syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P9/1:b..l
	(detected by 1, t=10502 jiffies, g=49045, q=284)
task:syz-executor.0  state:R  running task     stack:24880 pid:17688 ppid: 13379 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:4322 [inline]
 __schedule+0x911/0x21b0 kernel/sched/core.c:5073
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:5530
 irqentry_exit_cond_resched kernel/entry/common.c:392 [inline]
 irqentry_exit_cond_resched kernel/entry/common.c:384 [inline]
 irqentry_exit+0x7a/0xa0 kernel/entry/common.c:428
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:lock_acquire+0x1ef/0x740 kernel/locking/lockdep.c:5478
Code: 50 a8 7e 83 f8 01 0f 85 ee 03 00 00 9c 58 f6 c4 02 0f 85 d9 03 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc90002c0f098 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff92000581e15 RCX: 000000005caa8f7c
RDX: 1ffff1100236013d RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8fa988a7
R10: fffffbfff1f53114 R11: 0000000000000000 R12: 0000000000000002
R13: ffffffff8bf74320 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:267 [inline]
 rcu_read_lock include/linux/rcupdate.h:656 [inline]
 find_get_pages_range+0x11b/0x890 mm/filemap.c:2012
 pagevec_lookup_range+0x32/0x70 mm/swap.c:1064
 clean_bdev_aliases+0x19d/0x830 fs/buffer.c:1619
 clean_bdev_bh_alias include/linux/buffer_head.h:179 [inline]
 __block_write_begin_int+0xa48/0x1770 fs/buffer.c:2019
 __block_write_begin fs/buffer.c:2061 [inline]
 block_page_mkwrite+0x21f/0x310 fs/buffer.c:2524
 ext4_page_mkwrite+0xbdf/0x1a10 fs/ext4/inode.c:6087
 do_page_mkwrite+0x1a7/0x530 mm/memory.c:2720
 do_shared_fault mm/memory.c:4003 [inline]
 do_fault mm/memory.c:4071 [inline]
 handle_pte_fault mm/memory.c:4318 [inline]
 __handle_mm_fault+0x2baa/0x4f70 mm/memory.c:4453
 handle_mm_fault+0x1bc/0x7e0 mm/memory.c:4551
 do_user_addr_fault+0x483/0x1210 arch/x86/mm/fault.c:1390
 handle_page_fault arch/x86/mm/fault.c:1475 [inline]
 exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1531
 asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:577
RIP: 0010:copy_user_generic_string+0x2c/0x40 arch/x86/lib/copy_user_64.S:169
Code: cb 83 fa 08 72 27 89 f9 83 e1 07 74 15 83 e9 08 f7 d9 29 ca 8a 06 88 07 48 ff c6 48 ff c7 ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 <f3> 48 a5 89 d1 f3 a4 31 c0 0f 01 ca c3 0f 1f 80 00 00 00 00 0f 01
RSP: 0018:ffffc90002c0fa00 EFLAGS: 00050246
RAX: 0000000000000001 RBX: 0000000000001000 RCX: 0000000000000030
RDX: 0000000000000000 RSI: ffff888032d9ae80 RDI: 000000002018f000
RBP: 000000002018e180 R08: 0000000000000000 R09: ffff888032d9afff
R10: ffffed10065b35ff R11: 0000000000000000 R12: ffff888032d9a000
R13: 000000002018f180 R14: 0000000000000000 R15: 0000000000001000
 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:58 [inline]
 copyout.part.0+0xe4/0x110 lib/iov_iter.c:146
 copyout lib/iov_iter.c:180 [inline]
 copy_page_to_iter_iovec lib/iov_iter.c:217 [inline]
 copy_page_to_iter+0x41b/0xee0 lib/iov_iter.c:912
 filemap_read+0x61e/0xe40 mm/filemap.c:2513
 generic_file_read_iter+0x397/0x4f0 mm/filemap.c:2609
 ext4_file_read_iter+0x1d4/0x5d0 fs/ext4/file.c:130
 call_read_iter include/linux/fs.h:1971 [inline]
 new_sync_read+0x41e/0x6e0 fs/read_write.c:415
 vfs_read+0x35c/0x570 fs/read_write.c:496
 ksys_read+0x12d/0x250 fs/read_write.c:634
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x466459
RSP: 002b:00007faf4cb38188 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459
RDX: 00000000fffffe47 RSI: 0000000020000180 RDI: 0000000000000006
RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008
R13: 00007ffc561d590f R14: 00007faf4cb38300 R15: 0000000000022000
task:kworker/u4:0    state:R  running task     stack:25072 pid:    9 ppid:     2 flags:0x00004000
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
 context_switch kernel/sched/core.c:4322 [inline]
 __schedule+0x911/0x21b0 kernel/sched/core.c:5073
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:5530
 irqentry_exit_cond_resched kernel/entry/common.c:392 [inline]
 irqentry_exit_cond_resched kernel/entry/common.c:384 [inline]
 irqentry_exit+0x7a/0xa0 kernel/entry/common.c:428
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:lock_acquire+0x1ef/0x740 kernel/locking/lockdep.c:5478
Code: 50 a8 7e 83 f8 01 0f 85 ee 03 00 00 9c 58 f6 c4 02 0f 85 d9 03 00 00 48 83 7c 24 08 00 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc90000ce7aa8 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff9200019cf57 RCX: 00000000f9e69e84
RDX: 1ffff1100222f13d RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffffffff8fa988a7
R10: fffffbfff1f53114 R11: 0000000000000000 R12: 0000000000000002
R13: ffffffff8bf74320 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:267 [inline]
 rcu_read_lock include/linux/rcupdate.h:656 [inline]
 batadv_iv_ogm_slide_own_bcast_window net/batman-adv/bat_iv_ogm.c:754 [inline]
 batadv_iv_ogm_schedule_buff+0x5d0/0x1410 net/batman-adv/bat_iv_ogm.c:825
 batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:869 [inline]
 batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:862 [inline]
 batadv_iv_send_outstanding_bat_ogm_packet+0x675/0x920 net/batman-adv/bat_iv_ogm.c:1723
 process_one_work+0x98d/0x1600 kernel/workqueue.c:2275
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
rcu: rcu_preempt kthread starved for 10500 jiffies! g49045 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28872 pid:   14 ppid:     2 flags:0x00004000
Call Trace:
 context_switch kernel/sched/core.c:4322 [inline]
 __schedule+0x911/0x21b0 kernel/sched/core.c:5073
 schedule+0xcf/0x270 kernel/sched/core.c:5152
 schedule_timeout+0x14a/0x250 kernel/time/timer.c:1892
 rcu_gp_fqs_loop kernel/rcu/tree.c:2005 [inline]
 rcu_gp_kthread+0xd07/0x2250 kernel/rcu/tree.c:2178
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 1
CPU: 1 PID: 17698 Comm: syz-executor.3 Not tainted 5.12.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
 rcu_check_gp_kthread_starvation+0x1c7/0x1e4 kernel/rcu/tree_stall.h:478
 print_other_cpu_stall kernel/rcu/tree_stall.h:582 [inline]
 check_cpu_stall kernel/rcu/tree_stall.h:706 [inline]
 rcu_pending kernel/rcu/tree.c:3830 [inline]
 rcu_sched_clock_irq.cold+0x9a3/0x11dd kernel/rcu/tree.c:2650
 update_process_times+0x16d/0x200 kernel/time/timer.c:1796
 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1369
 __run_hrtimer kernel/time/hrtimer.c:1537 [inline]
 __hrtimer_run_queues+0x1c0/0xe40 kernel/time/hrtimer.c:1601
 hrtimer_interrupt+0x330/0xa00 kernel/time/hrtimer.c:1663
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline]
 __sysvec_apic_timer_interrupt+0x146/0x540 arch/x86/kernel/apic/apic.c:1106
 sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1100
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:unwind_next_frame+0x34f/0x1ce0 arch/x86/kernel/unwind_orc.c:456
Code: e8 96 f5 ff ff 49 89 c0 4d 85 c0 0f 84 39 02 00 00 4d 8d 78 04 48 b8 00 00 00 00 00 fc ff df 4c 89 fa 48 c1 ea 03 0f b6 04 02 <4c> 89 fa 83 e2 07 38 d0 7f 08 84 c0 0f 85 1e 09 00 00 41 0f b6 40
RSP: 0000:ffffc90000dc07b8 EFLAGS: 00000216
RAX: 0000000000000000 RBX: 1ffff920001b80ff RCX: ffffffff8902d429
RDX: 1ffffffff1da0a8b RSI: ffffffff8ed05456 RDI: ffffffff8e33ff84
RBP: 0000000000000001 R08: ffffffff8ed05456 R09: ffffffff8ed05456
R10: fffff520001b811d R11: 0000000000084087 R12: ffffc90000dc08d8
R13: ffffc90000dc08c5 R14: ffffc90000dc0890 R15: ffffffff8ed0545a
 arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357
 ____kasan_slab_free mm/kasan/common.c:360 [inline]
 ____kasan_slab_free mm/kasan/common.c:325 [inline]
 __kasan_slab_free+0xf5/0x130 mm/kasan/common.c:367
 kasan_slab_free include/linux/kasan.h:199 [inline]
 slab_free_hook mm/slub.c:1562 [inline]
 slab_free_freelist_hook+0x92/0x210 mm/slub.c:1600
 slab_free mm/slub.c:3161 [inline]
 kmem_cache_free+0x8a/0x740 mm/slub.c:3177
 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:683
 __kfree_skb net/core/skbuff.c:740 [inline]
 consume_skb net/core/skbuff.c:895 [inline]
 consume_skb+0xcf/0x160 net/core/skbuff.c:889
 mac80211_hwsim_tx_frame+0x157/0x1e0 drivers/net/wireless/mac80211_hwsim.c:1776
 mac80211_hwsim_beacon_tx+0x4ba/0x910 drivers/net/wireless/mac80211_hwsim.c:1829
 __iterate_interfaces+0x1e5/0x520 net/mac80211/util.c:793
 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:829
 mac80211_hwsim_beacon+0xd5/0x1a0 drivers/net/wireless/mac80211_hwsim.c:1852
 __run_hrtimer kernel/time/hrtimer.c:1537 [inline]
 __hrtimer_run_queues+0x609/0xe40 kernel/time/hrtimer.c:1601
 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1618
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu kernel/softirq.c:422 [inline]
 irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100
 </IRQ>
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:preempt_schedule_irq+0x49/0x90 kernel/sched/core.c:5530
Code: 55 53 65 48 8b 1c 25 00 f0 01 00 48 89 dd 48 c1 ed 03 48 01 c5 bf 01 00 00 00 e8 72 e2 49 f8 e8 3d 8c 75 f8 fb bf 01 00 00 00 <e8> c2 d0 ff ff 9c 58 fa f6 c4 02 75 27 bf 01 00 00 00 e8 b0 d0 49
RSP: 0000:ffffc90002c5fe68 EFLAGS: 00000206
RAX: 00000000005a35db RBX: ffff88801f359c40 RCX: 1ffffffff1b89bc9
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffffed1003e6b388 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8179e058 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 irqentry_exit_cond_resched kernel/entry/common.c:392 [inline]
 irqentry_exit_cond_resched kernel/entry/common.c:384 [inline]
 irqentry_exit+0x7a/0xa0 kernel/entry/common.c:428
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
RIP: 0010:exit_to_user_mode_prepare+0x10e/0x250 kernel/entry/common.c:208
Code: f6 c4 02 0f 85 0f 01 00 00 65 48 8b 04 25 00 f0 01 00 48 8b 18 f7 c3 0e 30 02 00 0f 84 2f ff ff ff e8 e6 99 17 00 fb f6 c3 08 <74> bf e8 1b 00 a2 07 f6 c7 10 74 ba 48 89 ef e8 2e d6 32 00 f7 c3
RSP: 0000:ffffc90002c5ff30 EFLAGS: 00000202
RAX: 000000000023ebc1 RBX: 0000000000000008 RCX: 1ffffffff1b89bc9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90002c5ff58 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8179e058 R11: 0000000000000001 R12: ffff88801f359c40
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 irqentry_exit_to_user_mode+0x5/0x40 kernel/entry/common.c:314
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0033:0x466459
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f74636b8188 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 000000000056bf60 RCX: 0000000000466459
RDX: 0000000020000000 RSI: 0000000000005452 RDI: 0000000000000003
RBP: 00000000004bf9fb R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffc06f8e1df R14: 00007f74636b8300 R15: 0000000000022000