rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-...!: (4630 ticks this GP) idle=efd/1/0x4000000000000000 softirq=19912/19912 fqs=4
(t=10501 jiffies g=25173 q=434)
rcu: rcu_preempt kthread starved for 10484 jiffies! g25173 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:29152 pid: 14 ppid: 2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:4940 [inline]
__schedule+0x940/0x26f0 kernel/sched/core.c:6287
schedule+0xd3/0x270 kernel/sched/core.c:6366
schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881
rcu_gp_fqs_loop+0x186/0x800 kernel/rcu/tree.c:1957
rcu_gp_kthread+0x1de/0x320 kernel/rcu/tree.c:2130
kthread+0x3e5/0x4d0 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 10801 Comm: syz-executor230 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:native_apic_mem_read+0x36/0x40 arch/x86/include/asm/apic.h:115
Code: fb 48 8d bb 00 c0 5f ff 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 08 8b 83 00 c0 5f ff <5b> c3 e8 b3 15 8a 00 eb f1 90 b8 01 00 00 00 c3 66 2e 0f 1f 84 00
RSP: 0018:ffffc90000007418 EFLAGS: 00000046
RAX: 00000000000400f6 RBX: 0000000000000300 RCX: ffffffff812a1423
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffffff5fc300
RBP: fffffbfff1665148 R08: 0000000000000000 R09: ffffffff8d6d9ec7
R10: fffffbfff1adb3d8 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000504f28000 R14: 0000000002833410 R15: ffff88802b988428
FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004d3994 CR3: 0000000013995000 CR4: 0000000000350ef0
Call Trace:
apic_read arch/x86/include/asm/apic.h:389 [inline]
native_apic_wait_icr_idle+0x47/0x70 arch/x86/kernel/apic/apic.c:252
__irq_work_queue_local kernel/irq_work.c:59 [inline]
__irq_work_queue_local+0x133/0x190 kernel/irq_work.c:53
irq_work_queue kernel/irq_work.c:75 [inline]
irq_work_queue+0x47/0x80 kernel/irq_work.c:67
perf_output_wakeup kernel/events/ring_buffer.c:25 [inline]
perf_output_put_handle+0x2e3/0x3f0 kernel/events/ring_buffer.c:131
perf_output_end+0x12/0xb0 kernel/events/ring_buffer.c:301
__perf_event_output kernel/events/core.c:7469 [inline]
perf_event_output_forward+0x121/0x280 kernel/events/core.c:7481
__perf_event_overflow+0x13c/0x3d0 kernel/events/core.c:9153
perf_swevent_hrtimer+0x37c/0x3f0 kernel/events/core.c:10543
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
__sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:_compound_head include/linux/page-flags.h:188 [inline]
RIP: 0010:virt_to_head_page include/linux/mm.h:901 [inline]
RIP: 0010:__ksize+0x2f/0x110 mm/slub.c:4241
Code: 84 8d 00 00 00 48 83 ec 08 e8 2d 91 78 ff 48 c1 e8 0c 48 89 c7 48 b8 00 00 00 00 00 ea ff ff 48 c1 e7 06 48 01 c7 48 8b 47 08 <48> 8d 50 ff a8 01 48 0f 45 fa 48 8b 57 08 48 8d 42 ff 83 e2 01 48
RSP: 0018:ffffc90000007ad8 EFLAGS: 00000282
RAX: ffffea0000bf5d01 RBX: 0000000000000000 RCX: 0000000000000100
RDX: ffff888018a83900 RSI: ffffffff81349ed4 RDI: ffffea0000bf5d40
RBP: ffff88802fd75000 R08: 0000000000000000 R09: 0000000000000030
R10: ffffffff81349eca R11: 000000000000003f R12: 0000000000000000
R13: ffff88802fd75000 R14: 00000000ffffffff R15: 0000000000020a20
ksize mm/slab_common.c:1306 [inline]
ksize+0x4e/0x60 mm/slab_common.c:1284
__alloc_skb+0xf7/0x340 net/core/skbuff.c:433
__netdev_alloc_skb+0x73/0x400 net/core/skbuff.c:493
netdev_alloc_skb include/linux/skbuff.h:2877 [inline]
dev_alloc_skb include/linux/skbuff.h:2890 [inline]
__ieee80211_beacon_get+0xdfa/0x1b20 net/mac80211/tx.c:5070
ieee80211_beacon_get_tim+0x88/0x930 net/mac80211/tx.c:5184
ieee80211_beacon_get include/net/mac80211.h:4981 [inline]
mac80211_hwsim_beacon_tx+0x111/0x930 drivers/net/wireless/mac80211_hwsim.c:1808
__iterate_interfaces+0x1e5/0x520 net/mac80211/util.c:793
ieee80211_iterate_active_interfaces_atomic+0x70/0x180 net/mac80211/util.c:829
mac80211_hwsim_beacon+0xd5/0x1a0 drivers/net/wireless/mac80211_hwsim.c:1861
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:mm_trace_rss_stat mm/memory.c:172 [inline]
RIP: 0010:add_mm_counter include/linux/mm.h:1939 [inline]
RIP: 0010:add_mm_rss_vec mm/memory.c:502 [inline]
RIP: 0010:zap_pte_range mm/memory.c:1416 [inline]
RIP: 0010:zap_pmd_range mm/memory.c:1481 [inline]
RIP: 0010:zap_pud_range mm/memory.c:1510 [inline]
RIP: 0010:zap_p4d_range mm/memory.c:1531 [inline]
RIP: 0010:unmap_page_range+0x10b1/0x2a10 mm/memory.c:1552
Code: ff ff e8 12 0a cb ff 48 63 f5 48 83 fe 04 0f 87 de 14 00 00 be 08 00 00 00 4c 89 e7 e8 08 bf 11 00 4c 89 ea f0 49 0f c1 14 24 <48> 8b 7c 24 48 4c 01 ea 89 ee e8 60 9b ff ff e9 32 ff ff ff e8 d6
RSP: 0018:ffffc9000307f7b0 EFLAGS: 00000207
RAX: 0000000000000001 RBX: ffffc9000307f898 RCX: ffffffff81ab1618
RDX: 0000000000000042 RSI: 0000000000000008 RDI: ffff88802ff073f0
RBP: 0000000000000000 R08: 0000000000000001 R09: ffff88802ff073f7
R10: ffffed1005fe0e7e R11: 0000000000000000 R12: ffff88802ff073f0
R13: fffffffffffffff7 R14: dffffc0000000000 R15: 0000000000469000
unmap_single_vma+0x198/0x310 mm/memory.c:1597
unmap_vmas+0x16d/0x2f0 mm/memory.c:1629
exit_mmap+0x1d0/0x620 mm/mmap.c:3195
__mmput+0x122/0x470 kernel/fork.c:1103
mmput+0x58/0x60 kernel/fork.c:1124
exit_mm kernel/exit.c:501 [inline]
do_exit+0xabc/0x2a30 kernel/exit.c:812
do_group_exit+0x125/0x310 kernel/exit.c:922
get_signal+0x47f/0x2160 kernel/signal.c:2823
arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302
do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x454c69
Code: Unable to access opcode bytes at RIP 0x454c3f.
