bisecting fixing commit since bf8d1cd4386535004c4afe7f03d37f9864c9940e building syzkaller on af6b8ef8f18c45343685f0ee7af9dd3a4b2b5d95 testing commit bf8d1cd4386535004c4afe7f03d37f9864c9940e with gcc (GCC) 8.1.0 kernel signature: 23786929765a85be04e3b3241f918ad4a62dc7209525972278bf022221a564d7 all runs: crashed: WARNING in switch_fpu_return testing current HEAD 322bf2d3446aabdaf5e8887775bd9ced80dbc0f0 testing commit 322bf2d3446aabdaf5e8887775bd9ced80dbc0f0 with gcc (GCC) 8.1.0 kernel signature: 6e3ade6d1ec6d7f43be82fc0e810db632b82e8bc99f6849547e62c93feabbbad run #0: crashed: INFO: rcu detected stall in kvm_vm_release run #1: OK run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK revisions tested: 2, total time: 28m14.991433789s (build: 13m41.828415995s, test: 14m4.85516545s) the crash still happens on HEAD commit msg: Merge branch 'for-5.6' of git://git.kernel.org/pub/scm/linux/kernel/git/dennis/percpu crash: INFO: rcu detected stall in kvm_vm_release rcu: INFO: rcu_preempt self-detected stall on CPU rcu: 0-...!: (10499 ticks this GP) idle=586/1/0x4000000000000002 softirq=93902/93902 fqs=0 (t=10500 jiffies g=54085 q=163) rcu: rcu_preempt kthread starved for 10500 jiffies! g54085 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1 rcu: RCU grace-period kthread stack dump: rcu_preempt I29360 10 2 0x80004000 Call Trace: context_switch kernel/sched/core.c:3386 [inline] __schedule+0x8a9/0x1970 kernel/sched/core.c:4082 schedule+0xc3/0x2b0 kernel/sched/core.c:4156 schedule_timeout+0x38b/0xad0 kernel/time/timer.c:1895 rcu_gp_fqs_loop kernel/rcu/tree.c:1658 [inline] rcu_gp_kthread+0x9f2/0x1890 kernel/rcu/tree.c:1818 kthread+0x331/0x3f0 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 NMI backtrace for cpu 0 CPU: 0 PID: 2115 Comm: syz-executor.1 Not tainted 5.5.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x12d/0x187 lib/dump_stack.c:118 nmi_cpu_backtrace.cold.7+0x4b/0x84 lib/nmi_backtrace.c:101 nmi_trigger_cpumask_backtrace+0x18b/0x1b7 lib/nmi_backtrace.c:62 arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38 trigger_single_cpu_backtrace include/linux/nmi.h:164 [inline] rcu_dump_cpu_stacks+0x16f/0x1bc kernel/rcu/tree_stall.h:254 print_cpu_stall kernel/rcu/tree_stall.h:475 [inline] check_cpu_stall kernel/rcu/tree_stall.h:549 [inline] rcu_pending kernel/rcu/tree.c:3030 [inline] rcu_sched_clock_irq.cold.86+0x514/0xc8b kernel/rcu/tree.c:2276 update_process_times+0x23/0x50 kernel/time/timer.c:1726 tick_sched_handle+0x77/0x140 kernel/time/tick-sched.c:171 tick_sched_timer+0x43/0x100 kernel/time/tick-sched.c:1314 __run_hrtimer kernel/time/hrtimer.c:1517 [inline] __hrtimer_run_queues+0x32f/0xb50 kernel/time/hrtimer.c:1579 hrtimer_interrupt+0x2df/0x760 kernel/time/hrtimer.c:1641 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1110 [inline] smp_apic_timer_interrupt+0x163/0x5f0 arch/x86/kernel/apic/apic.c:1135 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:__read_once_size include/linux/compiler.h:199 [inline] RIP: 0010:csd_lock_wait kernel/smp.c:109 [inline] RIP: 0010:smp_call_function_single+0x12e/0x3b0 kernel/smp.c:311 Code: 45 85 ff 0f 84 0c 01 00 00 8b 7c 24 1c 48 8d 74 24 40 4c 89 f1 4c 89 ea e8 2f fb ff ff 41 89 c4 8b 44 24 58 a8 01 74 0b f3 90 <8b> 54 24 58 83 e2 01 75 f5 bf 01 00 00 00 e8 3f 66 e8 ff 65 8b 15 RSP: 0018:ffffc900068f75c0 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13 RAX: 0000000000000003 RBX: 1ffff92000d1eebc RCX: 0000000000000830 RDX: 0000000000000001 RSI: 00000000000000fb RDI: 0000000000000830 RBP: ffffc900068f7688 R08: ffffed1015d67099 R09: ffffed1015d67099 R10: ffffed1015d67098 R11: ffff8880aeb384c7 R12: 0000000000000000 R13: ffffffff812ea860 R14: ffff8880aea36d00 R15: 0000000000000001 smp_call_function_many_cond+0xfc/0x7b0 kernel/smp.c:439 smp_call_function_many kernel/smp.c:498 [inline] smp_call_function+0x39/0x60 kernel/smp.c:520 on_each_cpu+0x28/0x170 kernel/smp.c:627 flush_tlb_kernel_range+0x19c/0x230 arch/x86/mm/tlb.c:839 kasan_release_vmalloc+0xb2/0xc0 mm/kasan/common.c:990 __purge_vmap_area_lazy+0xa35/0x2280 mm/vmalloc.c:1329 try_purge_vmap_area_lazy mm/vmalloc.c:1348 [inline] free_vmap_area_noflush+0x26d/0x320 mm/vmalloc.c:1384 free_unmap_vmap_area mm/vmalloc.c:1397 [inline] remove_vm_area+0x16b/0x1d0 mm/vmalloc.c:2217 vm_remove_mappings mm/vmalloc.c:2244 [inline] __vunmap+0x1e3/0x860 mm/vmalloc.c:2306 __vfree+0x21/0x90 mm/vmalloc.c:2363 vfree+0x2a/0x50 mm/vmalloc.c:2393 vmx_vm_free+0x3a/0x50 arch/x86/kvm/vmx/vmx.c:6643 kvm_arch_free_vm arch/x86/include/asm/kvm_host.h:1269 [inline] kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:818 [inline] kvm_put_kvm+0x65f/0x9c0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:833 kvm_vm_release+0x3e/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:856 __fput+0x25a/0x770 fs/file_table.c:280 ____fput+0x9/0x10 fs/file_table.c:313 task_work_run+0x108/0x180 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x9f9/0x2ca0 kernel/exit.c:801 do_group_exit+0xf4/0x2e0 kernel/exit.c:899 get_signal+0x36c/0x1d40 kernel/signal.c:2734 do_signal+0x87/0x1710 arch/x86/kernel/signal.c:813 exit_to_usermode_loop+0x114/0x2e0 arch/x86/entry/common.c:160 prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] syscall_return_slowpath arch/x86/entry/common.c:278 [inline] do_syscall_64+0x4ff/0x5f0 arch/x86/entry/common.c:304 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45a919 Code: ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fd2a14f2c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000006 RBX: 0000000000000003 RCX: 000000000045a919 RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000005 RBP: 000000000075bfc8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd2a14f36d4 R13: 00000000004c3ce8 R14: 00000000004d93b0 R15: 00000000ffffffff Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 skipped: idling at native_halt+0x11/0x20 arch/x86/include/asm/irqflags.h:66