rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (0 ticks this GP) idle=4fc4/1/0x4000000000000000 softirq=38041/38041 fqs=0
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P13275/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=57233, q=468 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 13264 Comm: syz.0.3128 Not tainted 6.11.0-rc7-syzkaller-00097-g196145c606d0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
RIP: 0010:__lock_is_held kernel/locking/lockdep.c:5497 [inline]
RIP: 0010:lock_is_held_type+0x82/0x190 kernel/locking/lockdep.c:5831
Code: 41 89 f6 49 89 ff 48 c7 04 24 00 00 00 00 9c 8f 04 24 4c 8b 24 24 fa 48 c7 c7 40 e2 0a 8c e8 55 1b 00 00 65 ff 05 9e dc 48 74 <41> 83 bd d8 0a 00 00 00 7e 47 4c 89 eb 48 81 c3 e0 0a 00 00 31 ed
RSP: 0018:ffffc90000a18c48 EFLAGS: 00000002
RAX: 0000000000000001 RBX: 00000000ffffffff RCX: ffff88805091bc00
RDX: ffff88805091bc00 RSI: ffffffff8c0ae240 RDI: ffffffff8c608f40
RBP: dffffc0000000000 R08: ffffffff89c02d5b R09: fffff52000143180
R10: dffffc0000000000 R11: fffff52000143180 R12: 0000000000000046
R13: ffff88805091bc00 R14: 00000000ffffffff R15: ffff888056c9f300
FS:  00007f2d49bd76c0(0000) GS:ffff8880b8900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f58cc2656c0 CR3: 0000000071300000 CR4: 0000000000350ef0
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 lock_is_held include/linux/lockdep.h:249 [inline]
 advance_sched+0xcd/0xca0 net/sched/sch_taprio.c:925
 __run_hrtimer kernel/time/hrtimer.c:1689 [inline]
 __hrtimer_run_queues+0x59d/0xd50 kernel/time/hrtimer.c:1753
 hrtimer_interrupt+0x396/0x990 kernel/time/hrtimer.c:1815
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1032 [inline]
 __sysvec_apic_timer_interrupt+0x112/0x3f0 arch/x86/kernel/apic/apic.c:1049
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lockdep_enabled kernel/locking/lockdep.c:115 [inline]
RIP: 0010:lock_release+0xd7/0xa30 kernel/locking/lockdep.c:5772
Code: e3 8a 00 48 0f a3 1d 80 82 a8 0e 73 16 e8 f1 ce 09 00 84 c0 75 0d 80 3d 30 4e 92 0e 00 0f 84 fc 05 00 00 48 c7 c0 cc a8 18 90 <48> c1 e8 03 42 0f b6 04 38 84 c0 0f 85 1f 06 00 00 83 3d ad b4 a8
RSP: 0018:ffffc9000fc0e2e0 EFLAGS: 00000202
RAX: ffffffff9018a8cc RBX: 0000000000000001 RCX: ffffffff816ff3e0
RDX: 0000000000000000 RSI: ffffffff8c608f20 RDI: ffffffff8c608ee0
RBP: ffffc9000fc0e420 R08: ffffffff9018766f R09: 1ffffffff2030ecd
R10: dffffc0000000000 R11: fffffbfff2030ece R12: 1ffff92001f81c68
R13: ffffffff82073f47 R14: 1ffff1100b63d45f R15: dffffc0000000000
 rcu_lock_release include/linux/rcupdate.h:336 [inline]
 rcu_read_unlock include/linux/rcupdate.h:869 [inline]
 page_ext_put+0xa3/0xc0 mm/page_ext.c:550
 page_table_check_pte_clear include/linux/page_table_check.h:49 [inline]
 ptep_get_and_clear arch/x86/include/asm/pgtable.h:1268 [inline]
 ptep_clear_flush+0x162/0x170 mm/pgtable-generic.c:99
 try_to_unmap_one+0xee2/0x32e0 mm/rmap.c:1776
 rmap_walk_anon+0x4cf/0x8a0 mm/rmap.c:2625
 try_to_unmap+0x243/0x2e0
 shrink_folio_list+0x249c/0x8c90 mm/vmscan.c:1297
 reclaim_folio_list mm/vmscan.c:2120 [inline]
 reclaim_pages+0x918/0xc60 mm/vmscan.c:2156
 madvise_cold_or_pageout_pte_range+0x2964/0x32a0 mm/madvise.c:550
