[v6.1] INFO: rcu detected stall in worker_thread

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4078fa637fcd Linux 6.1.91
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1739f1dc980000
kernel config: https://syzkaller.appspot.com/x/.config?x=715ba80acfd3def4
dashboard link: https://syzkaller.appspot.com/bug?extid=d3a4308cd2ba5cfd5b8c
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/2443dfe91c62/disk-4078fa63.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/12dbc2af3348/vmlinux-4078fa63.xz
kernel image: https://storage.googleapis.com/syzbot-assets/da3589238e32/bzImage-4078fa63.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d3a430...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P4500/1:b..l
(detected by 0, t=10502 jiffies, g=25581, q=141 ncpus=2)
task:kworker/u4:7 state:R running task stack:23512 pid:4500 ppid:2 flags:0x00004000
Workqueue: bat_events batadv_nc_worker
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0x142d/0x4550 kernel/sched/core.c:6558
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6870
irqentry_exit+0x53/0x80 kernel/entry/common.c:439
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:658
RIP: 0010:cpu_max_bits_warn include/linux/cpumask.h:110 [inline]
RIP: 0010:cpumask_check include/linux/cpumask.h:117 [inline]
RIP: 0010:cpumask_test_cpu include/linux/cpumask.h:444 [inline]
RIP: 0010:cpu_online include/linux/cpumask.h:1030 [inline]
RIP: 0010:trace_lock_acquire include/trace/events/lock.h:24 [inline]
RIP: 0010:lock_acquire+0xc4/0x5a0 kernel/locking/lockdep.c:5633
Code: 43 c6 44 2c 17 f3 0f 1f 44 00 00 65 8b 1d f4 b7 97 7e 48 c7 c0 78 8a 73 8e 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 59 03 00 00 <39> 1d ae 28 09 0d 0f 86 e4 02 00 00 89 db 48 89 d8 48 c1 e8 06 48
RSP: 0018:ffffc9000367fa80 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8d12ac80
RBP: ffffc9000367fbe0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff920006cff58
R13: dffffc0000000000 R14: 0000000000000000 R15: dffffc0000000000
rcu_lock_acquire include/linux/rcupdate.h:350 [inline]
rcu_read_lock include/linux/rcupdate.h:791 [inline]
batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:408 [inline]
batadv_nc_worker+0xe8/0x610 net/batman-adv/network-coding.c:719
process_one_work+0x8a9/0x11d0 kernel/workqueue.c:2292
worker_thread+0xa47/0x1200 kernel/workqueue.c:2439
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
rcu: rcu_preempt kthread starved for 10527 jiffies! g25581 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27032 pid:16 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0x142d/0x4550 kernel/sched/core.c:6558
schedule+0xbf/0x180 kernel/sched/core.c:6634
schedule_timeout+0x1b9/0x300 kernel/time/timer.c:1965
rcu_gp_fqs_loop+0x2d2/0x1150 kernel/rcu/tree.c:1706
rcu_gp_kthread+0xa3/0x3b0 kernel/rcu/tree.c:1905
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 119 Comm: kworker/1:1H Not tainted 6.1.91-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024
Workqueue: 0x0 (kblockd)
RIP: 0010:hlock_class kernel/locking/lockdep.c:228 [inline]
RIP: 0010:lookup_chain_cache_add kernel/locking/lockdep.c:3737 [inline]
RIP: 0010:validate_chain+0x11a/0x5950 kernel/locking/lockdep.c:3793
Code: 04 00 00 81 e3 ff 1f 00 00 48 89 d8 48 c1 e8 06 48 8d 3c c5 20 c2 49 90 be 08 00 00 00 e8 1e f3 76 00 48 0f a3 1d d6 a6 de 0e <72> 25 48 c7 c0 60 41 c9 91 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85
RSP: 0018:ffffc90002587520 EFLAGS: 00000057
RAX: 0000000000000001 RBX: 0000000000000033 RCX: ffffffff816b1b42
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff9049c220
RBP: ffffc900025877d0 R08: dffffc0000000000 R09: fffffbfff2093845
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8880153f0b00 R14: eab34365c7f49dfa R15: 1ffff11002a7e160
FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e72b000 CR3: 000000005f607000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<TASK>
__lock_acquire+0x125b/0x1f80 kernel/locking/lockdep.c:5049
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
_raw_spin_lock_nested+0x2d/0x40 kernel/locking/spinlock.c:378
raw_spin_rq_lock_nested+0x26/0x140 kernel/sched/core.c:537
raw_spin_rq_lock kernel/sched/sched.h:1354 [inline]
rq_lock kernel/sched/sched.h:1644 [inline]
__schedule+0x33d/0x4550 kernel/sched/core.c:6475
preempt_schedule_irq+0xf7/0x1c0 kernel/sched/core.c:6870
irqentry_exit+0x53/0x80 kernel/entry/common.c:439
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:preempt_count_sub+0x62/0x160 kernel/sched/core.c:5747
Code: c1 81 e1 ff ff ff 7f 39 d9 7c 23 81 fb fe 00 00 00 77 07 0f b6 c0 85 c0 74 55 65 8b 05 1f 1b a4 7e f7 db 65 01 1d 16 1b a4 7e <5b> 41 5e c3 e8 e5 b1 d6 02 85 c0 74 f3 48 c7 c0 28 bd 73 8e 48 c1
RSP: 0018:ffffc90002587db0 EFLAGS: 00000257
RAX: 0000000000000001 RBX: 00000000ffffffff RCX: 0000000000000001
RDX: dffffc0000000000 RSI: ffffffff8aec01c0 RDI: 0000000000000001
RBP: ffff8880153d0068 R08: dffffc0000000000 R09: ffffed1017327541
R10: 0000000000000000 R11: dffffc0000000001 R12: ffff8880153f0000
R13: dffffc0000000000 R14: dffffc0000000000 R15: dffffc0000000000
schedule+0xc9/0x180 kernel/sched/core.c:6635
worker_thread+0xe9d/0x1200 kernel/workqueue.c:2460
kthread+0x28d/0x320 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
</TASK>
vkms_vblank_simulate: vblank timer overrun
vkms_vblank_simulate: vblank timer overrun


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup