rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 GPs behind) idle=f89c/1/0x4000000000000000 softirq=21725/21725 fqs=0
rcu: 	(detected by 0, t=10506 jiffies, g=17829, q=167 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 6449 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:rb_erase_cached include/linux/rbtree.h:151 [inline]
RIP: 0010:timerqueue_del+0x66/0x100 lib/timerqueue.c:57
Code: 3e 4c 89 ff 4c 89 f6 e8 c8 1f 1a f6 4d 39 f7 0f 84 9d 00 00 00 e8 5a 1d 1a f6 4c 8d 63 08 4d 89 e7 49 c1 ef 03 43 80 3c 2f 00 <74> 08 4c 89 e7 e8 80 45 84 f6 4d 39 34 24 74 07 e8 35 1d 1a f6 eb
RSP: 0018:ffffc90000a08d08 EFLAGS: 00000046
RAX: ffffffff8bab9506 RBX: ffff8880b87283d0 RCX: ffff8880291f9e40
RDX: 0000000000010000 RSI: ffff88807b1ff300 RDI: ffffffff9a2c6f60
RBP: 1ffff1100f63fe60 R08: ffffffff9a4dcab3 R09: 1ffffffff349b956
R10: dffffc0000000000 R11: fffffbfff349b957 R12: ffff8880b87283d8
R13: dffffc0000000000 R14: ffff88807b1ff300 R15: 1ffff110170e507b
FS:  0000000000000000(0000) GS:ffff888125555000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f791da1eff8 CR3: 000000000e54c000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 __remove_hrtimer kernel/time/hrtimer.c:1122 [inline]
 __run_hrtimer kernel/time/hrtimer.c:1765 [inline]
 __hrtimer_run_queues+0x37b/0xcc0 kernel/time/hrtimer.c:1849
 hrtimer_interrupt+0x42b/0x1010 kernel/time/hrtimer.c:1911
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1045 [inline]
 __sysvec_apic_timer_interrupt+0x102/0x460 arch/x86/kernel/apic/apic.c:1062
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
 sysvec_apic_timer_interrupt+0xa1/0xc0 arch/x86/kernel/apic/apic.c:1056
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:179 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x47/0x80 kernel/locking/spinlock.c:194
Code: f7 e8 fd d1 ef f5 f7 c3 00 02 00 00 74 05 e8 e0 26 1b f6 9c 58 a9 00 02 00 00 75 27 f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> 44 98 e1 f5 65 8b 05 9d 3f 6a 07 85 c0 74 18 5b 41 5e e9 81 48
RSP: 0018:ffffc900033e73c8 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000246 RCX: 0000000080000001
RDX: 0000000000000006 RSI: ffffffff8defa6e1 RDI: 0000000000000001
RBP: ffffc900033e74f0 R08: ffffffff9011c0b7 R09: 1ffffffff2023816
R10: dffffc0000000000 R11: fffffbfff2023817 R12: ffffc900033e7560
R13: ffffea00018a9080 R14: ffff88801ceadb58 R15: 0000000000000006
 spin_unlock_irqrestore include/linux/spinlock.h:407 [inline]
 unlock_page_lruvec_irqrestore include/linux/memcontrol.h:1495 [inline]
 folios_put_refs+0x71a/0x8d0 mm/swap.c:994
 free_pages_and_swap_cache+0x537/0x5b0 mm/swap_state.c:426
 __tlb_batch_free_encoded_pages mm/mmu_gather.c:138 [inline]
 tlb_batch_pages_flush mm/mmu_gather.c:151 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:398 [inline]
 tlb_flush_mmu+0x6d3/0xa30 mm/mmu_gather.c:405
 tlb_finish_mmu+0xf9/0x230 mm/mmu_gather.c:530
 exit_mmap+0x498/0xa10 mm/mmap.c:1315
 __mmput+0x118/0x430 kernel/fork.c:1174
 exit_mm+0x168/0x220 kernel/exit.c:581
 do_exit+0x62e/0x2320 kernel/exit.c:959
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1112
 get_signal+0x1284/0x1330 kernel/signal.c:3034
 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline]
 exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline]
 do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f791cb9a379
Code: Unable to access opcode bytes at 0x7f791cb9a34f.
RSP: 002b:00007f791da1f0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f791cdf5fa8 RCX: 00007f791cb9a379
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f791cdf5fa8
RBP: 00007f791cdf5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f791cdf6038 R14: 00007ffe45d9cbe0 R15: 00007ffe45d9ccc8
 </TASK>
rcu: rcu_preempt kthread starved for 10506 jiffies! g17829 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:26856 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5295 [inline]
 __schedule+0x1585/0x5340 kernel/sched/core.c:6907
 __schedule_loop kernel/sched/core.c:6989 [inline]
 schedule+0x164/0x360 kernel/sched/core.c:7004
 schedule_timeout+0x158/0x2c0 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x312/0x11d0 kernel/rcu/tree.c:2095
 rcu_gp_kthread+0x9e/0x2b0 kernel/rcu/tree.c:2297
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:342 [inline]
RIP: 0010:smp_call_function_many_cond+0xcea/0x12c0 kernel/smp.c:877
Code: 89 ee 83 e6 01 31 ff e8 04 e5 0b 00 41 83 e5 01 49 bd 00 00 00 00 00 fc ff df 75 07 e8 af e0 0b 00 eb 38 f3 90 42 0f b6 04 2b <84> c0 75 11 41 f7 04 24 01 00 00 00 74 1e e8 93 e0 0b 00 eb e4 44
RSP: 0018:ffffc90000117760 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 1ffff110170e812d RCX: ffff88801ded8000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900001178a0 R08: ffffffff9011c0b7 R09: 1ffffffff2023816
R10: dffffc0000000000 R11: fffffbfff2023817 R12: ffff8880b8740968
R13: dffffc0000000000 R14: ffff8880b863bf80 R15: 0000000000000001
FS:  0000000000000000(0000) GS:ffff888125455000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f791ca744c0 CR3: 000000000e54c000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 on_each_cpu_cond_mask+0x3f/0x80 kernel/smp.c:1043
 on_each_cpu include/linux/smp.h:72 [inline]
 smp_text_poke_sync_each_cpu arch/x86/kernel/alternative.c:2746 [inline]
 smp_text_poke_batch_finish+0x5f5/0x1160 arch/x86/kernel/alternative.c:2956
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x128/0x240 kernel/jump_label.c:210
 static_key_enable+0x1a/0x20 kernel/jump_label.c:223
 toggle_allocation_gate+0xab/0x290 mm/kfence/core.c:900
 process_one_work+0x949/0x1650 kernel/workqueue.c:3279
 process_scheduled_works kernel/workqueue.c:3362 [inline]
 worker_thread+0xb46/0x1140 kernel/workqueue.c:3443
 kthread+0x388/0x470 kernel/kthread.c:467
 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>