------------[ cut here ]------------
WARNING: kernel/rcu/tree_stall.h:1049 at rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 kernel/rcu/tree_stall.h:1049, CPU#0: vhost-8027/8031
Modules linked in:
CPU: 0 UID: 0 PID: 8031 Comm: vhost-8027 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 kernel/rcu/tree_stall.h:1049
Code: 88 61 01 00 00 be 04 00 00 00 48 c7 c7 c0 52 c2 9a e8 b0 3a 85 00 b8 01 00 00 00 87 05 05 c5 1e 19 85 c0 0f 85 3d 01 00 00 90 <0f> 0b 90 48 c7 c3 74 e4 88 90 48 81 fd 00 46 3d 8e 74 5a 48 b8 00
RSP: 0018:ffffc90000007df0 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000002904 RCX: ffffffff81a38db0
RDX: fffffbfff3584a58 RSI: 0000000000000004 RDI: ffffffff9ac252c0
RBP: ffffffff8e3d4600 R08: 0000000000000001 R09: fffffbfff3584a58
R10: 0000000000000003 R11: ffff88807e42aff0 R12: 1ffffffff1c02250
R13: 0000000000000246 R14: ffffffff8e3d4600 R15: ffff8880b843bc52
FS:  00007f9fa4d836c0(0000) GS:ffff8881248f5000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b302f9ff8 CR3: 000000007b72a000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 rcu_check_gp_start_stall kernel/rcu/tree_stall.h:1012 [inline]
 rcu_core+0x4cf/0x15f0 kernel/rcu/tree.c:2852
 handle_softirqs+0x219/0x950 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:723
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:lock_acquire+0x62/0x330 kernel/locking/lockdep.c:5872
Code: b4 18 12 83 f8 07 0f 87 a2 02 00 00 89 c0 48 0f a3 05 72 b8 ee 0e 0f 82 74 02 00 00 8b 35 0a e9 ee 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 89 b4 18 12 0f 85 ad 02 00 00 48 83 c4
RSP: 0018:ffffc9001c36f3a0 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e3c9620 RCX: 00000000654d142b
RDX: 0000000000000000 RSI: ffffffff8daa7d80 RDI: ffffffff8bf2b380
RBP: 0000000000000002 R08: 00000000623d3099 R09: 000000009623d309
R10: 0000000000000002 R11: ffff88807e42aff0 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 rcu_read_lock include/linux/rcupdate.h:867 [inline]
 mt_find+0x14f/0xa20 lib/maple_tree.c:6495
 find_vma+0xbf/0x140 mm/mmap.c:906
 gup_vma_lookup+0x24/0x220 mm/gup.c:1275
 __get_user_pages+0x241/0x3590 mm/gup.c:1396
 __get_user_pages_locked mm/gup.c:1692 [inline]
 __gup_longterm_locked+0xa92/0x17e0 mm/gup.c:2476
 gup_fast_fallback+0xf5f/0x2350 mm/gup.c:3220
 pin_user_pages_fast+0xa7/0xf0 mm/gup.c:3326
 set_bit_to_user drivers/vhost/vhost.c:2425 [inline]
 log_write+0x267/0x320 drivers/vhost/vhost.c:2451
 log_used.isra.0+0x170/0x1e0 drivers/vhost/vhost.c:2507
 vhost_update_used_flags+0x2ff/0x3d0 drivers/vhost/vhost.c:2582
 vhost_disable_notify drivers/vhost/vhost.c:3263 [inline]
 vhost_disable_notify+0xba/0x1b0 drivers/vhost/vhost.c:3255
 vhost_vsock_handle_tx_kick+0x18e/0xdb0 drivers/vhost/vsock.c:500
 vhost_run_work_list+0x18b/0x230 drivers/vhost/vhost.c:454
 vhost_task_fn+0x165/0x460 kernel/vhost_task.c:49
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
----------------
Code disassembly (best guess):
   0:	b4 18                	mov    $0x18,%ah
   2:	12 83 f8 07 0f 87    	adc    -0x78f0f808(%rbx),%al
   8:	a2 02 00 00 89 c0 48 	movabs %al,0xa30f48c089000002
   f:	0f a3
  11:	05 72 b8 ee 0e       	add    $0xeeeb872,%eax
  16:	0f 82 74 02 00 00    	jb     0x290
  1c:	8b 35 0a e9 ee 0e    	mov    0xeeee90a(%rip),%esi        # 0xeeee92c
  22:	85 f6                	test   %esi,%esi
  24:	0f 85 8d 00 00 00    	jne    0xb7
* 2a:	48 8b 44 24 30       	mov    0x30(%rsp),%rax <-- trapping instruction
  2f:	65 48 2b 05 89 b4 18 	sub    %gs:0x1218b489(%rip),%rax        # 0x1218b4c0
  36:	12
  37:	0f 85 ad 02 00 00    	jne    0x2ea
  3d:	48                   	rex.W
  3e:	83                   	.byte 0x83
  3f:	c4                   	.byte 0xc4