RSP: 002b:00007ffee4eafe78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: 0000000000278000 RBX: 0000000000000003 RCX: 0000000000454c69
RDX: ffffffffffffffef RSI: 0000000020d7cfcb RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000053
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffee4eafeb8
R13: 00007ffee4eafed0 R14: 00007ffee4eaff10 R15: 000000000000002b
NMI backtrace for cpu 1
CPU: 1 PID: 10802 Comm: syz-executor230 Not tainted 5.14.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105
nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105
nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline]
rcu_dump_cpu_stacks+0x25e/0x3f0 kernel/rcu/tree_stall.h:343
print_cpu_stall kernel/rcu/tree_stall.h:627 [inline]
check_cpu_stall kernel/rcu/tree_stall.h:711 [inline]
rcu_pending kernel/rcu/tree.c:3880 [inline]
rcu_sched_clock_irq.cold+0x9d/0x746 kernel/rcu/tree.c:2599
update_process_times+0x16d/0x200 kernel/time/timer.c:1785
tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226
tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1421
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x31c/0x790 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1086 [inline]
__sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1103
sysvec_apic_timer_interrupt+0x40/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__ieee80211_beacon_get+0x95a/0x1b20 net/mac80211/tx.c:5148
Code: 7d 40 48 b8 00 00 00 00 00 fc ff df 48 89 fa 4c 89 6c 24 58 48 c1 ea 03 80 3c 02 00 0f 85 49 0f 00 00 41 83 ff 04 49 8b 45 40 <45> 89 fd 0f 87 1c 0f 00 00 4a 8d bc e8 a8 01 00 00 48 ba 00 00 00
RSP: 0018:ffffc90000dc0b78 EFLAGS: 00000297
RAX: ffff88802c600580 RBX: ffff88803cfd6080 RCX: 0000000000000000
RDX: 1ffff110058c01b4 RSI: 0000000000000000 RDI: ffff88802c600da0
RBP: ffff888036dba8e8 R08: 0000000000000001 R09: ffffc90000dc0bd0
R10: fffff520001b8181 R11: 0000000000000000 R12: ffff888036dba8c0
R13: ffff88802c600d60 R14: ffffc90000dc0bd0 R15: 0000000000000000
ieee80211_beacon_get_tim+0x88/0x930 net/mac80211/tx.c:5184
ieee80211_beacon_get include/net/mac80211.h:4981 [inline]
mac80211_hwsim_beacon_tx+0x111/0x930 drivers/net/wireless/mac80211_hwsim.c:1808
__iterate_interfaces+0x1e5/0x520 net/mac80211/util.c:793
ieee80211_iterate_active_interfaces_atomic+0x70/0x180 net/mac80211/util.c:829
mac80211_hwsim_beacon+0xd5/0x1a0 drivers/net/wireless/mac80211_hwsim.c:1861
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x609/0xe50 kernel/time/hrtimer.c:1749
hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1766
__do_softirq+0x29b/0x9c2 kernel/softirq.c:558
invoke_softirq kernel/softirq.c:432 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__schedule+0x1/0x26f0 kernel/sched/core.c:6166
Code: 5d 41 5c c3 e8 60 e1 88 f8 eb d9 e8 59 e1 88 f8 e9 4b ff ff ff e8 ef e0 88 f8 e9 02 ff ff ff e8 05 e1 88 f8 e9 6c ff ff ff 55 <48> 89 e5 41 57 48 8d 85 78 ff ff ff 41 56 48 c1 e8 03 41 55 41 54
RSP: 0018:ffffc900032ef528 EFLAGS: 00000246
RAX: 0000000000000007 RBX: ffff88802bbf0000 RCX: 1ffffffff1adbb3d
RDX: 0000000000000000 RSI: ffffffff817c4961 RDI: 0000000000000001
RBP: ffffed100577e000 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff817c4948 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:6687
irqentry_exit+0x31/0x80 kernel/entry/common.c:427
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x8/0x70 kernel/kcov.c:292
Code: 4c 89 f7 e8 ca cc 61 02 e9 2d fd ff ff e8 60 6c bc 07 e9 7c fe ff ff e8 56 6c bc 07 e9 65 fc ff ff 90 49 89 f8 bf 03 00 00 00 <4c> 8b 14 24 48 89 f1 65 48 8b 34 25 40 f0 01 00 e8 33 f2 ff ff 84
