------------[ cut here ]------------
WARNING: CPU: 1 PID: 8560 at kernel/rcu/tree_stall.h:1001 rcu_check_gp_start_stall+0x2dc/0x460 kernel/rcu/tree_stall.h:993
Modules linked in:
CPU: 1 PID: 8560 Comm: syz.1.721 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:rcu_check_gp_start_stall+0x2dc/0x460 kernel/rcu/tree_stall.h:1001
Code: ff ff ff 48 c7 c7 a0 e4 ee 96 be 04 00 00 00 e8 3a a9 6c 00 48 89 df b8 01 00 00 00 87 05 0c b6 7e 15 85 c0 0f 85 19 ff ff ff <0f> 0b 48 81 ff 40 54 d3 8c 74 47 48 c7 c0 dc c3 4a 8e 48 c1 e8 03
RSP: 0018:ffffc900001f0bb8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffffffff8cd35440 RCX: ffffffff81702e86
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff8cd35440
RBP: ffffc900001f0e30 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff2dddc94 R12: 0000000000002904
R13: 1ffff110171e7a6a R14: 0000000000000a02 R15: dffffc0000000000
FS:  00007f9cc67ca6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f9cc5bc6098 CR3: 000000005f15e000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 rcu_core+0x612/0x1720 kernel/rcu/tree.c:2462
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 __do_softirq kernel/softirq.c:612 [inline]
 invoke_softirq kernel/softirq.c:452 [inline]
 __irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
 irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:percpu_ref_put_many+0x1/0x240 include/linux/percpu-refcount.h:327
Code: ff e9 ac fe ff ff 44 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c d5 fe ff ff 4c 89 ff e8 8a 3f c6 fd e9 c8 fe ff ff 0f 1f 44 00 00 55 <41> 57 41 56 41 55 41 54 53 50 49 89 f7 49 89 fe e8 4a f9 6e fd e8
RSP: 0018:ffffc90004a77af0 EFLAGS: 00000286
RAX: cef4eb90c4748b00 RBX: 0000000000000000 RCX: ffffffff8a768ff2
RDX: 0000000000000001 RSI: 0000000000000001 RDI: ffff888020e2c018
RBP: ffffc90004a77bd0 R08: ffffc90004a77a87 R09: 1ffff9200094ef50
R10: dffffc0000000000 R11: fffff5200094ef51 R12: dffffc0000000000
R13: ffff888020e2c018 R14: ffff88805f004dc8 R15: ffff888031593c00
 percpu_ref_put include/linux/percpu-refcount.h:351 [inline]
 ctx_flush_and_put io_uring/io_uring.c:1169 [inline]
 tctx_task_work+0x537/0x800 io_uring/io_uring.c:1268
 task_work_run+0x1ce/0x250 kernel/task_work.c:239
 get_signal+0x1235/0x1400 kernel/signal.c:2678
 arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9cc598ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9cc67ca0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f9cc5bc6098 RCX: 00007f9cc598ebe9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f9cc5bc6098
RBP: 00007f9cc5bc6090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9cc5bc6128 R14: 00007ffc9ca89970 R15: 00007ffc9ca89a58
 </TASK>
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	e9 ac fe ff ff       	jmp    0xfffffeb1
   5:	44 89 f9             	mov    %r15d,%ecx
   8:	80 e1 07             	and    $0x7,%cl
   b:	80 c1 03             	add    $0x3,%cl
   e:	38 c1                	cmp    %al,%cl
  10:	0f 8c d5 fe ff ff    	jl     0xfffffeeb
  16:	4c 89 ff             	mov    %r15,%rdi
  19:	e8 8a 3f c6 fd       	call   0xfdc63fa8
  1e:	e9 c8 fe ff ff       	jmp    0xfffffeeb
  23:	0f 1f 44 00 00       	nopl   0x0(%rax,%rax,1)
  28:	55                   	push   %rbp
* 29:	41 57                	push   %r15 <-- trapping instruction
  2b:	41 56                	push   %r14
  2d:	41 55                	push   %r13
  2f:	41 54                	push   %r12
  31:	53                   	push   %rbx
  32:	50                   	push   %rax
  33:	49 89 f7             	mov    %rsi,%r15
  36:	49 89 fe             	mov    %rdi,%r14
  39:	e8 4a f9 6e fd       	call   0xfd6ef988
  3e:	e8                   	.byte 0xe8