INFO: rcu detected stall in kcov_close

Status: auto-obsoleted due to no activity on 2026/03/31 08:37
Reported-by: syzbot+a24cd6f5019358f9104f@syzkaller.appspotmail.com
First crash: 218d, last: 218d
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-6.6 INFO: rcu detected stall in kcov_close (2) 1 2 64d 67d 0/2 upstream: reported on 2026/05/21 10:08
linux-6.1 INFO: rcu detected stall in kcov_close 1 6 742d 792d 0/3 auto-obsoleted due to no activity on 2024/10/23 16:14
upstream INFO: rcu detected stall in kcov_close prio:normal mm 1 226 10h09m 714d 0/29 upstream: reported on 2024/08/12 12:28
linux-5.15 BUG: soft lockup in kcov_close 1 1 792d 792d 0/3 auto-obsoleted due to no activity on 2024/09/03 09:36
upstream INFO: task hung in release_tty (3) serial 1 3 625d 691d 0/29 auto-obsoleted due to no activity on 2025/02/07 03:06

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P49/1:b..l P16994/1:b..l P14615/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=98853, q=210 ncpus=2)
task:syz-executor    state:R  running task     stack:24232 pid:14615 ppid:5749   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:save_stack+0x13c/0x1f0 mm/page_owner.c:133
Code: 85 f6 74 15 e8 95 6c 9f ff eb 1a e8 8e 6c 9f ff 44 8b 35 87 23 0a 15 eb 1d e8 80 6c 9f ff 44 8b 35 99 23 0a 15 43 0f b6 04 27 <84> c0 0f 85 81 00 00 00 80 63 01 fb 48 c7 44 24 20 0e 36 e0 45 43
RSP: 0018:ffffc9000bf87960 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff88807ee85f70 RCX: ffff88807ee85a00
RDX: 0000000000000000 RSI: 0000000005e503b8 RDI: 0000000000000000
RBP: ffffc9000bf87a98 R08: 0000000049d612d6 R09: 000000003001c89e
R10: dffffc0000000000 R11: fffffbfff1c94426 R12: dffffc0000000000
R13: 1ffff920017f0f30 R14: 0000000005e503b8 R15: 1ffff1100fdd0bee
 __reset_page_owner+0x4e/0x190 mm/page_owner.c:149
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 vfree+0x1a6/0x320 mm/vmalloc.c:2868
 kcov_put kernel/kcov.c:438 [inline]
 kcov_close+0x2b/0x50 kernel/kcov.c:534
 __fput+0x234/0x970 fs/file_table.c:384
 task_work_run+0x1ce/0x250 kernel/task_work.c:239
 exit_task_work include/linux/task_work.h:43 [inline]
 do_exit+0x90b/0x23c0 kernel/exit.c:883
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 __do_sys_exit_group kernel/exit.c:1035 [inline]
 __se_sys_exit_group kernel/exit.c:1033 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1033
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9b4d98f749
RSP: 002b:00007ffca2c4cb58 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f9b4d98f749
RDX: 00007f9b4d98e1c0 RSI: 0000000000000004 RDI: 0000000000000001
RBP: 00007f9b4dbe67b8 R08: 00007ffca2c4a8f7 R09: 0000000000000008
R10: 0000000000000019 R11: 0000000000000246 R12: 0000000000000008
R13: 0000000000000003 R14: 00007ffca2c4ce48 R15: 0000000000000000
 </TASK>
task:syz-executor    state:R  running task     stack:21896 pid:16994 ppid:16988  flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:692
RIP: 0010:lock_acquire+0x1f2/0x410 kernel/locking/lockdep.c:5758
Code: 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 0f 85 f5 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 66 43 c7 44 3c 09 00 00 43 c6 44 3c 0b 00
RSP: 0018:ffffc9000b9679c0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 282a0372d5413300
RDX: 0000000000000000 RSI: ffffffff8aaace60 RDI: ffffffff8afc6f80
RBP: ffffc9000b967ad0 R08: dffffc0000000000 R09: 1ffffffff21b28a0
R10: dffffc0000000000 R11: fffffbfff21b28a1 R12: 1ffff9200172cf44
R13: ffffffff8cd2ff20 R14: 0000000000000246 R15: dffffc0000000000
 rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 rcu_read_lock include/linux/rcupdate.h:786 [inline]
 netlink_deliver_tap+0x4a/0x1b0 net/netlink/af_netlink.c:335
 netlink_deliver_tap_kernel net/netlink/af_netlink.c:347 [inline]
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x72c/0x8d0 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x8c1/0xbe0 net/netlink/af_netlink.c:1894
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 __sys_sendto+0x46a/0x620 net/socket.c:2201
 __do_sys_sendto net/socket.c:2213 [inline]
 __se_sys_sendto net/socket.c:2209 [inline]
 __x64_sys_sendto+0xde/0xf0 net/socket.c:2209
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f65deb915dc
RSP: 002b:00007ffcf8a625c0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f65df914620 RCX: 00007f65deb915dc
RDX: 0000000000000020 RSI: 00007f65df914670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffcf8a62614 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f65df914670 R15: 0000000000000000
 </TASK>
task:kworker/u4:3    state:R  running task     stack:20328 pid:49    ppid:2      flags:0x00004000
Workqueue: bat_events batadv_nc_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:692
RIP: 0010:lock_acquire+0x1f2/0x410 kernel/locking/lockdep.c:5758
Code: 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 0f 85 f5 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 66 43 c7 44 3c 09 00 00 43 c6 44 3c 0b 00
RSP: 0018:ffffc90000ba7a40 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: c9d89c1608915b00
RDX: 0000000000000000 RSI: ffffffff8aaace60 RDI: ffffffff8afc6f80
RBP: ffffc90000ba7b48 R08: dffffc0000000000 R09: 1ffffffff21b28a0
R10: dffffc0000000000 R11: fffffbfff21b28a1 R12: 1ffff92000174f54
R13: ffffffff8cd2ff20 R14: 0000000000000246 R15: dffffc0000000000
 rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 rcu_read_lock include/linux/rcupdate.h:786 [inline]
 batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
 batadv_nc_worker+0xef/0x610 net/batman-adv/network-coding.c:719
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: rcu_preempt kthread starved for 10563 jiffies! g98853 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27080 pid:17    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 schedule_timeout+0x160/0x280 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
 rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:148
Code: cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 23 bb 40 00 f3 0f 1e fa fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 66 0f 1f 00 55 41 57 41 56
RSP: 0018:ffffffff8ca07d80 EFLAGS: 000002c2
RAX: 65e7a93c52b85d00 RBX: ffffffff8161881b RCX: 65e7a93c52b85d00
RDX: 0000000000000001 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6f80
RBP: ffffffff8ca07eb8 R08: ffff8880b8e36b2b R09: 1ffff110171c6d65
R10: dffffc0000000000 R11: ffffed10171c6d66 R12: ffffffff8e4a2128
R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1952688
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000bd038 CR3: 000000001ab7e000 CR4: 00000000003506f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:753
 default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
 cpuidle_idle_call kernel/sched/idle.c:170 [inline]
 do_idle+0x1eb/0x510 kernel/sched/idle.c:282
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:380
 rest_init+0x2e2/0x300 init/main.c:744
 arch_call_rest_init+0xe/0x10 init/main.c:841
 start_kernel+0x459/0x4e0 init/main.c:1086
 x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:555
 x86_64_start_kernel+0x60/0x60 arch/x86/kernel/head64.c:536
 secondary_startup_64_no_verify+0x179/0x17b
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/21 08:36 linux-6.6.y 5fa4793a2d2d d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-6-kasan INFO: rcu detected stall in kcov_close
* Struck through repros no longer work on HEAD.