Extracting prog: 4m20.785088351s Minimizing prog: 20m41.747525422s Simplifying prog options: 10m58.56037465s Extracting C: 2m6.768525661s Simplifying C: 0s extracting reproducer from 1 programs testing a last program of every proc single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000000008000300640000000c000700e80300ffffffffff", 0x68, 0x0, 0x0, 0x0) program crashed: INFO: rcu detected stall in netdev_run_todo single: successfully extracted reproducer found reproducer with 2 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink detailed listing: executing program 0: socket$netlink(0x10, 0x3, 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendto detailed listing: executing program 0: sendto(0xffffffffffffffff, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000000008000300640000000c000700e80300ffffffffff", 0x68, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, 0x0, 0x0, 0x0, 0x0, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto program did not crash simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000000008000300640000000c000700e80300ffffffffff", 0x68, 0x0, 0x0, 0x0) VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying program crashed: INFO: rcu detected stall in x64_sys_call a never seen crash title: INFO: rcu detected stall in x64_sys_call, ignore testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000000008000300640000000c000700e80300ffffffffff", 0x68, 0x0, 0x0, 0x0) program crashed: INFO: rcu detected stall in exit_to_user_mode_loop a never seen crash title: INFO: rcu detected stall in exit_to_user_mode_loop, ignore testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000000008000300640000000c000700e80300ffffffffff", 0x68, 0x0, 0x0, 0x0) program crashed: INFO: rcu detected stall in corrupted validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000000008000300640000000c000700e80300ffffffffff", 0x68, 0x0, 0x0, 0x0) program crashed: INFO: rcu detected stall in corrupted validation run: crashed=true testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000000008000300640000000c000700e80300ffffffffff", 0x68, 0x0, 0x0, 0x0) program crashed: INFO: rcu detected stall in corrupted validation run: crashed=true reproducing took 46m23.10391243s repro crashed as (corrupted=true): rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-....: (1 GPs behind) idle=1d4c/1/0x4000000000000000 softirq=17994/17994 fqs=5055 rcu: hardirqs softirqs csw/system rcu: number: 5278 0 0 rcu: cputime: 173 52316 25 ==> 52490(ms) rcu: (t=10500 jiffies g=17917 q=6412 ncpus=2) CPU: 0 UID: 0 PID: 6004 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:198 Code: f7 e8 1d 0b ce f5 f7 c3 00 02 00 00 74 05 e8 90 ef f9 f5 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 24 21 bf f5 65 8b 05 1d 31 98 07 85 c0 74 18 5b 41 5e e9 81 48 RSP: 0018:ffffc90000007e30 EFLAGS: 00000206 RAX: 0000000000000002 RBX: 0000000000000246 RCX: 0000000000000102 RDX: 0000000000000002 RSI: ffffffff8e22f089 RDI: 0000000000000001 RBP: ffff888070458d38 R08: ffffffff9057a237 R09: 1ffffffff20af446 R10: dffffc0000000000 R11: fffffbfff20af447 R12: ffff8880b86281c0 R13: ffffffff89cfeef0 R14: ffff8880b86281c0 R15: 1ffff110170c50c2 FS: 00007ffae55ed6c0(0000) GS:ffff888124f47000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f18b3412048 CR3: 0000000035830000 CR4: 00000000003526f0 Call Trace: __run_hrtimer kernel/time/hrtimer.c:2028 [inline] __hrtimer_run_queues+0x2bf/0xa10 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113 handle_softirqs+0x225/0x840 kernel/softirq.c:622 do_softirq+0x76/0xd0 kernel/softirq.c:523 __local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450 spin_unlock_bh include/linux/spinlock.h:396 [inline] tcf_gate_init+0x1266/0x15a0 net/sched/act_gate.c:528 tcf_action_init_1+0x4ba/0x740 net/sched/act_api.c:1433 tcf_action_init+0x30e/0xb10 net/sched/act_api.c:1508 tcf_action_add net/sched/act_api.c:2106 [inline] tc_ctl_action+0x43b/0xc70 net/sched/act_api.c:2163 rtnetlink_rcv_msg+0x7b9/0xc00 net/core/rtnetlink.c:7085 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775 __sock_sendmsg net/socket.c:790 [inline] __sys_sendto+0x408/0x5a0 net/socket.c:2252 __do_sys_sendto net/socket.c:2259 [inline] __se_sys_sendto net/socket.c:2255 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2255 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ffae479e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffae55ed028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007ffae4a25fa0 RCX: 00007ffae479e0d9 RDX: 0000000000000068 RSI: 0000200000000000 RDI: 0000000000000003 RBP: 00007ffae4835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffae4a26038 R14: 00007ffae4a25fa0 R15: 00007fff1e8c8a68 sched: DL replenish lagged too much report is corrupted, running repro again testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-sendto detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) sendto(r0, &(0x7f0000000000)="68000000300005050100000000000000000000005400018050000180090001006761746500000000400002801800020000000000000000000000000000000000000000001800058014000180080001000000000008000300640000000c000700e80300ffffffffff", 0x68, 0x0, 0x0, 0x0) program crashed: INFO: rcu detected stall in netlink_sendmsg final repro crashed as (corrupted=false): rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 1-....: (1 GPs behind) idle=b944/1/0x4000000000000000 softirq=17960/17963 fqs=5250 rcu: hardirqs softirqs csw/system rcu: number: 5262 0 0 rcu: cputime: 139 52360 28 ==> 52520(ms) rcu: (t=10503 jiffies g=17677 q=4222 ncpus=2) CPU: 1 UID: 0 PID: 6017 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:seqcount_lockdep_reader_access+0xec/0x100 include/linux/seqlock.h:76 Code: 00 75 11 e8 96 0f 13 00 4d 85 ff 75 16 e8 8c 0f 13 00 eb 15 e8 85 0f 13 00 e8 a0 a0 1e 0a 4d 85 ff 74 ea e8 76 0f 13 00 fb 5b <41> 5e 41 5f e9 0b a3 21 0a cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 RSP: 0018:ffffc90000a08d80 EFLAGS: 00000246 RAX: ffffffff81b4048a RBX: 0000000000000000 RCX: ffff88801ffebe00 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 00000000f3027e44 R08: ffffffff9057a237 R09: 1ffffffff20af446 R10: dffffc0000000000 R11: fffffbfff20af447 R12: ffff88807b58d098 R13: ffff88801e28b530 R14: ffffffff81b408d5 R15: 0000000000000200 FS: 00007f281e5c56c0(0000) GS:ffff888125047000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f0e0582b008 CR3: 000000007278a000 CR4: 00000000003526f0 Call Trace: ktime_get+0x45/0x220 kernel/time/timekeeping.c:971 gate_get_time net/sched/act_gate.c:23 [inline] gate_timer_func+0x1dc/0x450 net/sched/act_gate.c:101 __run_hrtimer kernel/time/hrtimer.c:2032 [inline] __hrtimer_run_queues+0x3bc/0xa10 kernel/time/hrtimer.c:2096 hrtimer_run_softirq+0x17a/0x240 kernel/time/hrtimer.c:2113 handle_softirqs+0x225/0x840 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0xca/0x220 kernel/softirq.c:735 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1062 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674 RIP: 0010:stack_trace_consume_entry+0xf3/0x280 kernel/stacktrace.c:93 Code: 8b 74 24 08 48 8b 1f 45 8d 79 01 0f b6 44 15 00 84 c0 0f 85 3a 01 00 00 45 89 38 4e 8d 3c cb 4c 89 f8 48 c1 e8 03 80 3c 10 00 <74> 1a 4c 89 ff 48 89 f3 49 89 d4 4c 89 c5 e8 3a a1 82 00 49 89 e8 RSP: 0018:ffffc90003617398 EFLAGS: 00000246 RAX: 1ffff920006c2ea6 RBX: ffffc90003617520 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: ffffffff8228ba10 RDI: ffffc900036174a0 RBP: 1ffff920006c2e96 R08: ffffc900036174b0 R09: 0000000000000002 R10: ffffc90003617438 R11: ffffffff81b20a10 R12: 0000000000000000 R13: 1ffff920006c2e95 R14: ffffc900036174a8 R15: ffffc90003617530 arch_stack_walk+0x10f/0x150 arch/x86/kernel/stacktrace.c:27 stack_trace_save+0xa9/0x100 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4931 skb_clone+0x212/0x3a0 net/core/skbuff.c:2116 __netlink_deliver_tap_skb net/netlink/af_netlink.c:301 [inline] __netlink_deliver_tap+0x413/0x860 net/netlink/af_netlink.c:326 netlink_deliver_tap+0x19c/0x1b0 net/netlink/af_netlink.c:339 __netlink_sendskb net/netlink/af_netlink.c:1261 [inline] netlink_sendskb+0x68/0x140 net/netlink/af_netlink.c:1270 netlink_rcv_skb+0x2a4/0x4a0 net/netlink/af_netlink.c:2562 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775 __sock_sendmsg net/socket.c:790 [inline] __sys_sendto+0x408/0x5a0 net/socket.c:2252 __do_sys_sendto net/socket.c:2259 [inline] __se_sys_sendto net/socket.c:2255 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2255 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f281d79e0d9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f281e5c5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f281da25fa0 RCX: 00007f281d79e0d9 RDX: 0000000000000068 RSI: 0000200000000000 RDI: 0000000000000003 RBP: 00007f281d835024 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f281da26038 R14: 00007f281da25fa0 R15: 00007ffc2ec7f1a8 sched: DL replenish lagged too much