function_many_cond+0xdfe/0x1140 kernel/smp.c:855
Code: 45 8b 2c 24 44 89 ee 83 e6 01 31 ff e8 cb f5 0a 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 06 f2 0a 00 eb 38 f3 90 <42> 0f b6 04 2b 84 c0 75 11 41 f7 04 24 01 00 00 00 74 1e e8 ea f1
RSP: 0018:ffffc900043ef780 EFLAGS: 00000293
RAX: ffffffff817c3016 RBX: 1ffff110171c8759 RCX: ffff888028a9da00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900043ef900 R08: ffffffff911c6507 R09: 1ffffffff2238ca0
R10: dffffc0000000000 R11: fffffbfff2238ca1 R12: ffff8880b8e43ac8
R13: dffffc0000000000 R14: ffff8880b8f3d148 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe8c594ff8 CR3: 000000000cf32000 CR4: 00000000003506e0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000002
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1022
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:2222 [inline]
 text_poke_bp_batch+0x31e/0x990 arch/x86/kernel/alternative.c:2432
 text_poke_flush arch/x86/kernel/alternative.c:2623 [inline]
 text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2630
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x123/0x240 kernel/jump_label.c:207
 static_key_enable+0x1a/0x20 kernel/jump_label.c:220
 toggle_allocation_gate+0xa8/0x260 mm/kfence/core.c:847
 process_one_work kernel/workqueue.c:2653 [inline]
 process_scheduled_works+0xa5d/0x15d0 kernel/workqueue.c:2730
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2811
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>