rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: (detected by 1, t=10502 jiffies, g=23301, q=58) rcu: All QSes seen, last rcu_preempt kthread activity 10470 (4295146385-4295135915), jiffies_till_next_fqs=1, root ->qsmask 0x0 rcu: rcu_preempt kthread starved for 10470 jiffies! g23301 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:29512 pid: 11 ppid: 2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:4327 [inline] __schedule+0x8cd/0x2150 kernel/sched/core.c:5078 schedule+0xcf/0x270 kernel/sched/core.c:5157 schedule_timeout+0x148/0x250 kernel/time/timer.c:1878 rcu_gp_fqs_loop kernel/rcu/tree.c:1940 [inline] rcu_gp_kthread+0xbbe/0x1d70 kernel/rcu/tree.c:2113 kthread+0x3b1/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 ================================ WARNING: inconsistent lock state 5.10.0-syzkaller #0 Not tainted -------------------------------- inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. syz-executor963/12923 [HC0[0]:SC1[1]:HE0:SE0] takes: ffffffff8b341358 (rcu_node_0){?.-.}-{2:2}, at: print_other_cpu_stall kernel/rcu/tree_stall.h:493 [inline] ffffffff8b341358 (rcu_node_0){?.-.}-{2:2}, at: check_cpu_stall kernel/rcu/tree_stall.h:652 [inline] ffffffff8b341358 (rcu_node_0){?.-.}-{2:2}, at: rcu_pending kernel/rcu/tree.c:3751 [inline] ffffffff8b341358 (rcu_node_0){?.-.}-{2:2}, at: rcu_sched_clock_irq.cold+0xbc/0xec3 kernel/rcu/tree.c:2580 {IN-HARDIRQ-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5437 [inline] lock_acquire+0x29d/0x740 kernel/locking/lockdep.c:5402 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:159 rcu_report_exp_cpu_mult+0x72/0x320 kernel/rcu/tree_exp.h:237 flush_smp_call_function_queue+0x34b/0x640 kernel/smp.c:425 __sysvec_call_function_single+0x95/0x3d0 arch/x86/kernel/smp.c:248 asm_call_irq_on_stack+0xf/0x20 __run_sysvec_on_irqstack arch/x86/include/asm/irq_stack.h:37 [inline] run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:89 [inline] sysvec_call_function_single+0xbd/0x100 arch/x86/kernel/smp.c:243 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:636 __sanitizer_cov_trace_pc+0x19/0x60 kernel/kcov.c:193 stack_not_used include/linux/sched/task_stack.h:99 [inline] check_stack_usage kernel/exit.c:709 [inline] do_exit+0x1834/0x29f0 kernel/exit.c:866 call_usermodehelper_exec_async+0x413/0x580 kernel/umh.c:123 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 irq event stamp: 19914721 hardirqs last enabled at (19914720): [] asm_sysvec_irq_work+0x12/0x20 arch/x86/include/asm/idtentry.h:654 hardirqs last disabled at (19914721): [] sysvec_apic_timer_interrupt+0xc/0x100 arch/x86/kernel/apic/apic.c:1096 softirqs last enabled at (14600310): [] asm_call_irq_on_stack+0xf/0x20 softirqs last disabled at (14600313): [] asm_call_irq_on_stack+0xf/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(rcu_node_0); lock(rcu_node_0); *** DEADLOCK *** 3 locks held by syz-executor963/12923: #0: ffffffff8b339260 (rcu_read_lock){....}-{1:2}, at: ieee80211_iterate_active_interfaces_atomic+0x0/0x170 net/mac80211/util.c:1298 #1: ffffffff8fa0c4f8 (&hwsim_radio_lock){+.-.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline] #1: ffffffff8fa0c4f8 (&hwsim_radio_lock){+.-.}-{2:2}, at: mac80211_hwsim_tx_frame_no_nl.isra.0+0x68f/0x1330 drivers/net/wireless/mac80211_hwsim.c:1444 #2: ffffffff8b341358 (rcu_node_0){?.-.}-{2:2}, at: print_other_cpu_stall kernel/rcu/tree_stall.h:493 [inline] #2: ffffffff8b341358 (rcu_node_0){?.-.}-{2:2}, at: check_cpu_stall kernel/rcu/tree_stall.h:652 [inline] #2: ffffffff8b341358 (rcu_node_0){?.-.}-{2:2}, at: rcu_pending kernel/rcu/tree.c:3751 [inline] #2: ffffffff8b341358 (rcu_node_0){?.-.}-{2:2}, at: rcu_sched_clock_irq.cold+0xbc/0xec3 kernel/rcu/tree.c:2580 stack backtrace: CPU: 1 PID: 12923 Comm: syz-executor963 Not tainted 5.10.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_usage_bug kernel/locking/lockdep.c:3740 [inline] valid_state kernel/locking/lockdep.c:3751 [inline] mark_lock_irq kernel/locking/lockdep.c:3954 [inline] mark_lock.cold+0x31/0x73 kernel/locking/lockdep.c:4411 mark_held_locks+0x9f/0xe0 kernel/locking/lockdep.c:4012 __trace_hardirqs_on_caller kernel/locking/lockdep.c:4030 [inline] lockdep_hardirqs_on_prepare kernel/locking/lockdep.c:4098 [inline] lockdep_hardirqs_on_prepare+0x135/0x400 kernel/locking/lockdep.c:4050 trace_hardirqs_on+0x5b/0x1c0 kernel/trace/trace_preemptirq.c:49 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:__module_address kernel/module.c:4521 [inline] RIP: 0010:__module_text_address+0x7/0x160 kernel/module.c:4563 Code: 1f 40 00 48 39 3d 29 1d 9a 09 77 0e 48 39 3d 28 1d 9a 09 72 05 e9 09 e4 fe ff 31 c0 c3 66 0f 1f 44 00 00 48 3b 3d 09 1d 9a 09 <0f> 82 09 01 00 00 55 48 89 fd 53 48 83 ec 08 48 3b 3d fb 1c 9a 09 RSP: 0018:ffffc90000d906e8 EFLAGS: 00000217 RAX: 0000000000000103 RBX: 00000000004493a9 RCX: 1ffffffff1de7b44 RDX: 0000000000000000 RSI: 0000000000000103 RDI: 00000000004493a9 RBP: 00000000004493a9 R08: ffffffff8df5caa2 R09: ffffffff8df5caa6 R10: 0000000000082081 R11: 0000000000000001 R12: ffffc90000d90800 R13: 0000000000000000 R14: ffff88801c109ac0 R15: 00000000000000e0 is_module_text_address+0x18/0x50 kernel/module.c:4548 kernel_text_address kernel/extable.c:145 [inline] kernel_text_address+0x62/0xf0 kernel/extable.c:120 __kernel_text_address+0x9/0x30 kernel/extable.c:105 unwind_get_return_address arch/x86/kernel/unwind_orc.c:318 [inline] unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_orc.c:313 arch_stack_walk+0x93/0xe0 arch/x86/kernel/stacktrace.c:26 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461 slab_post_alloc_hook mm/slab.h:535 [inline] slab_alloc_node mm/slub.c:2891 [inline] kmem_cache_alloc_node+0x1e0/0x470 mm/slub.c:2927 __alloc_skb+0x71/0x550 net/core/skbuff.c:198 skb_copy+0x137/0x2f0 net/core/skbuff.c:1507 mac80211_hwsim_tx_frame_no_nl.isra.0+0xb17/0x1330 drivers/net/wireless/mac80211_hwsim.c:1493 mac80211_hwsim_tx_frame+0x14f/0x1e0 drivers/net/wireless/mac80211_hwsim.c:1705 mac80211_hwsim_beacon_tx+0x4ba/0x910 drivers/net/wireless/mac80211_hwsim.c:1759 __iterate_interfaces+0x1e5/0x520 net/mac80211/util.c:792 ieee80211_iterate_active_interfaces_atomic+0x8d/0x170 net/mac80211/util.c:828 mac80211_hwsim_beacon+0xd5/0x1a0 drivers/net/wireless/mac80211_hwsim.c:1782 __run_hrtimer kernel/time/hrtimer.c:1519 [inline] __hrtimer_run_queues+0x693/0xea0 kernel/time/hrtimer.c:1583 hrtimer_run_softirq+0x17b/0x360 kernel/time/hrtimer.c:1600 __do_softirq+0x2a0/0x9f6 kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x132/0x200 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:pv_unhash kernel/locking/qspinlock_paravirt.h:246 [inline] RIP: 0010:__pv_queued_spin_unlock_slowpath+0xa6/0x290 kernel/locking/qspinlock_paravirt.h:517 Code: 63 ed eb 1a 4c 89 eb 48 21 eb 48 83 c5 01 48 c1 e3 04 4c 01 fb 48 39 d5 0f 84 95 01 00 00 48 89 d8 48 c1 e8 03 42 80 3c 30 00 <0f> 85 6e 01 00 00 48 8b 03 49 39 c4 75 cc 48 8d 7b 08 48 b8 00 00 RSP: 0018:ffffc900027ffa48 EFLAGS: 00000246 RAX: 1ffff11047ffcd88 RBX: ffff88823ffe6c40 RCX: 0000000000000008 RDX: 00000000000001b9 RSI: 0000000000000003 RDI: ffffffff8b4629a0 RBP: 00000000000000b9 R08: 0000000000000000 R09: ffffffff8b4629a3 R10: fffffbfff168c534 R11: 0000000000000000 R12: ffffffff8b4629a0 R13: 00000000000000ff R14: dffffc0000000000 R15: ffff88823ffe60c0 __raw_callee_save___pv_queued_spin_unlock_slowpath+0x11/0x20 .slowpath+0x9/0xe pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:559 [inline] queued_spin_unlock arch/x86/include/asm/qspinlock.h:56 [inline] do_raw_spin_unlock+0x171/0x230 kernel/locking/spinlock_debug.c:139 __raw_spin_unlock include/linux/spinlock_api_smp.h:151 [inline] _raw_spin_unlock+0x1a/0x40 kernel/locking/spinlock.c:183 spin_unlock include/linux/spinlock.h:394 [inline] __khugepaged_exit+0x28d/0x3f0 mm/khugepaged.c:527 khugepaged_exit include/linux/khugepaged.h:52 [inline] __mmput+0x389/0x470 kernel/fork.c:1080 mmput+0x53/0x60 kernel/fork.c:1102 exit_mm kernel/exit.c:500 [inline] do_exit+0xaa9/0x29f0 kernel/exit.c:810 do_group_exit+0x125/0x310 kernel/exit.c:920 get_signal+0x42a/0x1fb0 kernel/signal.c:2792 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x124/0x200 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:302 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x4493a9 Code: Unable to access opcode bytes at RIP 0x44937f. RSP: 002b:00007f9c01b28cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00000000006dfc48 RCX: 00000000004493a9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00000000006dfc48 RBP: 00000000006dfc40 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dfc4c R13: 00007ffda445dfaf R14: 00007f9c01b299c0 R15: 0000000000000001 softirq: huh, entered softirq 8 HRTIMER 00000000c3e5de91 with preempt_count 00000101, exited with 00000102?