[v6.1] INFO: rcu detected stall in inet_frag_destroy

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 1989cd3d56e2 Linux 6.1.167
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1044f81f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=f0605c5af04d7603
dashboard link: https://syzkaller.appspot.com/bug?extid=de6c09fe906b3915c85b
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3e0cf5574b81/disk-1989cd3d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0c1152de55b1/vmlinux-1989cd3d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3fe87e3166b1/bzImage-1989cd3d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+de6c09...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 1-.... } 2641 jiffies s: 250301 root: 0x2/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5052 Comm: syz.3.9698 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
RIP: 0010:rcu_rdp_cpu_online kernel/rcu/tree.c:236 [inline]
RIP: 0010:rcu_lockdep_current_cpu_online+0x83/0x120 kernel/rcu/tree.c:776
Code: 3c 30 00 74 08 48 89 df e8 1a 0e 67 00 48 8b 03 48 8d 98 c0 b9 03 00 48 8d b8 e0 b9 03 00 48 89 f8 48 c1 e8 03 42 80 3c 30 00 <74> 05 e8 f6 0d 67 00 4c 8b 7b 20 48 83 c3 18 48 89 d8 48 c1 e8 03
RSP: 0018:ffffc900001dff10 EFLAGS: 00000046
RAX: 1ffff110171e773c RBX: ffff8880b8f3b9c0 RCX: c59dc646c87f7f00
RDX: ffff88801a703b80 RSI: ffffffff8adf0d00 RDI: ffff8880b8f3b9e0
RBP: ffffc900001e0038 R08: dffffc0000000000 R09: 1ffffffff215ee48
R10: dffffc0000000000 R11: fffffbfff215ee49 R12: ffffffff8c9f9420
R13: 1ffff9200003bff4 R14: dffffc0000000000 R15: 0000000000000000
FS: 00007f794de246c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f33bc9456b8 CR3: 000000006438b000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000200000000300 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
rcu_read_lock_held_common kernel/rcu/update.c:112 [inline]
rcu_read_lock_held+0x1a/0x40 kernel/rcu/update.c:309
trace_call_bpf+0x19e/0x6b0 kernel/trace/bpf_trace.c:135
perf_trace_run_bpf_submit+0x79/0x1c0 kernel/events/core.c:10027
perf_trace_lock_acquire+0x33f/0x3e0 include/trace/events/lock.h:24
trace_lock_acquire include/trace/events/lock.h:24 [inline]
lock_acquire+0x452/0x4a0 kernel/locking/lockdep.c:5633
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162
debug_object_activate+0x68/0x4f0 lib/debugobjects.c:698
debug_hrtimer_activate kernel/time/hrtimer.c:448 [inline]
debug_activate kernel/time/hrtimer.c:503 [inline]
enqueue_hrtimer+0x30/0x3f0 kernel/time/hrtimer.c:1105
__run_hrtimer kernel/time/hrtimer.c:1764 [inline]
__hrtimer_run_queues+0x685/0xd50 kernel/time/hrtimer.c:1811
hrtimer_interrupt+0x3c5/0x9c0 kernel/time/hrtimer.c:1873
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline]
__sysvec_apic_timer_interrupt+0x153/0x5a0 arch/x86/kernel/apic/apic.c:1124
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0x4d/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:__stack_depot_save+0x4a/0x460 lib/stackdepot.c:441
Code: 00 00 48 89 44 24 28 48 c7 44 24 20 00 00 00 00 e8 cb 6f 38 fd 41 89 c7 31 c0 45 85 ff 0f 84 51 01 00 00 80 3d 27 d9 bd 12 00 <0f> 85 44 01 00 00 43 8d 3c 3f 42 8d 2c fd 7b 71 f5 75 83 ff 04 72
RSP: 0018:ffffc900001e07a8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000801
RDX: 0000000000000001 RSI: 000000000000001f RDI: ffffc900001e0810
RBP: ffffc900001e0a40 R08: 0000000000000001 R09: 1ffffffff1c3fbdd
R10: dffffc0000000000 R11: fffffbfff1c3fbde R12: 0000000000000800
R13: 0000000000000001 R14: ffffc900001e0810 R15: 000000000000000e
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_set_track+0x60/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x2d/0x50 mm/kasan/generic.c:516
____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1729 [inline]
slab_free_freelist_hook+0x131/0x1a0 mm/slub.c:1755
slab_free mm/slub.c:3687 [inline]
kmem_cache_free+0xf7/0x290 mm/slub.c:3709
kfree_skb include/linux/skbuff.h:1252 [inline]
inet_frag_rbtree_purge net/ipv4/inet_fragment.c:280 [inline]
inet_frag_destroy+0x13d/0x230 net/ipv4/inet_fragment.c:300
call_timer_fn+0x1ac/0x670 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x53e/0x800 kernel/time/timer.c:2023
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:_compound_head include/linux/page-flags.h:-1 [inline]
RIP: 0010:virt_to_folio include/linux/mm.h:915 [inline]
RIP: 0010:virt_to_slab mm/slab.h:175 [inline]
RIP: 0010:___cache_free+0x13f/0x150 mm/slub.c:3694
Code: de ea ff 0f 0b a9 c0 0f 00 00 0f 85 19 ff ff ff 48 f7 00 00 00 01 00 0f 84 0c ff ff ff 48 8b 48 48 f6 c1 01 0f 84 ff fe ff ff <48> ff c9 48 89 c8 e9 f4 fe ff ff 0f 0b 0f 0b 66 90 41 57 41 56 41
RSP: 0018:ffffc90004aafa38 EFLAGS: 00000202
RAX: 0000000001f42b80 RBX: ffff88807d0ae800 RCX: ffffea0001f42b01
RDX: ffffea0000000000 RSI: 000000000000fca9 RDI: 000000000000fcaa
RBP: ffff8880739b7b40 R08: ffff888023fd83c0 R09: 00000000800c0008
R10: dffffc0000000000 R11: ffffed10171e6b02 R12: ffff888017441c80
R13: dffffc0000000000 R14: ffffffff81d38bdb R15: ffff888017441c80
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:306
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x4b/0x480 mm/slab.h:737
slab_alloc_node mm/slub.c:3359 [inline]
__kmem_cache_alloc_node+0x140/0x260 mm/slub.c:3398
kmalloc_trace+0x26/0xe0 mm/slab_common.c:1026
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:699 [inline]
apparmor_sk_alloc_security+0x74/0x100 security/apparmor/lsm.c:812
security_sk_alloc+0x6a/0xa0 security/security.c:2332
sk_prot_alloc+0x101/0x210 net/core/sock.c:2055
sk_alloc+0x36/0x340 net/core/sock.c:2108
tipc_sk_create+0xe4/0x2890 net/tipc/socket.c:488
__sock_create+0x4a2/0x940 net/socket.c:1549
sock_create net/socket.c:1605 [inline]
__sys_socketpair+0x232/0x540 net/socket.c:1736
__do_sys_socketpair net/socket.c:1785 [inline]
__se_sys_socketpair net/socket.c:1782 [inline]
__x64_sys_socketpair+0x97/0xb0 net/socket.c:1782
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f794cf9c819
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f794de24028 EFLAGS: 00000246 ORIG_RAX: 0000000000000035
RAX: ffffffffffffffda RBX: 00007f794d216180 RCX: 00007f794cf9c819
RDX: 0000000000000000 RSI: 0000000000000005 RDI: 000000000000001e
RBP: 00007f794d032c91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000200000001380 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f794d216218 R14: 00007f794d216180 R15: 00007ffe619cd6a8
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup