rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: (detected by 0, t=10502 jiffies, g=31793, q=139) rcu: All QSes seen, last rcu_preempt kthread activity 10484 (4294996442-4294985958), jiffies_till_next_fqs=1, root ->qsmask 0x0 rcu: rcu_preempt kthread starved for 10484 jiffies! g31793 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28888 pid: 13 ppid: 2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:4313 [inline] __schedule+0x90c/0x21a0 kernel/sched/core.c:5064 schedule+0xcf/0x270 kernel/sched/core.c:5143 schedule_timeout+0x148/0x250 kernel/time/timer.c:1878 rcu_gp_fqs_loop kernel/rcu/tree.c:1940 [inline] rcu_gp_kthread+0xbbe/0x1d70 kernel/rcu/tree.c:2113 kthread+0x3b1/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 ================================ WARNING: inconsistent lock state 5.11.0-rc4-syzkaller #0 Not tainted -------------------------------- inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. syz-executor.4/15861 [HC0[0]:SC1[1]:HE0:SE0] takes: ffffffff8b37bbd8 (rcu_node_0){?.-.}-{2:2}, at: print_other_cpu_stall kernel/rcu/tree_stall.h:493 [inline] ffffffff8b37bbd8 (rcu_node_0){?.-.}-{2:2}, at: check_cpu_stall kernel/rcu/tree_stall.h:652 [inline] ffffffff8b37bbd8 (rcu_node_0){?.-.}-{2:2}, at: rcu_pending kernel/rcu/tree.c:3751 [inline] ffffffff8b37bbd8 (rcu_node_0){?.-.}-{2:2}, at: rcu_sched_clock_irq.cold+0xbc/0xedf kernel/rcu/tree.c:2580 {IN-HARDIRQ-W} state was registered at: lock_acquire kernel/locking/lockdep.c:5437 [inline] lock_acquire+0x29d/0x740 kernel/locking/lockdep.c:5402 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x39/0x50 kernel/locking/spinlock.c:159 rcu_report_exp_cpu_mult+0x72/0x320 kernel/rcu/tree_exp.h:237 flush_smp_call_function_queue+0x34b/0x640 kernel/smp.c:425 __sysvec_call_function_single+0x95/0x3d0 arch/x86/kernel/smp.c:248 asm_call_irq_on_stack+0xf/0x20 __run_sysvec_on_irqstack arch/x86/include/asm/irq_stack.h:37 [inline] run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:89 [inline] sysvec_call_function_single+0xbd/0x100 arch/x86/kernel/smp.c:243 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:636 kernel_init_free_pages+0x2/0x120 mm/page_alloc.c:1204 prep_new_page mm/page_alloc.c:2304 [inline] get_page_from_freelist+0x1c6e/0x3f80 mm/page_alloc.c:3943 __alloc_pages_nodemask+0x2d6/0x730 mm/page_alloc.c:4993 alloc_pages_current+0x18c/0x2a0 mm/mempolicy.c:2267 alloc_pages include/linux/gfp.h:547 [inline] alloc_slab_page mm/slub.c:1618 [inline] allocate_slab+0x2b6/0x4a0 mm/slub.c:1758 new_slab mm/slub.c:1821 [inline] new_slab_objects mm/slub.c:2578 [inline] ___slab_alloc+0x476/0x790 mm/slub.c:2741 __slab_alloc.constprop.0+0x95/0xe0 mm/slub.c:2781 slab_alloc_node mm/slub.c:2856 [inline] slab_alloc mm/slub.c:2899 [inline] kmem_cache_alloc+0x36e/0x440 mm/slub.c:2904 copy_fs_struct+0x43/0x330 fs/fs_struct.c:114 copy_fs kernel/fork.c:1444 [inline] copy_process+0x4dbc/0x6fd0 kernel/fork.c:2090 kernel_clone+0xe7/0xab0 kernel/fork.c:2464 kernel_thread+0xb5/0xf0 kernel/fork.c:2516 call_usermodehelper_exec_work kernel/umh.c:172 [inline] call_usermodehelper_exec_work+0xcc/0x180 kernel/umh.c:158 process_one_work+0x98d/0x15f0 kernel/workqueue.c:2275 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421 kthread+0x3b1/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 irq event stamp: 17342257 hardirqs last enabled at (17342256): [] asm_sysvec_irq_work+0x12/0x20 arch/x86/include/asm/idtentry.h:654 hardirqs last disabled at (17342257): [] sysvec_apic_timer_interrupt+0xc/0x100 arch/x86/kernel/apic/apic.c:1096 softirqs last enabled at (11881720): [] asm_call_irq_on_stack+0xf/0x20 softirqs last disabled at (11881723): [] asm_call_irq_on_stack+0xf/0x20 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(rcu_node_0); lock(rcu_node_0); *** DEADLOCK *** 3 locks held by syz-executor.4/15861: #0: ffffffff8b484338 (vmap_area_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:354 [inline] #0: ffffffff8b484338 (vmap_area_lock){+.