[v5.15] INFO: rcu detected stall in el1h_64_irq (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: fa3df276cd36 Linux 5.15.155
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=147e77fb180000
kernel config: https://syzkaller.appspot.com/x/.config?x=fa45dfd65a261480
dashboard link: https://syzkaller.appspot.com/bug?extid=cc0459fb35ec1603bb5c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/0dc19fc63531/disk-fa3df276.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/fae4c89e243a/vmlinux-fa3df276.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a5c832fcb939/Image-fa3df276.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cc0459...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P4960/1:b..l P737/1:b..l
(detected by 1, t=10502 jiffies, g=10677, q=231)
task:kworker/u4:5 state:R running task stack: 0 pid: 737 ppid: 2 flags:0x00000008
Workqueue: bat_events batadv_nc_worker
Call trace:
__switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
context_switch kernel/sched/core.c:5030 [inline]
__schedule+0xf10/0x1e48 kernel/sched/core.c:6376
preempt_schedule_irq+0x90/0x274 kernel/sched/core.c:6780
arm64_preempt_schedule_irq+0x174/0x2c4 arch/arm64/kernel/entry-common.c:260
el1_interrupt+0x40/0x58 arch/arm64/kernel/entry-common.c:463
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470
el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
check_kcov_mode kernel/kcov.c:163 [inline]
write_comp_data kernel/kcov.c:218 [inline]
__sanitizer_cov_trace_const_cmp4+0x5c/0xb0 kernel/kcov.c:284
process_one_work+0x790/0x11b8 kernel/workqueue.c:2310
worker_thread+0x910/0x1034 kernel/workqueue.c:2457
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
task:syz-executor.1 state:R running task stack: 0 pid: 4960 ppid: 3978 flags:0x00000004
Call trace:
__switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
context_switch kernel/sched/core.c:5030 [inline]
__schedule+0xf10/0x1e48 kernel/sched/core.c:6376
preempt_schedule_common+0x140/0x260 kernel/sched/core.c:6552
preempt_schedule+0x64/0x84 kernel/sched/core.c:6577
__local_bh_enable_ip+0x254/0x470 kernel/softirq.c:390
local_bh_enable+0x28/0x1d0 include/linux/bottom_half.h:32
rcu_read_unlock_bh include/linux/rcupdate.h:809 [inline]
ip_finish_output2+0xe78/0x131c net/ipv4/ip_output.c:229
__ip_finish_output+0x1b0/0x458
ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip_output+0x330/0x49c net/ipv4/ip_output.c:430
dst_output include/net/dst.h:443 [inline]
ip_local_out net/ipv4/ip_output.c:126 [inline]
__ip_queue_xmit+0xe70/0x1930 net/ipv4/ip_output.c:532
ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
__tcp_transmit_skb+0x1944/0x31e8 net/ipv4/tcp_output.c:1402
tcp_transmit_skb net/ipv4/tcp_output.c:1420 [inline]
tcp_connect+0x19fc/0x3e34 net/ipv4/tcp_output.c:3889
tcp_v4_connect+0xc48/0x15fc net/ipv4/tcp_ipv4.c:314
__inet_stream_connect+0x204/0xc00 net/ipv4/af_inet.c:669
inet_stream_connect+0x74/0xb0 net/ipv4/af_inet.c:733
__sys_connect_file net/socket.c:1918 [inline]
__sys_connect+0x268/0x290 net/socket.c:1935
__do_sys_connect net/socket.c:1945 [inline]
__se_sys_connect net/socket.c:1942 [inline]
__arm64_sys_connect+0x7c/0x94 net/socket.c:1942
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
rcu: rcu_preempt kthread starved for 10508 jiffies! g10677 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack: 0 pid: 15 ppid: 2 flags:0x00000008
Call trace:
__switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
context_switch kernel/sched/core.c:5030 [inline]
__schedule+0xf10/0x1e48 kernel/sched/core.c:6376
schedule+0x11c/0x1c8 kernel/sched/core.c:6459
schedule_timeout+0x1d8/0x344 kernel/time/timer.c:1914
rcu_gp_fqs_loop+0x26c/0x13d4 kernel/rcu/tree.c:1972
rcu_gp_kthread+0xc4/0x2c4 kernel/rcu/tree.c:2145
kthread+0x37c/0x45c kernel/kthread.c:334
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870
rcu: Stack dump where RCU GP kthread last ran:
Task dump for CPU 0:
task:syz-executor.2 state:R running task stack: 0 pid: 4961 ppid: 4333 flags:0x00000001
Call trace:
__switch_to+0x308/0x5e8 arch/arm64/kernel/process.c:518
0xffff0000d9801b40


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup