Extracting prog: 5m24.517009703s
Minimizing prog: 59m49.397272264s
Simplifying prog options: 0s
Extracting C: 2m24.095222217s
Simplifying C: 19m8.828153499s


extracting reproducer from 1 programs
testing a last program of every proc
single: executing 1 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf-close
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)
close(r1)

program crashed: INFO: rcu detected stall in corrupted
program crashed: INFO: rcu detected stall in corrupted
single: successfully extracted reproducer
found reproducer with 4 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program crashed: INFO: rcu detected stall in corrupted
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
sendmsg$inet(r0, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, 0x0, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, 0x0, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
simplifying C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
detailed listing:
executing program 0:
socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x48090) (async, rerun: 32)
setsockopt$sock_attach_bpf(r0, 0x1, 0x21, &(0x7f00000001c0), 0x4)

program crashed: INFO: rcu detected stall in corrupted
validation run: crashed=true
reproducing took 1h34m22.037849482s
repro crashed as (corrupted=true):
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	1-...!: (1 GPs behind) idle=bf84/1/0x4000000000000000 softirq=16887/16887 fqs=41
rcu: 	(t=10502 jiffies g=16013 q=71 ncpus=2)
rcu: rcu_preempt kthread timer wakeup didn't happen for 10420 jiffies! g16013 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=3500
rcu: rcu_preempt kthread starved for 10423 jiffies! g16013 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:27536 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 __schedule_loop kernel/sched/core.c:7268 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7283
 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x312/0x11d0 kernel/rcu/tree.c:2095
 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2297
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6108 Comm: syz.0.102 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:trylock_clear_pending kernel/locking/qspinlock_paravirt.h:122 [inline]
RIP: 0010:pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:431 [inline]
RIP: 0010:__pv_queued_spin_lock_slowpath+0x622/0xbc0 kernel/locking/qspinlock.c:325
Code: 00 41 c6 07 00 43 0f b6 04 26 84 c0 0f 85 7c 01 00 00 c6 01 01 41 bc 00 80 ff ff 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 28 <c6> 44 01 06 02 66 c7 84 24 90 00 00 00 00 01 48 8b 4c 24 48 0f b6
RSP: 0018:ffffc90002f77980 EFLAGS: 00000282
RAX: dffffc0000000000 RBX: ffffc90002f77a20 RCX: 1ffff920005eef3c
RDX: 0000000000000000 RSI: ffffffff8dfa6c27 RDI: ffff8880b863be00
RBP: ffffc90002f77a90 R08: ffffffff9030bcf7 R09: 1ffffffff206179e
R10: dffffc0000000000 R11: fffffbfff206179f R12: 00000000ffff810d
R13: 0000000000000000 R14: 1ffff11005905dd2 R15: ffff8880b863be14
FS:  000055556c233500(0000) GS:ffff88812528a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faee1dea540 CR3: 0000000075cdc000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:35 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:66 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x26c/0x2f0 kernel/locking/spinlock_debug.c:116
 spin_lock_bh include/linux/spinlock.h:348 [inline]
 lock_sock_nested+0x6a/0x100 net/core/sock.c:3802
 lock_sock include/net/sock.h:1713 [inline]
 tipc_release+0xc4/0x2580 net/tipc/socket.c:637
 __sock_release net/socket.c:722 [inline]
 sock_close+0xc3/0x240 net/socket.c:1514
 __fput+0x44f/0xa60 fs/file_table.c:510
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]
 exit_to_user_mode_loop+0xf3/0x4d0 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faee1d9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc27012308 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: 0000000000000000 RBX: 00007faee2017da0 RCX: 00007faee1d9ce59
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 00007faee2017da0 R08: 0000000000000006 R09: 0000000000000000
R10: 00007faee2017cb0 R11: 0000000000000246 R12: 000000000001acfc
R13: 00007faee201609c R14: 000000000001a9ef R15: 00007ffc27012410
 </TASK>
CPU: 1 UID: 0 PID: 6110 Comm: syz.0.102 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:lock_acquire+0x221/0x350 kernel/locking/lockdep.c:5872
Code: ff ff ff e8 f1 1d 07 0a f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 db a8 97 11 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d e9 40 11 0a 0a cc 48 8d 3d 88 63 92
RSP: 0018:ffffc900024ae2e0 EFLAGS: 00000282
RAX: c618325f8b8a3a00 RBX: 0000000000000000 RCX: 0000000000000201
RDX: 00000000bf2d56af RSI: ffffffff8e21a1b7 RDI: ffffffff8c28af60
RBP: ffffffff8b47c145 R08: ffffffff8b47c145 R09: ffffffff8e95cda0
R10: dffffc0000000000 R11: fffffbfff206179f R12: 0000000000000002
R13: ffffffff8e95cda0 R14: 0000000000000000 R15: 0000000000000246
FS:  00007faee2c8e6c0(0000) GS:ffff88812538a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007faee2c8dff8 CR3: 0000000075cdc000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:838 [inline]
 tipc_sk_lookup+0xd2/0x920 net/tipc/socket.c:2999
 tipc_sk_rcv+0x3f8/0x2b40 net/tipc/socket.c:2492
 tipc_node_xmit+0x202/0xf10 net/tipc/node.c:1701
 tipc_node_xmit_skb net/tipc/node.c:1766 [inline]
 tipc_node_distr_xmit+0x2d8/0x400 net/tipc/node.c:1781
 tipc_sk_rcv+0x2535/0x2b40 net/tipc/socket.c:2501
 tipc_node_xmit+0x202/0xf10 net/tipc/node.c:1701
 tipc_sk_push_backlog+0x4ef/0x930 net/tipc/socket.c:1312
 tipc_sk_conn_proto_rcv net/tipc/socket.c:1366 [inline]
 tipc_sk_proto_rcv+0x9a7/0x17d0 net/tipc/socket.c:2156
 tipc_sk_filter_rcv+0x312d/0x3370 net/tipc/socket.c:2352
 tipc_sk_enqueue net/tipc/socket.c:2445 [inline]
 tipc_sk_rcv+0x87d/0x2b40 net/tipc/socket.c:2497
 tipc_node_xmit+0x202/0xf10 net/tipc/node.c:1701
 tipc_node_xmit_skb net/tipc/node.c:1766 [inline]
 tipc_node_distr_xmit+0x2d8/0x400 net/tipc/node.c:1781
 tipc_sk_backlog_rcv+0x1bb/0x270 net/tipc/socket.c:2412
 sk_backlog_rcv include/net/sock.h:1190 [inline]
 __release_sock+0x297/0x3a0 net/core/sock.c:3216
 release_sock+0x190/0x260 net/core/sock.c:3815
 sockopt_release_sock net/core/sock.c:1163 [inline]
 sk_setsockopt+0x27d6/0x2d60 net/core/sock.c:1676
 do_sock_setsockopt+0x11b/0x1b0 net/socket.c:2377
 __sys_setsockopt net/socket.c:2406 [inline]
 __do_sys_setsockopt net/socket.c:2412 [inline]
 __se_sys_setsockopt net/socket.c:2409 [inline]
 __x64_sys_setsockopt+0x13d/0x1b0 net/socket.c:2409
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faee1d9ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faee2c8e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007faee2016090 RCX: 00007faee1d9ce59
RDX: 0000000000000021 RSI: 0000000000000001 RDI: 0000000000000003
RBP: 00007faee1e32d6f R08: 0000000000000004 R09: 0000000000000000
R10: 00002000000001c0 R11: 0000000000000246 R12: 0000000000000000
R13: 00007faee2016128 R14: 00007faee2016090 R15: 00007ffc270121a8
 </TASK>

report is corrupted, running repro again
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
report is corrupted, running repro again
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
report is corrupted, running repro again
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$tipc-sendmsg$inet-setsockopt$sock_attach_bpf
program crashed: INFO: rcu detected stall in corrupted
final repro crashed as (corrupted=true):
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 	1-...!: (10499 ticks this GP) idle=684c/1/0x4000000000000000 softirq=13740/13740 fqs=0
rcu: 	(t=10501 jiffies g=12333 q=234 ncpus=2)
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g12333 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=0 timer-softirq=3017
rcu: rcu_preempt kthread starved for 10504 jiffies! g12333 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:27968 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5388 [inline]
 __schedule+0x1821/0x5740 kernel/sched/core.c:7189
 __schedule_loop kernel/sched/core.c:7268 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7283
 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x312/0x11d0 kernel/rcu/tree.c:2095
 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2297
 kthread+0x389/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 6595 Comm: syz-executor262 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:246 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x17/0x90 kernel/kcov.c:314
Code: 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 48 8b 04 24 65 48 8b 15 58 97 73 11 65 8b 0d 79 97 73 11 <81> e1 00 01 ff 00 74 11 81 f9 00 01 00 00 75 5b 83 ba d4 16 00 00
RSP: 0018:ffffc90003e2e4d8 EFLAGS: 00000246
RAX: ffffffff8b47c215 RBX: 0000000000000001 RCX: 0000000000000201
RDX: ffff88807e373d80 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90003e2e5d0 R08: ffffffff8b47c145 R09: ffffffff8e95cda0
R10: dffffc0000000000 R11: fffffbfff206179f R12: ffff8880322e5138
R13: dffffc0000000000 R14: ffffffff8b47c145 R15: ffff8880322e4000
FS:  00007f7cf0c176c0(0000) GS:ffff88812528a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7cf0c16ff8 CR3: 000000007dd30000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 __rhashtable_lookup include/linux/rhashtable.h:626 [inline]
 rhashtable_lookup include/linux/rhashtable.h:671 [inline]
 tipc_sk_lookup+0x185/0x920 net/tipc/socket.c:3000
 tipc_sk_rcv+0x3f8/0x2b40 net/tipc/socket.c:2492
 tipc_node_xmit+0x202/0xf10 net/tipc/node.c:1701
 tipc_node_xmit_skb net/tipc/node.c:1766 [inline]
 tipc_node_distr_xmit+0x2d8/0x400 net/tipc/node.c:1781
 tipc_sk_rcv+0x2535/0x2b40 net/tipc/socket.c:2501
 tipc_node_xmit+0x202/0xf10 net/tipc/node.c:1701
 tipc_sk_push_backlog net/tipc/socket.c:1312 [inline]
 tipc_sk_filter_connect net/tipc/socket.c:2255 [inline]
 tipc_sk_filter_rcv+0x1d3b/0x3370 net/tipc/socket.c:2364
 tipc_sk_enqueue net/tipc/socket.c:2445 [inline]
 tipc_sk_rcv+0x87d/0x2b40 net/tipc/socket.c:2497
 tipc_node_xmit+0x202/0xf10 net/tipc/node.c:1701
 tipc_node_xmit_skb net/tipc/node.c:1766 [inline]
 tipc_node_distr_xmit+0x2d8/0x400 net/tipc/node.c:1781
 tipc_sk_backlog_rcv+0x1bb/0x270 net/tipc/socket.c:2412
 sk_backlog_rcv include/net/sock.h:1190 [inline]
 __release_sock+0x297/0x3a0 net/core/sock.c:3216
 release_sock+0x190/0x260 net/core/sock.c:3815
 sockopt_release_sock net/core/sock.c:1163 [inline]
 sk_setsockopt+0x27d6/0x2d60 net/core/sock.c:1676
 do_sock_setsockopt+0x11b/0x1b0 net/socket.c:2377
 __sys_setsockopt net/socket.c:2406 [inline]
 __do_sys_setsockopt net/socket.c:2412 [inline]
 __se_sys_setsockopt net/socket.c:2409 [inline]
 __x64_sys_setsockopt+0x13d/0x1b0 net/socket.c:2409
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7cf0c60029
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7cf0c171d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007f7cf0c17cdc RCX: 00007f7cf0c60029
RDX: 0000000000000021 RSI: 0000000000000001 RDI: 0000000000000003
RBP: 00007f7cf0d10b58 R08: 0000000000000004 R09: 36203a6b63617473
R10: 00002000000001c0 R11: 0000000000000246 R12: 0000200000000080
R13: 00007f7cf0d10b50 R14: 00007f7cf0d10b5c R15: 0000200000000004
 </TASK>
INFO: NMI handler (nmi_cpu_backtrace_handler) took too long to run: 1.877 msecs
CPU: 1 UID: 0 PID: 6594 Comm: syz-executor262 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:63
Code: 9b 7d 02 e9 93 f7 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 91 20 00 fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffc90003ddf768 EFLAGS: 000002d3
RAX: ffffffff817623ca RBX: 0000000000000003 RCX: ffff88807e375c40
RDX: 0000000000000000 RSI: ffffffff8dfa6c27 RDI: ffffffff8c28af60
RBP: 0000000000000003 R08: ffffffff9030bcf7 R09: 1ffffffff206179e
R10: dffffc0000000000 R11: fffffbfff206179f R12: 0000000000000200
R13: 0000000000000000 R14: ffff88807e30e010 R15: dffffc0000000000
FS:  00007f7cf0c386c0(0000) GS:ffff88812538a000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f7cf0c17d58 CR3: 000000007dd30000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 kvm_wait+0x10f/0x150 arch/x86/kernel/kvm.c:1095
 pv_wait arch/x86/include/asm/paravirt-spinlock.h:83 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:466 [inline]
 __pv_queued_spin_lock_slowpath+0x74c/0xbc0 kernel/locking/qspinlock.c:325
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:35 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:66 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x26c/0x2f0 kernel/locking/spinlock_debug.c:116
 spin_lock_bh include/linux/spinlock.h:348 [inline]
 lock_sock_nested+0x6a/0x100 net/core/sock.c:3802
 lock_sock include/net/sock.h:1713 [inline]
 tipc_sendstream+0x47/0x70 net/tipc/socket.c:1545
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x972/0x9f0 net/socket.c:2698
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2752
 __sys_sendmsg net/socket.c:2784 [inline]
 __do_sys_sendmsg net/socket.c:2789 [inline]
 __se_sys_sendmsg net/socket.c:2787 [inline]
 __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2787
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7cf0c60029
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7cf0c381d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f7cf0c60029
RDX: 0000000000048090 RSI: 0000200000000080 RDI: 0000000000000004
RBP: 00007f7cf0d10b48 R08: 36203a6b63617473 R09: 36203a6b63617473
R10: 36203a6b63617473 R11: 0000000000000246 R12: 0000200000000080
R13: 00007f7cf0d10b40 R14: 00007f7cf0d10b4c R15: 0000200000000004
 </TASK>