[v6.1] INFO: rcu detected stall in netif_receive_skb_list_internal

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 228da13e907e Linux 6.1.175
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1274b2ae580000
kernel config: https://syzkaller.appspot.com/x/.config?x=4dd3c1715f0a309b
dashboard link: https://syzkaller.appspot.com/bug?extid=88601bc736a31f23e33a
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/894d01ce6736/disk-228da13e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/2a4cec18e217/vmlinux-228da13e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/32550387ebe8/bzImage-228da13e.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+88601b...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2686 jiffies s: 138193 root: 0x1/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 2748 Comm: syz.3.8668 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:should_resched arch/x86/include/asm/preempt.h:103 [inline]
RIP: 0010:kvm_get_running_vcpu virt/kvm/kvm_main.c:5841 [inline]
RIP: 0010:kvm_guest_state+0x3d/0xf0 virt/kvm/kvm_main.c:5858
Code: 4e 00 48 c7 c7 e0 e5 81 8a e8 df 2c 25 09 65 4c 8b 35 7f 21 f8 7e 4c 89 f3 bf 01 00 00 00 e8 1a b0 4e 00 65 8b 2d eb 2f f8 7e <31> ff 89 ee e8 9a 3f 78 00 85 ed 74 7a e8 31 3c 78 00 45 31 ff 31
RSP: 0018:ffffc90000006c70 EFLAGS: 00000013
RAX: 0000000000000103 RBX: 0000000000000000 RCX: 0000000000000100
RDX: 0000000000000100 RSI: ffffffff8a81e5e0 RDI: 00000000ffffffff
RBP: 0000000000000102 R08: ffffc90000006e37 R09: ffffc90000006e00
R10: dffffc0000000000 R11: fffff52000000dc7 R12: dffffc0000000000
R13: ffff8880655d8000 R14: 0000000000000000 R15: dffffc0000000000
FS: 00007f7fb35026c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000004 CR3: 000000002f79f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
perf_guest_state include/linux/perf_event.h:1332 [inline]
perf_misc_flags+0x1d/0xc0 arch/x86/events/core.c:3041
perf_prepare_sample+0x12f/0x2020 kernel/events/core.c:7529
__perf_event_output kernel/events/core.c:7730 [inline]
perf_event_output_forward+0x197/0x2f0 kernel/events/core.c:7750
__perf_event_overflow+0x448/0x610 kernel/events/core.c:9496
perf_swevent_overflow+0x19b/0x230 kernel/events/core.c:9579
perf_swevent_event+0x458/0x570 kernel/events/core.c:-1
perf_tp_event+0x3e7/0xc30 kernel/events/core.c:10064
perf_trace_run_bpf_submit+0xf3/0x1c0 kernel/events/core.c:10032
perf_trace_preemptirq_template+0x268/0x320 include/trace/events/preemptirq.h:14
trace_irq_enable_rcuidle+0xd3/0x140 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x24/0x40 kernel/trace/trace_preemptirq.c:44
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:rcu_read_unlock_special+0x7f/0x510 kernel/rcu/tree_plugin.h:685
Code: eb 03 48 b8 f1 f1 f1 f1 f8 f2 f2 f2 4a 89 04 2b 42 c7 44 2b 08 f8 f3 f3 f3 65 44 8b 35 82 30 95 7e 41 f7 c6 00 00 f0 00 74 40 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 42 c7 44 2b 08
RSP: 0018:ffffc90000007540 EFLAGS: 00000206
RAX: d57d9ea2501e1000 RBX: 1ffff92000000eb0 RCX: d57d9ea2501e1000
RDX: dffffc0000000000 RSI: ffffffff8a8c1aa0 RDI: ffffffff8adf2060
RBP: ffffc90000007640 R08: ffffffff90aff277 R09: 1ffffffff215fe4e
R10: dffffc0000000000 R11: fffffbfff215fe4f R12: 0000000000000246
R13: dffffc0000000000 R14: ffff8880b8e3b900 R15: 0000000000000001
__rcu_read_unlock+0x78/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:823 [inline]
netif_receive_skb_list_internal+0xa11/0xca0 net/core/dev.c:5854
gro_normal_list include/net/gro.h:433 [inline]
gro_normal_one include/net/gro.h:446 [inline]
napi_skb_finish net/core/gro.c:630 [inline]
napi_gro_receive+0x4f3/0xb60 net/core/gro.c:660
receive_buf+0x211b/0x4ed0 drivers/net/virtio_net.c:1327
virtnet_receive drivers/net/virtio_net.c:1592 [inline]
virtnet_poll+0x5d3/0x1180 drivers/net/virtio_net.c:1710
__napi_poll+0xc0/0x460 net/core/dev.c:6628
napi_poll net/core/dev.c:6695 [inline]
net_rx_action+0x5dd/0xb20 net/core/dev.c:6809
handle_softirqs+0x2a1/0x930 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
common_interrupt+0xb5/0xd0 arch/x86/kernel/irq.c:242
</IRQ>
<TASK>
asm_common_interrupt+0x22/0x40 arch/x86/include/asm/idtentry.h:682
RIP: 0010:finish_task_switch+0x26a/0x8f0 kernel/sched/core.c:5124
Code: 0f 84 3b 01 00 00 48 85 db 0f 85 5a 01 00 00 0f 1f 44 00 00 4c 8b 75 d0 4c 89 e7 e8 30 ba df 08 e8 cb 30 2f 00 fb 4c 8b 65 c0 <49> 8d bc 24 f8 15 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 28 84 c0
RSP: 0018:ffffc9000dfcf438 EFLAGS: 00000282
RAX: d57d9ea2501e1000 RBX: 0000000000000000 RCX: d57d9ea2501e1000
RDX: dffffc0000000000 RSI: ffffffff8a8c1aa0 RDI: ffffffff8adf2060
RBP: ffffc9000dfcf490 R08: ffffffff90aff277 R09: 1ffffffff215fe4e
R10: dffffc0000000000 R11: fffffbfff215fe4f R12: ffff88807d638000
R13: dffffc0000000000 R14: ffff888024139e00 R15: ffff8880b8e3b5d0
context_switch kernel/sched/core.c:5248 [inline]
__schedule+0x11d9/0x40e0 kernel/sched/core.c:6562
preempt_schedule_irq+0xbb/0x160 kernel/sched/core.c:6874
irqentry_exit+0x63/0x70 kernel/entry/common.c:439
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:mas_next_nentry lib/maple_tree.c:4783 [inline]
RIP: 0010:mas_next_entry+0xc31/0xed0 lib/maple_tree.c:4839
Code: e9 32 fa ff ff e8 6f 2e 66 f7 eb 14 e8 68 2e 66 f7 e9 19 fa ff ff e8 5e 2e 66 f7 4c 8b 6c 24 18 48 8b 44 24 50 42 80 3c 38 00 <48> 8b 5c 24 58 74 08 48 89 df e8 70 36 b7 f7 48 8b 44 24 48 48 89
RSP: 0018:ffffc9000dfcf7a0 EFLAGS: 00000246
RAX: 1ffff92001bf9f26 RBX: 0000000000000001 RCX: ffff88807d638000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000dfcf920 R08: ffff88807d638000 R09: 0000000000000003
R10: 0000000000000003 R11: 0000000000000000 R12: ffff88802fd8c800
R13: ffffffffffffffff R14: ffff888020bc2d80 R15: dffffc0000000000
vma_find include/linux/mm.h:690 [inline]
vma_next include/linux/mm.h:699 [inline]
acct_collect+0x1eb/0x780 kernel/acct.c:599
do_exit+0x887/0x2480 kernel/exit.c:851
do_group_exit+0x217/0x2d0 kernel/exit.c:1024
get_signal+0x1272/0x1350 kernel/signal.c:2871
arch_do_signal_or_restart+0xc4/0x1350 arch/x86/kernel/signal.c:871
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline]
syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:303
do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7fb259ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7fb3502028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: 000000000000008a RBX: 00007f7fb2816090 RCX: 00007f7fb259ce59
RDX: ffffffffffffffff RSI: 0000000000000000 RDI: 0000200000000480
RBP: 00007f7fb2632d6f R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7fb2816128 R14: 00007f7fb2816090 R15: 00007ffd4c954a58
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup