rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6170/1:b..l P6159/1:b..l
rcu: (detected by 0, t=10502 jiffies, g=9809, q=1167 ncpus=2)
task:syz.2.54 state:R running task stack:26632 pid:6159 tgid:6155 ppid:5817 task_flags:0x40044c flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7190
irqentry_exit+0x1d8/0x8c0 kernel/entry/common.c:216
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:its_return_thunk+0x0/0x10 arch/x86/lib/retpoline.S:417
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 4b 7d b1 f5 cc
RSP: 0018:ffffc90004b3ee10 EFLAGS: 00000246
RAX: 0000000000000001 RBX: 0000000000000001 RCX: 00000000c64af325
RDX: 0000000000000000 RSI: ffffffff8da9bf6a RDI: ffffffff8bf24280
RBP: ffffc90004b3eed8 R08: 0000000055fd6992 R09: 00000000255fd699
R10: 0000000000000002 R11: ffff888079f954b0 R12: ffffffff81a95e80
R13: ffffc90004b3ee90 R14: 0000000000000000 R15: ffff888079f94980
rcu_read_lock include/linux/rcupdate.h:868 [inline]
class_rcu_constructor include/linux/rcupdate.h:1195 [inline]
unwind_next_frame+0xd6/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
save_stack+0x160/0x1f0 mm/page_owner.c:165
__reset_page_owner+0x84/0x1a0 mm/page_owner.c:320
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa22/0x1610 mm/page_alloc.c:3000
folios_put_refs+0x4be/0x750 mm/swap.c:1002
free_pages_and_swap_cache+0x245/0x4a0 mm/swap_state.c:355
__tlb_batch_free_encoded_pages+0xf9/0x290 mm/mmu_gather.c:136
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:397 [inline]
tlb_flush_mmu+0xe9/0x5a0 mm/mmu_gather.c:404
zap_pte_range mm/memory.c:1893 [inline]
zap_pmd_range mm/memory.c:1946 [inline]
zap_pud_range mm/memory.c:1975 [inline]
zap_p4d_range mm/memory.c:1996 [inline]
unmap_page_range+0x1e64/0x43c0 mm/memory.c:2017
unmap_single_vma+0x153/0x240 mm/memory.c:2059
unmap_vmas+0x218/0x470 mm/memory.c:2101
exit_mmap+0x1b0/0xb60 mm/mmap.c:1277
__mmput+0x12a/0x410 kernel/fork.c:1173
mmput+0x62/0x70 kernel/fork.c:1196
exit_mm kernel/exit.c:581 [inline]
do_exit+0x7d7/0x2bd0 kernel/exit.c:959
do_group_exit+0xd3/0x2a0 kernel/exit.c:1112
get_signal+0x2671/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7e0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:41 [inline]
exit_to_user_mode_loop+0x8c/0x540 kernel/entry/common.c:75
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
do_syscall_64+0x4ee/0xf80 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4c2d38f749
RSP: 002b:00007f4c2e1c5038 EFLAGS: 00000246 ORIG_RAX: 000000000000013e
RAX: 000000000043c000 RBX: 00007f4c2d5e6090 RCX: 00007f4c2d38f749
RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000000240
RBP: 00007f4c2d413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4c2d5e6128 R14: 00007f4c2d5e6090 R15: 00007ffcd0989018
task:syz.4.56 state:R running task stack:25912 pid:6170 tgid:6166 ppid:5808 task_flags:0x400040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7190
irqentry_exit+0x1d8/0x8c0 kernel/entry/common.c:216
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_is_held_type+0x107/0x150 kernel/locking/lockdep.c:5945
Code: 00 00 b8 ff ff ff ff 65 0f c1 05 5c c0 3a 08 83 f8 01 75 2d 9c 58 f6 c4 02 75 43 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 87 2c 03 00 45 31 ed eb
RSP: 0018:ffffc90002e97708 EFLAGS: 00000282
RAX: 0000000000000046 RBX: ffff888076543018 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8da9bf6a RDI: ffffffff8bf24280
RBP: ffffffff8e427f58 R08: 0000000055fd6992 R09: 00000000255fd699
R10: 0000000000000002 R11: ffff888076542ff0 R12: ffff8880765424c0
R13: 0000000000000000 R14: 00000000ffffffff R15: 0000000000000002
lock_is_held include/linux/lockdep.h:249 [inline]
task_css include/linux/cgroup.h:460 [inline]
mem_cgroup_from_task mm/memcontrol.c:885 [inline]
get_mem_cgroup_from_mm+0x1da/0x600 mm/memcontrol.c:938
__mem_cgroup_charge+0x1a/0x1e0 mm/memcontrol.c:4744
mem_cgroup_charge include/linux/memcontrol.h:663 [inline]
folio_prealloc mm/memory.c:1198 [inline]
alloc_anon_folio mm/memory.c:5165 [inline]
do_anonymous_page+0xca9/0x2190 mm/memory.c:5222
do_pte_missing mm/memory.c:4399 [inline]
handle_pte_fault mm/memory.c:6273 [inline]
__handle_mm_fault+0x1ecf/0x2bb0 mm/memory.c:6411
handle_mm_fault+0x3fe/0xad0 mm/memory.c:6580
do_user_addr_fault+0x7a6/0x1370 arch/x86/mm/fault.c:1387
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x64/0xc0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0010:rep_movs_alternative+0x4a/0x90 arch/x86/lib/copy_user_64.S:74
Code: 81 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 e9 4f 81 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48
RSP: 0018:ffffc90002e97bb0 EFLAGS: 00050246
RAX: 0000000000000001 RBX: 0000000000000040 RCX: 0000000000000040
RDX: fffff520005d2fb9 RSI: ffffc90002e97d88 RDI: 000020000049f000
RBP: 000020000049f000 R08: 0000000000000000 R09: fffff520005d2fb8
R10: ffffc90002e97dc7 R11: ffff888076542ff0 R12: ffffc90002e97e78
R13: 000020000049f040 R14: ffffc90002e97d88 R15: 00007ffffffff000
copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
copy_to_user_iter lib/iov_iter.c:25 [inline]
iterate_ubuf include/linux/iov_iter.h:30 [inline]
iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
iterate_and_advance include/linux/iov_iter.h:330 [inline]
_copy_to_iter+0x383/0x1710 lib/iov_iter.c:197
copy_to_iter include/linux/uio.h:220 [inline]
get_random_bytes_user+0x17f/0x3c0 drivers/char/random.c:473
__do_sys_getrandom drivers/char/random.c:1420 [inline]
__se_sys_getrandom drivers/char/random.c:1394 [inline]
__x64_sys_getrandom+0x183/0x290 drivers/char/random.c:1394
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe08498f749
RSP: 002b:00007fe08579a038 EFLAGS: 00000246 ORIG_RAX: 000000000000013e
RAX: ffffffffffffffda RBX: 00007fe084be5fa0 RCX: 00007fe08498f749
RDX: 0000000000000000 RSI: 00000000ffffff9a RDI: 0000200000000240
RBP: 00007fe084a13f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe084be6038 R14: 00007fe084be5fa0 R15: 00007ffe44b93558
rcu: rcu_preempt kthread starved for 10589 jiffies! g9809 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:28440 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
context_switch kernel/sched/core.c:5256 [inline]
__schedule+0x1139/0x6150 kernel/sched/core.c:6863
__schedule_loop kernel/sched/core.c:6945 [inline]
schedule+0xe7/0x3a0 kernel/sched/core.c:6960
schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
rcu_gp_fqs_loop+0x1ea/0xaf0 kernel/rcu/tree.c:2083
rcu_gp_kthread+0x26d/0x380 kernel/rcu/tree.c:2285
kthread+0x3c5/0x780 kernel/kthread.c:463
ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:82
Code: 06 60 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 59 13 00 fb f4 cc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc90000197de8 EFLAGS: 000002c6
RAX: 000000000027da63 RBX: 0000000000000001 RCX: ffffffff8b7706d9
RDX: 0000000000000000 RSI: ffffffff8dac200a RDI: ffffffff8bf24280
RBP: ffffed1003b56498 R08: 0000000000000001 R09: ffffed10170a673d
R10: ffff8880b85339eb R11: ffff88801dab2ff0 R12: 0000000000000001
R13: ffff88801dab24c0 R14: ffffffff9087f7d0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff888124a09000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fcebff8 CR3: 000000000e184000 CR4: 00000000003526f0
Call Trace:
arch_safe_halt arch/x86/include/asm/paravirt.h:107 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:767
default_idle_call+0x6c/0xb0 kernel/sched/idle.c:122
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x38d/0x510 kernel/sched/idle.c:332
cpu_startup_entry+0x4f/0x60 kernel/sched/idle.c:430
start_secondary+0x21d/0x2d0 arch/x86/kernel/smpboot.c:312
common_startup_64+0x13e/0x148