BUG: workqueue lockup - pool cpus=0 node=0 flags=0x0 nice=0 stuck for 171s! BUG: workqueue lockup - pool cpus=1 node=0 flags=0x0 nice=0 stuck for 171s! Showing busy workqueues and worker pools: workqueue events: flags=0x0 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: kfree_rcu_monitor pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=3/256 refcnt=4 pending: vmstat_shepherd, psi_avgs_work, kfree_rcu_monitor workqueue events_unbound: flags=0x2 pwq 4: cpus=0-1 flags=0x4 nice=0 active=5/512 refcnt=7 pending: linkwatch_event, fsnotify_connector_destroy_workfn, fsnotify_mark_destroy_workfn, toggle_allocation_gate, flush_memcg_stats_dwork workqueue events_power_efficient: flags=0x80 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=6/256 refcnt=7 pending: neigh_managed_work, wg_ratelimiter_gc_entries, neigh_managed_work, neigh_periodic_work, neigh_periodic_work, check_lifetime pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: gc_worker workqueue netns: flags=0xe000a pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/1 refcnt=3 in-flight: 8:cleanup_net workqueue mm_percpu_wq: flags=0x8 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: vmstat_update pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: vmstat_update workqueue writeback: flags=0x4a pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=3 pending: wb_workfn workqueue dm_bufio_cache: flags=0x8 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: work_fn workqueue mld: flags=0x40008 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/1 refcnt=30 pending: mld_ifc_work inactive: mld_ifc_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_ifc_work, mld_dad_work pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/1 refcnt=34 pending: mld_ifc_work inactive: mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_dad_work, mld_ifc_work, mld_ifc_work, mld_ifc_work, mld_ifc_work workqueue ipv6_addrconf: flags=0x40008 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/1 refcnt=97 in-flight: 330:addrconf_dad_work inactive: addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work , addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_verify_work, addrconf_verify_work pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/1 refcnt=126 in-flight: 362:addrconf_dad_work inactive: addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work , addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work , addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_dad_work, addrconf_verify_work, addrconf_verify_work, addrconf_verify_work, addrconf_verify_work, addrconf_verify_work workqueue wg-crypt-wg0: flags=0x28 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker workqueue wg-crypt-wg1: flags=0x28 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker workqueue wg-crypt-wg2: flags=0x28 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker workqueue wg-kex-wg0: flags=0x6 pwq 4: cpus=0-1 flags=0x4 nice=0 active=2/256 refcnt=4 pending: wg_packet_handshake_send_worker, wg_packet_handshake_send_worker workqueue wg-kex-wg1: flags=0x6 pwq 4: cpus=0-1 flags=0x4 nice=0 active=2/256 refcnt=4 pending: wg_packet_handshake_send_worker, wg_packet_handshake_send_worker workqueue wg-kex-wg2: flags=0x6 pwq 4: cpus=0-1 flags=0x4 nice=0 active=2/256 refcnt=4 pending: wg_packet_handshake_send_worker, wg_packet_handshake_send_worker workqueue wg-kex-wg0: flags=0x6 pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=3 pending: wg_packet_handshake_send_worker workqueue wg-crypt-wg0: flags=0x28 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker workqueue wg-kex-wg1: flags=0x6 pwq 4: cpus=0-1 flags=0x4 nice=0 active=2/256 refcnt=4 pending: wg_packet_handshake_send_worker, wg_packet_handshake_send_worker workqueue wg-crypt-wg1: flags=0x28 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker workqueue wg-kex-wg2: flags=0x6 pwq 4: cpus=0-1 flags=0x4 nice=0 active=1/256 refcnt=3 pending: wg_packet_handshake_send_worker workqueue wg-crypt-wg2: flags=0x28 pwq 2: cpus=1 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker pwq 0: cpus=0 node=0 flags=0x0 nice=0 active=1/256 refcnt=2 pending: wg_packet_encrypt_worker pool 0: cpus=0 node=0 flags=0x0 nice=0 hung=172s workers=4 idle: 361 19 6 pool 2: cpus=1 node=0 flags=0x0 nice=0 hung=172s workers=4 idle: 24 387 40 pool 4: cpus=0-1 flags=0x4 nice=0 hung=172s workers=5 idle: 37 10 421 342 rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: (detected by 0, t=10002 jiffies, g=1925, q=518 ncpus=2) rcu: All QSes seen, last rcu_preempt kthread activity 10003 (4294980456-4294970453), jiffies_till_next_fqs=1, root ->qsmask 0x0 rcu: rcu_preempt kthread starved for 10004 jiffies! g1925 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1 rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior. rcu: RCU grace-period kthread stack dump: task:rcu_preempt state:R running task stack:28528 pid:14 ppid:2 flags:0x00004000 Call Trace: context_switch kernel/sched/core.c:5420 [inline] __schedule+0xb87/0x14e0 kernel/sched/core.c:6750 preempt_schedule_common+0x9b/0xf0 kernel/sched/core.c:6919 preempt_schedule+0xa7/0xb0 kernel/sched/core.c:6943 preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34 __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline] _raw_spin_unlock_irqrestore+0x6f/0x80 kernel/locking/spinlock.c:194 try_to_del_timer_sync kernel/time/timer.c:1324 [inline] del_timer_sync+0x144/0x1a0 kernel/time/timer.c:1472 schedule_timeout+0x134/0x2e0 kernel/time/timer.c:1972 rcu_gp_fqs_loop+0x2d8/0x10a0 kernel/rcu/tree.c:1706 rcu_gp_kthread+0x95/0x370 kernel/rcu/tree.c:1905 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 rcu: Stack dump where RCU GP kthread last ran: Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 431 Comm: syz.5.20 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:__list_add include/linux/list.h:73 [inline] RIP: 0010:list_add_tail include/linux/list.h:102 [inline] RIP: 0010:send_sigqueue+0x2c0/0x650 kernel/signal.c:2020 Code: 2b 00 48 b8 00 00 00 00 00 fc ff df 41 80 3c 04 00 49 89 c4 74 08 4c 89 f7 e8 3c c5 6f 00 4d 89 2e 48 8b 45 c0 42 80 3c 20 00 <74> 08 4c 89 ef e8 26 c5 6f 00 49 89 5d 00 4d 8d 65 08 4c 89 e0 48 RSP: 0018:ffffc900001b0c68 EFLAGS: 00000046 RAX: 1ffff11021f72396 RBX: ffff888123fe4f40 RCX: ffff888118a23cc0 RDX: 0000000000010000 RSI: ffff888123fe4f40 RDI: ffff88810fb91cb0 RBP: ffffc900001b0cd0 R08: 0000000000000004 R09: 0000000000000003 R10: fffff52000036178 R11: 1ffff92000036178 R12: dffffc0000000000 R13: ffff88810fb91cb0 R14: ffff888123fe4f48 R15: ffff888123fe4f40 FS: 00007fdca406a6c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000020000006b000 CR3: 000000013246b000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: posix_timer_event kernel/time/posix-timers.c:355 [inline] posix_timer_fn+0x16a/0x3f0 kernel/time/posix-timers.c:381 __run_hrtimer kernel/time/hrtimer.c:1690 [inline] __hrtimer_run_queues+0x3cd/0x9f0 kernel/time/hrtimer.c:1754 hrtimer_interrupt+0x3c7/0x8c0 kernel/time/hrtimer.c:1816 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline] __sysvec_apic_timer_interrupt+0x11e/0x440 arch/x86/kernel/apic/apic.c:1124 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691 RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irq+0x48/0x70 kernel/locking/spinlock.c:202 Code: 74 12 48 89 fb 48 c7 c7 00 d1 ed 86 e8 21 6f c0 fc 48 89 df 48 83 3d c6 b2 f9 01 00 74 26 e8 93 0c 00 00 90 fb bf 01 00 00 00 93 95 57 fc 65 8b 05 74 4f 0e 7b 85 c0 74 03 5b 5d c3 e8 34 5c RSP: 0018:ffffc90000ec7b90 EFLAGS: 00000246 RAX: 0000000000000001 RBX: 0000000000000021 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: ffffc90000ec7b98 R08: dffffc0000000000 R09: fffff520001d8fc0 R10: fffff520001d8fc0 R11: 1ffff920001d8fbc R12: dffffc0000000000 R13: 1ffff11022c74da4 R14: 000000001c000004 R15: ffff8881163a6d20 spin_unlock_irq include/linux/spinlock.h:401 [inline] get_signal+0x12a4/0x1520 kernel/signal.c:2892 arch_do_signal_or_restart+0xb0/0x1030 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174 exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:87 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7fdca318eec7 Code: ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 RSP: 002b:00007fdca406a0e8 EFLAGS: 00000246 RAX: 00000000000000ca RBX: 00007fdca33e5fa8 RCX: 00007fdca318eec9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fdca33e5fa8 RBP: 00007fdca33e5fa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fdca33e6038 R14: 00007ffcc2ec3590 R15: 00007ffcc2ec3678 ---------------- Code disassembly (best guess): 0: 2b 00 sub (%rax),%eax 2: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 9: fc ff df c: 41 80 3c 04 00 cmpb $0x0,(%r12,%rax,1) 11: 49 89 c4 mov %rax,%r12 14: 74 08 je 0x1e 16: 4c 89 f7 mov %r14,%rdi 19: e8 3c c5 6f 00 call 0x6fc55a 1e: 4d 89 2e mov %r13,(%r14) 21: 48 8b 45 c0 mov -0x40(%rbp),%rax 25: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) * 2a: 74 08 je 0x34 <-- trapping instruction 2c: 4c 89 ef mov %r13,%rdi 2f: e8 26 c5 6f 00 call 0x6fc55a 34: 49 89 5d 00 mov %rbx,0x0(%r13) 38: 4d 8d 65 08 lea 0x8(%r13),%r12 3c: 4c 89 e0 mov %r12,%rax 3f: 48 rex.W