RSP: 0018:ffffc900032ef608 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 000000000eeda000 RCX: 0000000000000000
RDX: ffff88802bbf0000 RSI: 0000000000000001 RDI: 0000000000000003
RBP: ffff888035cca528 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff81ac2e5b R11: 0000000000000000 R12: 0000000000000025
R13: 0000000000000000 R14: ffff888035cca578 R15: 0000000000000001
__pte_needs_invert arch/x86/include/asm/pgtable-invert.h:18 [inline]
protnone_mask arch/x86/include/asm/pgtable-invert.h:24 [inline]
pfn_pte arch/x86/include/asm/pgtable.h:577 [inline]
do_anonymous_page mm/memory.c:3745 [inline]
handle_pte_fault mm/memory.c:4556 [inline]
__handle_mm_fault+0x36f6/0x5320 mm/memory.c:4693
handle_mm_fault+0x1c8/0x790 mm/memory.c:4791
do_user_addr_fault+0x48b/0x11c0 arch/x86/mm/fault.c:1390
handle_page_fault arch/x86/mm/fault.c:1475 [inline]
exc_page_fault+0x9e/0x180 arch/x86/mm/fault.c:1531
asm_exc_page_fault+0x1e/0x30 arch/x86/include/asm/idtentry.h:568
RIP: 0010:copy_user_generic_string+0x2c/0x40 arch/x86/lib/copy_user_64.S:169
Code: cb 83 fa 08 72 27 89 f9 83 e1 07 74 15 83 e9 08 f7 d9 29 ca 8a 06 88 07 48 ff c6 48 ff c7 ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 48 a5 89 d1 f3 a4 31 c0 0f 01 ca c3 0f 1f 80 00 00 00 00 0f 01
RSP: 0018:ffffc900032ef910 EFLAGS: 00050246
RAX: 0000000000000001 RBX: 0000000000008000 RCX: 00000000000005fa
RDX: 0000000000000000 RSI: 0000000020fe9ffb RDI: ffff88803d1b5030
RBP: ffff88803d1b0000 R08: 0000000000000001 R09: ffff88803d1b7fff
R10: ffffed1007a36fff R11: 0000000000000000 R12: 0000000020fe4fcb
R13: 0000000020fecfcb R14: 0000000000000000 R15: ffffc900032efd70
copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline]
raw_copy_from_user arch/x86/include/asm/uaccess_64.h:52 [inline]
copyin.part.0+0xe4/0x110 lib/iov_iter.c:168
copyin lib/iov_iter.c:718 [inline]
_copy_from_iter+0x2a3/0x1320 lib/iov_iter.c:718
copy_from_iter include/linux/uio.h:148 [inline]
copy_from_iter_full include/linux/uio.h:154 [inline]
skb_do_copy_data_nocache+0x145/0x310 include/net/sock.h:2080
skb_copy_to_page_nocache include/net/sock.h:2106 [inline]
tcp_sendmsg_locked+0x1239/0x2f10 net/ipv4/tcp.c:1361
tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1461
inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821
sock_sendmsg_nosec net/socket.c:704 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:724
__sys_sendto+0x21c/0x320 net/socket.c:2036
__do_sys_sendto net/socket.c:2048 [inline]
__se_sys_sendto net/socket.c:2044 [inline]
__x64_sys_sendto+0xdd/0x1b0 net/socket.c:2044
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x454c69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffee4eafe78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000454c69
RDX: ffffffffffffffef RSI: 0000000020d7cfcb RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000053
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffee4eafeb8
R13: 00007ffee4eafed0 R14: 00007ffee4eaff10 R15: 000000000000002b
----------------
Code disassembly (best guess):
0: fb sti
1: 48 8d bb 00 c0 5f ff lea -0xa04000(%rbx),%rdi
8: 48 89 fa mov %rdi,%rdx
b: 48 c1 ea 03 shr $0x3,%rdx
f: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx
13: 48 89 f8 mov %rdi,%rax
16: 83 e0 07 and $0x7,%eax
19: 83 c0 03 add $0x3,%eax
1c: 38 d0 cmp %dl,%al
1e: 7c 04 jl 0x24
20: 84 d2 test %dl,%dl
22: 75 08 jne 0x2c
24: 8b 83 00 c0 5f ff mov -0xa04000(%rbx),%eax
* 2a: 5b pop %rbx <-- trapping instruction
2b: c3 retq
2c: e8 b3 15 8a 00 callq 0x8a15e4
31: eb f1 jmp 0x24
33: 90 nop
34: b8 01 00 00 00 mov $0x1,%eax
39: c3 retq
3a: 66 data16
3b: 2e cs
3c: 0f .byte 0xf
3d: 1f (bad)
3e: 84 00 test %al,(%rax)