[v6.6] WARNING in zap_other_threads

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: e617101e5626 Linux 6.6.110
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=166b4dcd980000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=3a0361dab1c9bdba8524
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5e096b5ec298/disk-e617101e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/074307bb1464/vmlinux-e617101e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/68e0d6ffb47c/bzImage-e617101e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3a0361...@syzkaller.appspotmail.com

process '/newroot/59/file0' started with executable stack
------------[ cut here ]------------
WARNING: CPU: 0 PID: 23210 at kernel/signal.c:772 signal_wake_up_state kernel/signal.c:772 [inline]
WARNING: CPU: 0 PID: 23210 at kernel/signal.c:772 signal_wake_up include/linux/sched/signal.h:457 [inline]
WARNING: CPU: 0 PID: 23210 at kernel/signal.c:772 zap_other_threads+0x38e/0x440 kernel/signal.c:1396
Modules linked in:
CPU: 0 PID: 23210 Comm: file0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:signal_wake_up_state kernel/signal.c:772 [inline]
RIP: 0010:signal_wake_up include/linux/sched/signal.h:457 [inline]
RIP: 0010:zap_other_threads+0x38e/0x440 kernel/signal.c:1396
Code: 89 00 48 81 e5 ff ff c0 ff 49 89 6d 00 f0 83 44 24 fc 00 4c 89 ef be 15 00 00 00 e8 ac c3 10 00 e9 85 fd ff ff e8 c2 01 32 00 <0f> 0b e9 26 ff ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 8f fd ff
RSP: 0000:ffffc90003417c20 EFLAGS: 00010083
RAX: ffffffff8153890e RBX: 1ffff110052fa46c RCX: 0000000000080000
RDX: ffffc9001cc03000 RSI: 000000000001100a RDI: 000000000001100b
RBP: 0000000000000109 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000682f6c R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: ffff8880297d1e00
FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000000000025d CR3: 000000005bf2d000 CR4: 00000000003506f0
DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083
DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
do_group_exit+0x197/0x2d0 kernel/exit.c:1019
get_signal+0x12fc/0x1400 kernel/signal.c:2902
arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0023:0x25d
Code: Unable to access opcode bytes at 0x233.
RSP: 002b:00000000ff91ac80 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: e617101e5626 Linux 6.6.110
git tree: linux-6.6.y

console output: https://syzkaller.appspot.com/x/log.txt?x=16dcd9e2580000

kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=3a0361dab1c9bdba8524
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=121e6542580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1041c9e2580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/5e096b5ec298/disk-e617101e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/074307bb1464/vmlinux-e617101e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/68e0d6ffb47c/bzImage-e617101e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+3a0361...@syzkaller.appspotmail.com

process 'syz.0.17' launched './file0' with NULL argv: empty string added
process '/newroot/0/file0' started with executable stack
------------[ cut here ]------------
WARNING: CPU: 0 PID: 5954 at kernel/signal.c:772 signal_wake_up_state kernel/signal.c:772 [inline]
WARNING: CPU: 0 PID: 5954 at kernel/signal.c:772 signal_wake_up include/linux/sched/signal.h:457 [inline]
WARNING: CPU: 0 PID: 5954 at kernel/signal.c:772 zap_other_threads+0x38e/0x440 kernel/signal.c:1396
Modules linked in:
CPU: 0 PID: 5954 Comm: file0 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
RIP: 0010:signal_wake_up_state kernel/signal.c:772 [inline]
RIP: 0010:signal_wake_up include/linux/sched/signal.h:457 [inline]
RIP: 0010:zap_other_threads+0x38e/0x440 kernel/signal.c:1396
Code: 89 00 48 81 e5 ff ff c0 ff 49 89 6d 00 f0 83 44 24 fc 00 4c 89 ef be 15 00 00 00 e8 ac c3 10 00 e9 85 fd ff ff e8 c2 01 32 00 <0f> 0b e9 26 ff ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 8f fd ff

RSP: 0000:ffffc90003147c20 EFLAGS: 00010093
RAX: ffffffff8153890e RBX: 1ffff110058c146c RCX: ffff88807a443c00

RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000

RBP: 0000000000000109 R08: 0000000000000003 R09: 0000000000000004

R10: dffffc0000000000 R11: fffff52000628f6c R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: ffff88802c609e00

FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033

CR2: 000000000000025d CR3: 0000000075b0d000 CR4: 00000000003506f0

Call Trace:
<TASK>
do_group_exit+0x197/0x2d0 kernel/exit.c:1019
get_signal+0x12fc/0x1400 kernel/signal.c:2902
arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
irqentry_exit_to_user_mode+0x9/0x40 kernel/entry/common.c:315
exc_page_fault+0x8f/0x110 arch/x86/mm/fault.c:1524
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0023:0x25d
Code: Unable to access opcode bytes at 0x233.

RSP: 002b:00000000fff6e7c0 EFLAGS: 00010202

RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>


---

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.