+.}-{2:2}, at: alloc_vmap_area+0xa44/0x1e00 mm/vmalloc.c:1235 #1: ffffc90000007d78 ((&ndev->rs_timer)){+.-.}-{0:0}, at: lockdep_copy_map include/linux/lockdep.h:35 [inline] #1: ffffc90000007d78 ((&ndev->rs_timer)){+.-.}-{0:0}, at: call_timer_fn+0xd5/0x6b0 kernel/time/timer.c:1407 #2: ffffffff8b37bbd8 (rcu_node_0){?.-.}-{2:2}, at: print_other_cpu_stall kernel/rcu/tree_stall.h:493 [inline] #2: ffffffff8b37bbd8 (rcu_node_0){?.-.}-{2:2}, at: check_cpu_stall kernel/rcu/tree_stall.h:652 [inline] #2: ffffffff8b37bbd8 (rcu_node_0){?.-.}-{2:2}, at: rcu_pending kernel/rcu/tree.c:3751 [inline] #2: ffffffff8b37bbd8 (rcu_node_0){?.-.}-{2:2}, at: rcu_sched_clock_irq.cold+0xbc/0xedf kernel/rcu/tree.c:2580 stack backtrace: CPU: 0 PID: 15861 Comm: syz-executor.4 Not tainted 5.11.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_usage_bug kernel/locking/lockdep.c:4413 [inline] valid_state kernel/locking/lockdep.c:3751 [inline] mark_lock_irq kernel/locking/lockdep.c:3954 [inline] mark_lock.cold+0x56/0x73 kernel/locking/lockdep.c:4411 mark_held_locks+0x9f/0xe0 kernel/locking/lockdep.c:4012 __trace_hardirqs_on_caller kernel/locking/lockdep.c:4030 [inline] lockdep_hardirqs_on_prepare kernel/locking/lockdep.c:4098 [inline] lockdep_hardirqs_on_prepare+0x135/0x400 kernel/locking/lockdep.c:4050 trace_hardirqs_on+0x5b/0x1c0 kernel/trace/trace_preemptirq.c:49 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:dst_alloc+0x45/0x650 net/core/dst.c:84 Code: ec 10 e8 0e eb 78 fa 48 8d 7b 08 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 6f 05 00 00 4c 8b 63 08 <4d> 85 e4 74 22 e8 e1 ea 78 fa 89 e8 31 ff 83 e0 08 89 c6 89 04 24 RSP: 0018:ffffc900000079d0 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffff88806dbc0b40 RCX: 0000000000000100 RDX: 1ffff1100db78169 RSI: ffffffff86f9df72 RDI: ffff88806dbc0b48 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff87ac3590 R13: ffff888010fb8000 R14: 0000000000000001 R15: 00000000ffffffff ip6_dst_alloc+0x2e/0x100 net/ipv6/route.c:356 icmp6_dst_alloc+0x6d/0x6c0 net/ipv6/route.c:3167 ndisc_send_skb+0x122e/0x1750 net/ipv6/ndisc.c:488 ndisc_send_rs+0x12e/0x700 net/ipv6/ndisc.c:702 addrconf_rs_timer+0x3f2/0x820 net/ipv6/addrconf.c:3875 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1417 expire_timers kernel/time/timer.c:1462 [inline] __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1731 __run_timers kernel/time/timer.c:1712 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1744 __do_softirq+0x2bc/0xa29 kernel/softirq.c:343 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:226 [inline] __irq_exit_rcu kernel/softirq.c:420 [inline] irq_exit_rcu+0x134/0x200 kernel/softirq.c:432 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:find_va_links mm/vmalloc.c:555 [inline] RIP: 0010:insert_vmap_area.constprop.0+0xa4/0x480 mm/vmalloc.c:710 Code: 48 8b 04 24 4c 8b 70 08 e8 a9 36 c8 ff 48 8d 7b f8 48 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 15 03 00 00 48 8d 7b f0 4c 8b 63 f8 <48> 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 13 03 00 00 4c 89 e6 4c 89 RSP: 0018:ffffc900017df950 EFLAGS: 00000246 RAX: 1ffff11028bad461 RBX: ffff888145d6a310 RCX: ffffc90011b7d000 RDX: 0000000000040000 RSI: ffffffff81aa93d7 RDI: ffff888145d6a300 RBP: dffffc0000000000 R08: ffffc900012fa000 R09: 0000000000000003 R10: ffffffff81aa9429 R11: 0000000000000001 R12: ffffc90001456000 R13: ffff888145d6a310 R14: ffffc900012fa000 R15: ffffc900012f8000 alloc_vmap_area+0xa4c/0x1e00 mm/vmalloc.c:1236 __get_vm_area_node+0x128/0x380 mm/vmalloc.c:2096 __vmalloc_node_range