 walk_pmd_range mm/pagewalk.c:104 [inline]
 walk_pud_range mm/pagewalk.c:176 [inline]
 walk_p4d_range mm/pagewalk.c:209 [inline]
 walk_pgd_range+0xba3/0x1810 mm/pagewalk.c:244
 __walk_page_range+0x132/0x720 mm/pagewalk.c:346
 walk_page_range+0x58f/0x7c0 mm/pagewalk.c:472
 madvise_pageout_page_range mm/madvise.c:609 [inline]
 madvise_pageout mm/madvise.c:636 [inline]
 madvise_vma_behavior mm/madvise.c:1042 [inline]
 madvise_walk_vmas mm/madvise.c:1271 [inline]
 do_madvise+0x3384/0x4760 mm/madvise.c:1467
 __do_sys_madvise mm/madvise.c:1484 [inline]
 __se_sys_madvise mm/madvise.c:1482 [inline]
 __x64_sys_madvise+0xa6/0xc0 mm/madvise.c:1482
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2d48d7def9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2d49bd7038 EFLAGS: 00000246 ORIG_RAX: 000000000000001c
RAX: ffffffffffffffda RBX: 00007f2d48f36058 RCX: 00007f2d48d7def9
RDX: 0000000000000015 RSI: 0000000000600000 RDI: 0000000020000000
RBP: 00007f2d48df0b76 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000001 R14: 00007f2d48f36058 R15: 00007ffc397291e8
 </TASK>
task:syz.4.3139      state:R  running task     stack:25984 pid:13275 tgid:13274 ppid:5231   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5188 [inline]
 __schedule+0x1800/0x4a60 kernel/sched/core.c:6529
 preempt_schedule_common+0x84/0xd0 kernel/sched/core.c:6708
 preempt_schedule+0xe1/0xf0 kernel/sched/core.c:6732
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 zap_pte_range mm/memory.c:1688 [inline]
 zap_pmd_range mm/memory.c:1736 [inline]
 zap_pud_range mm/memory.c:1765 [inline]
 zap_p4d_range mm/memory.c:1786 [inline]
 unmap_page_range+0x3818/0x42c0 mm/memory.c:1807
 unmap_vmas+0x3cc/0x5f0 mm/memory.c:1897
 exit_mmap+0x264/0xc80 mm/mmap.c:3412
 __mmput+0x115/0x390 kernel/fork.c:1345
 exit_mm+0x220/0x310 kernel/exit.c:571
 do_exit+0x9b2/0x27f0 kernel/exit.c:869
 do_group_exit+0x207/0x2c0 kernel/exit.c:1031
 get_signal+0x16a1/0x1740 kernel/signal.c:2917
 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218
 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4d1317def9
RSP: 002b:00007f4d12bff0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f4d13335f88 RCX: 00007f4d1317def9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4d13335f88
RBP: 00007f4d13335f80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4d13335f8c
R13: 0000000000000000 R14: 00007fff4942ead0 R15: 00007fff4942ebb8
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g57233 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=29570
rcu: rcu_preempt kthread starved for 10502 jiffies! g57233 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:25584 pid:17    tgid:17    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5188 [inline]
 __schedule+0x1800/0x4a60 kernel/sched/core.c:6529
 __schedule_loop kernel/sched/core.c:6606 [inline]
 schedule+0x14b/0x320 kernel/sched/core.c:6621
 schedule_timeout+0x1be/0x310 kernel/time/timer.c:2581
 rcu_gp_fqs_loop+0x2df/0x1330 kernel/rcu/tree.c:2034
 rcu_gp_kthread+0xa7/0x3b0 kernel/rcu/tree.c:2236
 kthread+0x2f2/0x390 kernel/kthread.c:389
 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>