rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P4697/1:b..l P9951/1:b..l rcu: (detected by 0, t=10502 jiffies, g=38709, q=3072 ncpus=1) task:syz.5.1280 state:R running task stack:0 pid:9951 tgid:9950 ppid:5076 task_flags:0x40054c flags:0x04000011 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5520 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7270 preempt_schedule_common+0xd4/0x190 kernel/sched/core.c:7449 preempt_schedule+0x60/0x78 kernel/sched/core.c:7473 __raw_spin_unlock include/linux/spinlock_api_smp.h:201 [inline] _raw_spin_unlock+0x74/0x78 kernel/locking/spinlock.c:213 spin_unlock include/linux/spinlock.h:401 [inline] zap_pte_range mm/memory.c:2095 [inline] zap_pmd_range mm/memory.c:2151 [inline] zap_pud_range mm/memory.c:2179 [inline] zap_p4d_range mm/memory.c:2200 [inline] __zap_vma_range+0x30b8/0x4348 mm/memory.c:2240 unmap_vmas+0x2e0/0x43c mm/memory.c:2309 exit_mmap+0x1e8/0xad4 mm/mmap.c:1315 __mmput+0xe0/0x2e8 kernel/fork.c:1193 mmput+0x70/0xa8 kernel/fork.c:1216 exit_mm+0x1ac/0x264 kernel/exit.c:614 do_exit+0x524/0x1a74 kernel/exit.c:996 do_group_exit+0x198/0x238 kernel/exit.c:1151 get_signal+0xfb0/0x1094 kernel/signal.c:3039 arch_do_signal_or_restart+0x288/0x444c arch/arm64/kernel/signal.c:1665 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x70/0x17c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:108 [inline] el0_svc+0x18c/0x260 arch/arm64/kernel/entry-common.c:759 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 task:udevd state:R running task stack:0 pid:4697 tgid:4697 ppid:4338 task_flags:0x40014c flags:0x00000000 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5520 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7270 preempt_schedule_irq+0x74/0x174 kernel/sched/core.c:7592 raw_irqentry_exit_cond_resched+0x30/0x40 kernel/entry/common.c:145 irqentry_exit_to_kernel_mode_preempt+0x44/0x54 include/linux/irq-entry-common.h:468 arm64_exit_to_kernel_mode_preempt+0x1c/0x38 arch/arm64/kernel/entry-common.c:69 __el1_irq arch/arm64/kernel/entry-common.c:533 [inline] el1_interrupt+0x4c/0x60 arch/arm64/kernel/entry-common.c:543 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:548 el1h_64_irq+0x6c/0x70 arch/arm64/kernel/entry.S:586 memory_is_poisoned_n mm/kasan/generic.c:-1 [inline] (P) memory_is_poisoned mm/kasan/generic.c:172 [inline] (P) check_region_inline mm/kasan/generic.c:191 [inline] (P) kasan_check_range+0x6c/0x1ac mm/kasan/generic.c:200 (P) __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31 instrument_atomic_read include/linux/instrumented.h:82 [inline] atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline] __page_table_check_zero+0x1d0/0x40c mm/page_table_check.c:142 page_table_check_free include/linux/page_table_check.h:46 [inline] __free_pages_prepare mm/page_alloc.c:1419 [inline] free_unref_folios+0xc50/0x1430 mm/page_alloc.c:3022 folios_put_refs+0x7e0/0x8dc mm/folio.c:1034 free_pages_and_swap_cache+0x240/0x3e8 mm/swap_state.c:592 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline] tlb_batch_pages_flush mm/mmu_gather.c:151 [inline] tlb_flush_mmu_free mm/mmu_gather.c:417 [inline] tlb_flush_mmu+0xfc/0x34c mm/mmu_gather.c:424 tlb_finish_mmu+0xf0/0x220 mm/mmu_gather.c:549 exit_mmap+0x3b4/0xad4 mm/mmap.c:1328 __mmput+0xe0/0x2e8 kernel/fork.c:1193 mmput+0x70/0xa8 kernel/fork.c:1216 exit_mm+0x1ac/0x264 kernel/exit.c:614 do_exit+0x524/0x1a74 kernel/exit.c:996 do_group_exit+0x198/0x238 kernel/exit.c:1151 __do_sys_exit_group kernel/exit.c:1162 [inline] __se_sys_exit_group kernel/exit.c:1160 [inline] pid_child_should_wake+0x0/0x104 kernel/exit.c:1160 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0x44/0x104 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 rcu: rcu_preempt kthread starved for 231 jiffies! g38709 f0x0 RCU_GP_WAIT_FQS(5) ->state=R ->cpu=0 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:0 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00000010 Call trace: __switch_to+0x2b4/0x6e4 arch/arm64/kernel/process.c:775 (T) context_switch kernel/sched/core.c:5520 [inline] __schedule+0x1370/0x2d80 kernel/sched/core.c:7270 __schedule_loop kernel/sched/core.c:7347 [inline] schedule+0x13c/0x20c kernel/sched/core.c:7362 schedule_timeout+0x13c/0x28c kernel/time/sleep_timeout.c:99 rcu_gp_fqs_loop+0x284/0x13c4 kernel/rcu/tree.c:2122 rcu_gp_kthread+0x148/0x230 kernel/rcu/tree.c:2330 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838 rcu: Stack dump where RCU GP kthread last ran: CPU: 0 UID: 0 PID: 5696 Comm: kworker/u8:8 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/14/2026 Workqueue: bat_events batadv_tt_purge pstate: 43400005 (nZcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : rps_input_queue_tail_save include/net/rps.h:181 [inline] pc : enqueue_to_backlog+0x320/0xc64 net/core/dev.c:5468 lr : backlog_unlock_irq_restore net/core/dev.c:259 [inline] lr : enqueue_to_backlog+0x318/0xc64 net/core/dev.c:5465 sp : ffff80008ec36a00 x29: ffff80008ec36a20 x28: 1fffe00035ba1b46 x27: 0000000000000000 x26: dfff800000000000 x25: ffff0001add0da20 x24: 0000000000000000 x23: ffff0001add0da28 x22: ffff0001add0da18 x21: 00000000000000c0 x20: ffff80008ec36a98 x19: 00000000004650d5 x18: 00000000883c0640 x17: ffff800125154000 x16: ffff80008ec30000 x15: 0000000000000000 x14: 00000000803107d8 x13: 0000000000000001 x12: 0000000000000003 x11: ffff80008a6a6e28 x10: 0000000000000003 x9 : 0000000000000301 x8 : 1ffff00011d86d53 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000001 x4 : 0000000000000008 x3 : ffff800084ce88e0 x2 : 0000000000000080 x1 : ffff0000cd679d80 x0 : 0000000000000000 Call trace: __daif_local_irq_restore arch/arm64/include/asm/irqflags.h:175 [inline] (P) arch_local_irq_restore arch/arm64/include/asm/irqflags.h:195 [inline] (P) backlog_unlock_irq_restore net/core/dev.c:259 [inline] (P) enqueue_to_backlog+0x320/0xc64 net/core/dev.c:5465 (P) netif_rx_internal+0x138/0x6f8 net/core/dev.c:5781 __netif_rx+0xa4/0x11c net/core/dev.c:5801 loopback_xmit+0x384/0x5f8 drivers/net/loopback.c:90 __netdev_start_xmit include/linux/netdevice.h:5429 [inline] netdev_start_xmit include/linux/netdevice.h:5438 [inline] xmit_one net/core/dev.c:3937 [inline] dev_hard_start_xmit+0x1dc/0x9d4 net/core/dev.c:3953 __dev_queue_xmit+0xed4/0x2bc0 net/core/dev.c:4926 dev_queue_xmit include/linux/netdevice.h:3461 [inline] neigh_hh_output include/net/neighbour.h:544 [inline] neigh_output include/net/neighbour.h:558 [inline] ip_finish_output2+0xcd0/0x1274 net/ipv4/ip_output.c:236 __ip_finish_output+0x198/0x41c net/ipv4/ip_output.c:-1 ip_finish_output+0x44/0x2fc net/ipv4/ip_output.c:324 NF_HOOK_COND include/linux/netfilter.h:314 [inline] ip_output+0x28c/0x400 net/ipv4/ip_output.c:437 dst_output include/net/dst.h:470 [inline] ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131 synproxy_send_tcp+0x3ec/0x5a4 net/netfilter/nf_synproxy_core.c:442 synproxy_send_client_synack+0x3b0/0x640 net/netfilter/nf_synproxy_core.c:487 nft_synproxy_eval_v4+0x16c/0x278 net/netfilter/nft_synproxy.c:59 nft_synproxy_do_eval+0x2d8/0x4a4 net/netfilter/nft_synproxy.c:141 nft_synproxy_eval+0x34/0x48 net/netfilter/nft_synproxy.c:247 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x418/0x13c8 net/netfilter/nf_tables_core.c:285 nft_do_chain_inet+0x284/0x3d4 net/netfilter/nft_chain_filter.c:162 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline] nf_hook_slow+0xc8/0x224 net/netfilter/core.c:619 nf_hook include/linux/netfilter.h:280 [inline] NF_HOOK+0x1f0/0x398 include/linux/netfilter.h:323 ip_local_deliver+0x128/0x188 net/ipv4/ip_input.c:262 dst_input include/net/dst.h:480 [inline] ip_rcv_finish+0x20c/0x230 net/ipv4/ip_input.c:492 NF_HOOK+0x308/0x398 include/linux/netfilter.h:325 ip_rcv+0x7c/0x9c net/ipv4/ip_input.c:612 __netif_receive_skb_one_core+0xc8/0x110 net/core/dev.c:6264 __netif_receive_skb+0x34/0x128 net/core/dev.c:6377 process_backlog+0x5f4/0x16f8 net/core/dev.c:6728 __napi_poll+0xb4/0x328 net/core/dev.c:7787 napi_poll net/core/dev.c:7850 [inline] net_rx_action+0x5b0/0xc14 net/core/dev.c:8007 handle_softirqs+0x2ec/0xd98 kernel/softirq.c:645 __do_softirq+0x14/0x20 kernel/softirq.c:679 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:78 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:885 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:83 do_softirq+0x90/0xf8 kernel/softirq.c:546 __local_bh_enable_ip+0x240/0x35c kernel/softirq.c:473 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:237 [inline] _raw_spin_unlock_bh+0x3c/0x4c kernel/locking/spinlock.c:245 spin_unlock_bh include/linux/spinlock.h:407 [inline] batadv_tt_global_purge net/batman-adv/translation-table.c:2390 [inline] batadv_tt_purge+0x3e4/0x7b4 net/batman-adv/translation-table.c:3754 process_one_work kernel/workqueue.c:3387 [inline] process_scheduled_works+0x91c/0x1250 kernel/workqueue.c:3470 worker_thread+0x798/0xbd0 kernel/workqueue.c:3551 kthread+0x304/0x3d4 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:838