[v6.1] INFO: rcu detected stall in handle_mm_fault

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4aa6747d9352 Linux 6.1.69
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11217616e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=e3efadc69a1b0490
dashboard link: https://syzkaller.appspot.com/bug?extid=167d7bf8b0a9b0dc8f12
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/31c5d5a5223e/disk-4aa6747d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/85c4938c28c7/vmlinux-4aa6747d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0fcb53eb57be/Image-4aa6747d.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+167d7b...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P21929/1:b..l
(detected by 0, t=10502 jiffies, g=63257, q=22 ncpus=2)
task:dhcpcd state:R running task stack:0 pid:21929 ppid:3897 flags:0x0000000c
Call trace:
__switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0xee4/0x1c98 kernel/sched/core.c:6558
preempt_schedule_irq+0x8c/0x1b8 kernel/sched/core.c:6870
arm64_preempt_schedule_irq arch/arm64/kernel/entry-common.c:265 [inline]
__el1_irq arch/arm64/kernel/entry-common.c:474 [inline]
el1_interrupt+0x4c/0x68 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
count_memcg_events include/linux/memcontrol.h:1066 [inline]
count_memcg_event_mm+0x1d0/0x308 include/linux/memcontrol.h:1098
handle_mm_fault+0x1bc/0x3ef0 mm/memory.c:5234
__do_page_fault arch/arm64/mm/fault.c:499 [inline]
do_page_fault+0x330/0x890 arch/arm64/mm/fault.c:583
do_mem_abort+0x74/0x200 arch/arm64/mm/fault.c:803
el1_abort+0x3c/0x5c arch/arm64/kernel/entry-common.c:367
el1h_64_sync_handler+0x60/0xac arch/arm64/kernel/entry-common.c:427
el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:580
task_pid_vnr include/linux/sched.h:1578 [inline]
schedule_tail+0xe0/0x130 kernel/sched/core.c:5184
ret_from_fork+0x4/0x20 arch/arm64/kernel/entry.S:861
rcu: rcu_preempt kthread timer wakeup didn't happen for 9053 jiffies! g63257 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=0 timer-softirq=35006
rcu: rcu_preempt kthread starved for 9055 jiffies! g63257 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:0 pid:16 ppid:2 flags:0x00000008
Call trace:
__switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0xee4/0x1c98 kernel/sched/core.c:6558
schedule+0xc4/0x170 kernel/sched/core.c:6634
schedule_timeout+0x1d8/0x344 kernel/time/timer.c:1935
rcu_gp_fqs_loop+0x2cc/0x150c kernel/rcu/tree.c:1674
rcu_gp_kthread+0xc0/0x2f4 kernel/rcu/tree.c:1873
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 PID: 21932 Comm: syz-executor.3 Not tainted 6.1.69-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : el0_svc_common+0xa8/0x258 arch/arm64/kernel/syscall.c:109
lr : local_daif_restore arch/arm64/include/asm/daifflags.h:75 [inline]
lr : el0_svc_common+0x9c/0x258 arch/arm64/kernel/syscall.c:107
sp : ffff800020097de0
x29: ffff800020097de0 x28: ffff000128da8000 x27: 0000000000000021
x26: 1fffe000251b5000 x25: 1ffff00004012fd6 x24: dfff800000000000
x23: 0000000000000000 x22: 00000000000000ac x21: ffff000128da8000
x20: ffff8000122465e0 x19: ffff800020097eb0 x18: 0000000000000000
x17: 0000000000000000 x16: ffff8000083048e0 x15: 0000000000000000
x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000040000
x11: 000000000003ffff x10: ffff800026e73000 x9 : ffff80000aad892c
x8 : 0000000001d76303 x7 : 0000000000000000 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
x2 : ffff800020097d00 x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
local_daif_restore arch/arm64/include/asm/daifflags.h:117 [inline]
el0_svc_common+0xa8/0x258 arch/arm64/kernel/syscall.c:107
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.