syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1):
 P12195/1:b..l P12193/1:b..l

rcu: 	(detected by 0, t=10503 jiffies, g=45389, q=221 ncpus=2)
task:vhost-12192     state:R
  running task     stack:28152 pid:12193 tgid:12190 ppid:5845   task_flags:0x404040 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5357 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6961
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7288
 irqentry_exit+0x36/0x90 kernel/entry/common.c:197
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_is_held_type+0x107/0x150 kernel/locking/lockdep.c:5945
Code: 00 00 b8 ff ff ff ff 65 0f c1 05 dc 40 43 08 83 f8 01 75 2d 9c 58 f6 c4 02 75 43 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 c7 03 03 00 45 31 ed eb
RSP: 0000:ffffc90003fbf388 EFLAGS: 00000286

RAX: 0000000000000046 RBX: ffff88804449af58 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8de29d10 RDI: ffffffff8c162580
RBP: ffff8880328f37a0 R08: 0000000000000005 R09: 0000000000000300
R10: 0000000000000300 R11: 0000000000000000 R12: ffff88804449a440
R13: 0000000000000001 R14: 00000000ffffffff R15: 0000000000000001
 lock_is_held include/linux/lockdep.h:249 [inline]
 mt_locked lib/maple_tree.c:793 [inline]
 mt_slot lib/maple_tree.c:800 [inline]
 mtree_range_walk+0x245/0xc00 lib/maple_tree.c:2797
 mas_state_walk lib/maple_tree.c:3636 [inline]
 mt_find+0x4d3/0xa30 lib/maple_tree.c:6933
 find_vma+0xbf/0x140 mm/mmap.c:909
 gup_vma_lookup+0x24/0x220 mm/gup.c:1293
 __get_user_pages+0x243/0x34a0 mm/gup.c:1414
 __get_user_pages_locked mm/gup.c:1712 [inline]
 __gup_longterm_locked+0xa92/0x17e0 mm/gup.c:2488
 gup_fast_fallback+0xf78/0x23f0 mm/gup.c:3232
 pin_user_pages_fast+0xa7/0xf0 mm/gup.c:3338
 set_bit_to_user drivers/vhost/vhost.c:2423 [inline]
 log_write+0x267/0x320 drivers/vhost/vhost.c:2449
 log_used.isra.0+0x170/0x1e0 drivers/vhost/vhost.c:2505
 vhost_update_used_flags+0x2ff/0x3d0 drivers/vhost/vhost.c:2580
 vhost_disable_notify drivers/vhost/vhost.c:3213 [inline]
 vhost_disable_notify+0xba/0x180 drivers/vhost/vhost.c:3205
 vhost_transport_do_send_pkt+0x168/0x10e0 drivers/vhost/vsock.c:107
 vhost_run_work_list+0x188/0x230 drivers/vhost/vhost.c:454
 vhost_task_fn+0x165/0x460 kernel/vhost_task.c:49
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:syz.5.1594      state:R
  running task     stack:26296 pid:12195 tgid:12189 ppid:7469   task_flags:0x400040 flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5357 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6961
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:7145
 preempt_schedule_thunk+0x16/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 wp_page_copy mm/memory.c:3653 [inline]
 do_wp_page+0x177b/0x4f00 mm/memory.c:4013
 handle_pte_fault mm/memory.c:6068 [inline]
 __handle_mm_fault+0x1b2d/0x2a50 mm/memory.c:6195
 handle_mm_fault+0x589/0xd10 mm/memory.c:6364
 do_user_addr_fault+0x7a6/0x1370 arch/x86/mm/fault.c:1387
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x5c/0xb0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:__put_user_nocheck_4+0x3/0x10 arch/x86/lib/putuser.S:104
Code: d9 0f 01 cb 89 01 31 c9 0f 01 ca e9 07 6d 03 00 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb <89> 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90002ec79f8 EFLAGS: 00050246

RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00002000001ea030
RDX: 0000000000080000 RSI: ffffffff8962c513 RDI: 0000000000000005
RBP: ffffc90002ec7d98 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000
R13: 00002000001ea000 R14: ffffc90002ec7ddc R15: 0000000000000002
 ____sys_recvmsg+0x2ee/0x6b0 net/socket.c:2847
 ___sys_recvmsg+0x114/0x1a0 net/socket.c:2876
 do_recvmmsg+0x2fe/0x750 net/socket.c:2971
 __sys_recvmmsg net/socket.c:3045 [inline]
 __do_sys_recvmmsg net/socket.c:3068 [inline]
 __se_sys_recvmmsg net/socket.c:3061 [inline]
 __x64_sys_recvmmsg+0x22a/0x280 net/socket.c:3061
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1c7358ebe9
RSP: 002b:00007f1c74347038 EFLAGS: 00000246
 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f1c737b6090 RCX: 00007f1c7358ebe9
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000003
RBP: 00007f1c73611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1c737b6128 R14: 00007f1c737b6090 R15: 00007fffe2277bd8
 </TASK>
rcu: rcu_preempt kthread starved for 10503 jiffies! g45389 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R
  running task     stack:27784 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5357 [inline]
 __schedule+0x1190/0x5de0 kernel/sched/core.c:6961
 __schedule_loop kernel/sched/core.c:7043 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:7058
 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1ea/0xb00 kernel/rcu/tree.c:2083
 rcu_gp_kthread+0x270/0x380 kernel/rcu/tree.c:2285
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.17.0-rc1-syzkaller-00016-g8742b2d8935f #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: ac 62 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 c2 16 00 fb f4 <e9> 4c 0d 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffffff8e207e08 EFLAGS: 000002c2

RAX: 0000000001adc125 RBX: 0000000000000000 RCX: ffffffff8b934c29
RDX: 0000000000000000 RSI: ffffffff8de4f205 RDI: ffffffff8c162580
RBP: fffffbfff1c52ef8 R08: 0000000000000001 R09: ffffed1017086655
R10: ffff8880b84332ab R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8e2977c0 R14: ffffffff90ab3690 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881246bc000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f10b25212c0 CR3: 00000000620c2000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:757
 default_idle_call+0x6d/0xb0 kernel/sched/idle.c:122
 cpuidle_idle_call kernel/sched/idle.c:190 [inline]
 do_idle+0x391/0x510 kernel/sched/idle.c:330
 cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:428
 rest_init+0x16b/0x2b0 init/main.c:744
 start_kernel+0x3ee/0x4d0 init/main.c:1097
 x86_64_start_reservations+0x18/0x30 arch/x86/kernel/head64.c:307
 x86_64_start_kernel+0x130/0x190 arch/x86/kernel/head64.c:288
 common_startup_64+0x13e/0x148
 </TASK>