[v6.1] INFO: rcu detected stall in sys_mprotect

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 4078fa637fcd Linux 6.1.91
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1518d4b2980000
kernel config: https://syzkaller.appspot.com/x/.config?x=1d51cd200f88f60
dashboard link: https://syzkaller.appspot.com/bug?extid=5abe6470e48cf6572688
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/b1a0a011a73e/disk-4078fa63.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cfaef39014a6/vmlinux-4078fa63.xz
kernel image: https://storage.googleapis.com/syzbot-assets/36e61b51fbe2/Image-4078fa63.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+5abe64...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5252/1:b..l P1603/1:b..l P5487/1:b..l
(detected by 0, t=10502 jiffies, g=9173, q=209 ncpus=2)
task:udevadm state:R running task stack:0 pid:5487 ppid:4236 flags:0x00000004
Call trace:
__switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0xee4/0x1c98 kernel/sched/core.c:6558
preempt_schedule_irq+0x8c/0x1b8 kernel/sched/core.c:6870
arm64_preempt_schedule_irq arch/arm64/kernel/entry-common.c:265 [inline]
__el1_irq arch/arm64/kernel/entry-common.c:474 [inline]
el1_interrupt+0x4c/0x68 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
write_comp_data kernel/kcov.c:259 [inline]
__sanitizer_cov_trace_const_cmp4+0x8c/0x98 kernel/kcov.c:304
validate_mm_mt+0x134/0x51c mm/mmap.c:295
__split_vma+0x48/0x4b4 mm/mmap.c:2344
split_vma+0xa0/0xf8 mm/mmap.c:2414
mprotect_fixup+0x400/0x624 mm/mprotect.c:623
do_mprotect_pkey mm/mprotect.c:792 [inline]
__do_sys_mprotect mm/mprotect.c:819 [inline]
__se_sys_mprotect mm/mprotect.c:816 [inline]
__arm64_sys_mprotect+0x764/0xc24 mm/mprotect.c:816
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
task:kworker/u4:4 state:R running task stack:0 pid:1603 ppid:2 flags:0x00000008
Workqueue: netns cleanup_net
Call trace:
__switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0xee4/0x1c98 kernel/sched/core.c:6558
preempt_schedule_irq+0x8c/0x1b8 kernel/sched/core.c:6870
arm64_preempt_schedule_irq arch/arm64/kernel/entry-common.c:265 [inline]
__el1_irq arch/arm64/kernel/entry-common.c:474 [inline]
el1_interrupt+0x4c/0x68 arch/arm64/kernel/entry-common.c:486
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:491
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:581
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
lock_acquire+0x2ac/0x7cc kernel/locking/lockdep.c:5665
rcu_lock_acquire+0x40/0x4c include/linux/rcupdate.h:350
rcu_read_lock include/linux/rcupdate.h:791 [inline]
inet_twsk_purge+0x10c/0x848 net/ipv4/inet_timewait_sock.c:295
dccp_v4_exit_batch+0x20/0x2c net/dccp/ipv4.c:1042
ops_exit_list net/core/net_namespace.c:177 [inline]
cleanup_net+0x5dc/0x994 net/core/net_namespace.c:604
process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292
worker_thread+0x8e4/0xfec kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
task:udevd state:R running task stack:0 pid:5252 ppid:3843 flags:0x00000004
Call trace:
__switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0xee4/0x1c98 kernel/sched/core.c:6558
preempt_schedule_common+0xf4/0x1e8 kernel/sched/core.c:6727
preempt_schedule+0x64/0x84 kernel/sched/core.c:6751
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0xa8/0xac kernel/locking/spinlock.c:194
spin_unlock_irqrestore include/linux/spinlock.h:406 [inline]
__wake_up_common_lock kernel/sched/wait.c:140 [inline]
__wake_up_sync_key+0x124/0x1ac kernel/sched/wait.c:208
sock_def_readable+0x150/0x278 net/core/sock.c:3305
unix_dgram_sendmsg+0xf4c/0x16c0 net/unix/af_unix.c:2079
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
sock_write_iter+0x2d8/0x414 net/socket.c:1143
call_write_iter include/linux/fs.h:2265 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x610/0x914 fs/read_write.c:584
ksys_write+0x15c/0x26c fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206
el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
rcu: rcu_preempt kthread starved for 10509 jiffies! g9173 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:0 pid:16 ppid:2 flags:0x00000008
Call trace:
__switch_to+0x320/0x754 arch/arm64/kernel/process.c:553
context_switch kernel/sched/core.c:5245 [inline]
__schedule+0xee4/0x1c98 kernel/sched/core.c:6558
schedule+0xc4/0x170 kernel/sched/core.c:6634
schedule_timeout+0x1d8/0x344 kernel/time/timer.c:1965
rcu_gp_fqs_loop+0x2cc/0x1538 kernel/rcu/tree.c:1706
rcu_gp_kthread+0xc0/0x308 kernel/rcu/tree.c:1905
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 PID: 5509 Comm: syz-executor.0 Not tainted 6.1.91-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : lock_release+0x528/0xa50
lr : lockdep_recursion_finish kernel/locking/lockdep.c:467 [inline]
lr : lock_release+0x4e8/0xa50 kernel/locking/lockdep.c:5684
sp : ffff8000227d79c0
x29: ffff8000227d7a80 x28: ffff0000d0433780 x27: dfff800000000000
x26: 0000000000000000 x25: ffff0000d04341f8 x24: 00000000fff501a6
x23: ffff0000d04341f0 x22: 1fffe0001a08683e x21: ffffffffffffffff
x20: 0000000000000000 x19: ffff0001b4357cc0 x18: 1fffe00019395374
x17: 0000000000000000 x16: ffff80001215f844 x15: 0000000000000002
x14: 1ffff00002b0a0b0 x13: dfff800000000000 x12: 0000000000040000
x11: 000000000003ffff x10: ffff80002344e000 x9 : 0000000000000080
x8 : 0000000000000000 x7 : ffff800008860188 x6 : 0000000000000000
x5 : 0000000000000000 x4 : 0000000000000001 x3 : 0000000000000001
x2 : 0000000000000008 x1 : ffff8000122bd820 x0 : 0000000000000000
Call trace:
arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
lock_release+0x528/0xa50 kernel/locking/lockdep.c:5685
__might_fault+0xf0/0x124 mm/memory.c:5835
__copy_to_user include/linux/uaccess.h:111 [inline]
setup_sigframe arch/arm64/kernel/signal.c:796 [inline]
setup_rt_frame arch/arm64/kernel/signal.c:975 [inline]
handle_signal arch/arm64/kernel/signal.c:1016 [inline]
do_signal arch/arm64/kernel/signal.c:1091 [inline]
do_notify_resume+0x10e8/0x3474 arch/arm64/kernel/signal.c:1129
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup