rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P36/1:b..l (detected by 1, t=10502 jiffies, g=239713, q=17103) task:syz-executor.1 state:R running task stack:23568 pid:15919 ppid: 1 flags:0x00004006 Call Trace: context_switch kernel/sched/core.c:4681 [inline] __schedule+0x93a/0x26f0 kernel/sched/core.c:5938 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6098 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35 __raw_read_unlock include/linux/rwlock_api_smp.h:227 [inline] _raw_read_unlock+0x36/0x40 kernel/locking/spinlock.c:255 zap_pid_ns_processes+0x271/0x660 kernel/pid_namespace.c:206 find_child_reaper kernel/exit.c:542 [inline] forget_original_parent kernel/exit.c:631 [inline] exit_notify kernel/exit.c:668 [inline] do_exit+0x2372/0x2a60 kernel/exit.c:845 do_group_exit+0x125/0x310 kernel/exit.c:922 get_signal+0x47f/0x2160 kernel/signal.c:2808 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x48a7b1 RSP: 002b:0000000000a9fd00 EFLAGS: 00000293 ORIG_RAX: 00000000000000e6 RAX: 0000000000000000 RBX: 00000000000014db RCX: 000000000048a7b1 RDX: 0000000000a9fd40 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000a9fddc R08: 0000000000000000 R09: 00007ffdd51a7080 R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000000d R13: 000000000017412b R14: 000000000000000e R15: 0000000000a9fe40 task:kworker/u4:3 state:R running task stack:24864 pid: 36 ppid: 2 flags:0x00004000 Workqueue: phy8 ieee80211_iface_work Call Trace: context_switch kernel/sched/core.c:4681 [inline] __schedule+0x93a/0x26f0 kernel/sched/core.c:5938 preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6098 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35 __local_bh_enable_ip+0x109/0x120 kernel/softirq.c:390 ieee80211_tx_skb_tid.constprop.0+0xff/0x340 net/mac80211/ieee80211_i.h:2164 ieee80211_tx_skb net/mac80211/ieee80211_i.h:2173 [inline] ieee80211_send_deauth_disassoc+0x2ec/0x3e0 net/mac80211/util.c:1742 ieee80211_ibss_sta_expire net/mac80211/ibss.c:1279 [inline] ieee80211_sta_merge_ibss net/mac80211/ibss.c:1305 [inline] ieee80211_ibss_work+0x61d/0xe80 net/mac80211/ibss.c:1711 ieee80211_iface_work+0x8dc/0xa40 net/mac80211/iface.c:1474 process_one_work+0x98d/0x1630 kernel/workqueue.c:2276 worker_thread+0x658/0x11f0 kernel/workqueue.c:2422 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 rcu: rcu_preempt kthread timer wakeup didn't happen for 7403 jiffies! g239713 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 rcu: Possible timer handling issue on cpu=1 timer-softirq=75948 rcu: rcu_preempt kthread starved for 7404 jiffies! g239713 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:I stack:28256 pid: 14 ppid: 2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:4681 [inline] __schedule+0x93a/0x26f0 kernel/sched/core.c:5938 schedule+0xd3/0x270 kernel/sched/core.c:6017 schedule_timeout+0x14a/0x2a0 kernel/time/timer.c:1881 rcu_gp_fqs_loop kernel/rcu/tree.c:1996 [inline] rcu_gp_kthread+0xd34/0x1980 kernel/rcu/tree.c:2169 kthread+0x3e5/0x4d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 rcu: Stack dump where RCU GP kthread last ran: NMI backtrace for cpu 1 CPU: 1 PID: 3720 Comm: syz-executor.1 Not tainted 5.14.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:105 nmi_cpu_backtrace.cold+0x44/0xd7 lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace+0x1b3/0x230 lib/nmi_backtrace.c:62 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_check_gp_kthread_starvation.cold+0x1d1/0x1d6 kernel/rcu/tree_stall.h:479 print_other_cpu_stall kernel/rcu/tree_stall.h:584 [inline] check_cpu_stall kernel/rcu/tree_stall.h:709 [inline] rcu_pending kernel/rcu/tree.c:3922 [inline] rcu_sched_clock_irq+0x2001/0x20c0 kernel/rcu/tree.c:2641 update_process_times+0x16d/0x200 kernel/time/timer.c:1785 tick_sched_handle+0x9b/0x180 kernel/time/tick-sched.c:226 tick_sched_timer+0x1b0/0x2d0 kernel/time/tick-sched.c:1421 __run_hrtimer kernel/time/hrtimer.c:1537 [inline] __hrtimer_run_queues+0x1c0/0xe50 kernel/time/hrtimer.c:1601 hrtimer_interrupt+0x330/0xa00 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0x146/0x530 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:27 [inline] RIP: 0010:check_preemption_disabled+0x22/0x140 lib/smp_processor_id.c:16 Code: e9 23 ff ff ff cc cc cc 41 56 41 55 49 89 f5 41 54 55 48 89 fd 53 0f 1f 44 00 00 65 44 8b 25 5d 0e d7 76 65 8b 1d ae 68 d7 76 <81> e3 ff ff ff 7f 31 ff 89 de 0f 1f 44 00 00 85 db 74 11 0f 1f 44 RSP: 0018:ffffc9001d5ff5c0 EFLAGS: 00000286 RAX: 0000000000000001 RBX: 0000000080000003 RCX: ffffffff815b2958 RDX: 0000000000000001 RSI: ffffffff89e3b560 RDI: ffffffff89e3b5a0 RBP: ffffffff89e3b5a0 R08: 0000000000000000 R09: ffffffff8d6c7fd7 R10: fffffbfff1ad8ffa R11: 0000000000000000 R12: 0000000000000001 R13: ffffffff89e3b560 R14: ffffffff8b97c280 R15: 0000000000000000 rcu_lockdep_current_cpu_online kernel/rcu/tree.c:1208 [inline] rcu_lockdep_current_cpu_online+0x2d/0x150 kernel/rcu/tree.c:1199 rcu_read_lock_held_common kernel/rcu/update.c:112 [inline] rcu_read_lock_held_common kernel/rcu/update.c:102 [inline] rcu_read_lock_sched_held+0x25/0x70 kernel/rcu/update.c:123 trace_lock_acquire include/trace/events/lock.h:13 [inline] lock_acquire+0x442/0x510 kernel/locking/lockdep.c:5596 rcu_lock_acquire include/linux/rcupdate.h:267 [inline] rcu_read_lock include/linux/rcupdate.h:687 [inline] lock_page_memcg+0x66/0x7d0 mm/memcontrol.c:2011 page_remove_rmap+0x25/0x1480 mm/rmap.c:1345 zap_pte_range mm/memory.c:1362 [inline] zap_pmd_range mm/memory.c:1481 [inline] zap_pud_range mm/memory.c:1510 [inline] zap_p4d_range mm/memory.c:1531 [inline] unmap_page_range+0xed5/0x2a10 mm/memory.c:1552 unmap_single_vma+0x198/0x300 mm/memory.c:1597 unmap_vmas+0x16d/0x2f0 mm/memory.c:1629 exit_mmap+0x1d0/0x620 mm/mmap.c:3201 __mmput+0x122/0x470 kernel/fork.c:1101 mmput+0x58/0x60 kernel/fork.c:1122 exit_mm kernel/exit.c:501 [inline] do_exit+0xae2/0x2a60 kernel/exit.c:812 do_group_exit+0x125/0x310 kernel/exit.c:922 get_signal+0x47f/0x2160 kernel/signal.c:2808 arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:865 handle_signal_work kernel/entry/common.c:148 [inline] exit_to_user_mode_loop kernel/entry/common.c:172 [inline] exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:209 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline] syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:302 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665e9 Code: Unable to access opcode bytes at RIP 0x4665bf. RSP: 002b:00007faa331dc218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000056bf88 RCX: 00000000004665e9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000056bf88 RBP: 000000000056bf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf8c R13: 0000000000a9fb1f R14: 00007faa331dc300 R15: 0000000000022000 ---------------- Code disassembly (best guess): 0: e9 23 ff ff ff jmpq 0xffffff28 5: cc int3 6: cc int3 7: cc int3 8: 41 56 push %r14 a: 41 55 push %r13 c: 49 89 f5 mov %rsi,%r13 f: 41 54 push %r12 11: 55 push %rbp 12: 48 89 fd mov %rdi,%rbp 15: 53 push %rbx 16: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 1b: 65 44 8b 25 5d 0e d7 mov %gs:0x76d70e5d(%rip),%r12d # 0x76d70e80 22: 76 23: 65 8b 1d ae 68 d7 76 mov %gs:0x76d768ae(%rip),%ebx # 0x76d768d8 2a: 81 e3 ff ff ff 7f and $0x7fffffff,%ebx <-- trapping instruction 30: 31 ff xor %edi,%edi 32: 89 de mov %ebx,%esi 34: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 39: 85 db test %ebx,%ebx 3b: 74 11 je 0x4e 3d: 0f .byte 0xf 3e: 1f (bad) 3f: 44 rex.R