mm/vmalloc.c:2571 [inline] __vmalloc_node mm/vmalloc.c:2619 [inline] __vmalloc+0xf3/0x1a0 mm/vmalloc.c:2633 bpf_prog_alloc_no_stats+0x33/0x2e0 kernel/bpf/core.c:85 bpf_prog_alloc+0x2c/0x250 kernel/bpf/core.c:113 bpf_prog_load+0x656/0x1f40 kernel/bpf/syscall.c:2152 __do_sys_bpf+0x1251/0x4f10 kernel/bpf/syscall.c:4382 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e219 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f140bd9ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219 RDX: 0000000000000048 RSI: 00000000200054c0 RDI: 0000000000000005 RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007fffc5db893f R14: 00007f140bd9b9c0 R15: 000000000119bf8c ------------[ cut here ]------------ timer: addrconf_rs_timer+0x0/0x820 net/ipv6/addrconf.c:1857 preempt leak: 00000101 -> 00000102 WARNING: CPU: 0 PID: 15861 at kernel/time/timer.c:1423 call_timer_fn+0x5d8/0x6b0 kernel/time/timer.c:1423 Modules linked in: CPU: 0 PID: 15861 Comm: syz-executor.4 Not tainted 5.11.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:call_timer_fn+0x5d8/0x6b0 kernel/time/timer.c:1423 Code: e8 6d 75 10 00 89 da 4c 89 f6 48 c7 c7 60 7f 4d 89 65 8b 0d 9a 9a 9f 7e 81 e1 ff ff ff 7f c6 05 ee 0f 8d 0b 01 e8 5c 89 56 07 <0f> 0b e9 80 fc ff ff e8 3c 75 10 00 0f 0b e9 fb fd ff ff e8 30 75 RSP: 0018:ffffc90000007d40 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000101 RCX: 0000000000000000 RDX: ffff88801e248000 RSI: ffffffff815b6bc5 RDI: fffff52000000f9a RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffff815afd9e R11: 0000000000000000 R12: 0000000000000000 R13: 1ffff92000000fa9 R14: ffffffff87aaf9f0 R15: 0000000000000000 FS: 00007f140bd9b700(0000) GS:ffff8880b9e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000c0258da020 CR3: 0000000024984000 CR4: 0000000000350ef0 Call Trace: expire_timers kernel/time/timer.c:1462 [inline] __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1731 __run_timers kernel/time/timer.c:1712 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1744 __do_softirq+0x2bc/0xa29 kernel/softirq.c:343 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:226 [inline] __irq_exit_rcu kernel/softirq.c:420 [inline] irq_exit_rcu+0x134/0x200 kernel/softirq.c:432 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:find_va_links mm/vmalloc.c:555 [inline] RIP: 0010:insert_vmap_area.constprop.0+0xa4/0x480 mm/vmalloc.c:710 Code: 48 8b 04 24 4c 8b 70 08 e8 a9 36 c8 ff 48 8d 7b f8 48 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 15 03 00 00 48 8d 7b f0 4c 8b 63 f8 <48> 89 f8 48 c1 e8 03 80 3c 28 00 0f 85 13 03 00 00 4c 89 e6 4c 89 RSP: 0018:ffffc900017df950 EFLAGS: 00000246 RAX: 1ffff11028bad461 RBX: ffff888145d6a310 RCX: ffffc90011b7d000 RDX: 0000000000040000 RSI: ffffffff81aa93d7 RDI: ffff888145d6a300 RBP: dffffc0000000000 R08: ffffc900012fa000 R09: 0000000000000003 R10: ffffffff81aa9429 R11: 0000000000000001 R12: ffffc90001456000 R13: ffff888145d6a310 R14: ffffc900012fa000 R15: ffffc900012f8000 alloc_vmap_area+0xa4c/0x1e00 mm/vmalloc.c:1236 __get_vm_area_node+0x128/0x380 mm/vmalloc.c:2096 __vmalloc_node_range mm/vmalloc.c:2571 [inline] __vmalloc_node mm/vmalloc.c:2619 [inline] __vmalloc+0xf3/0x1a0 mm/vmalloc.c:2633 bpf_prog_alloc_no_stats+0x33/0x2e0 kernel/bpf/core.c:85 bpf_prog_alloc+0x2c/0x250 kernel/bpf/core.c:113 bpf_prog_load+0x656/0x1f40 kernel/bpf/syscall.c:2152 __do_sys_bpf+0x1251/0x4f10 kernel/bpf/syscall.c:4382 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e219 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f140bd9ac68 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219 RDX: 0000000000000048 RSI: 00000000200054c0 RDI: 0000000000000005 RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007fffc5db893f R14: 00007f140bd9b9c0 R15: 000000000119bf8c