[v6.6] INFO: rcu detected stall in syscall_enter_from_user_mode (2)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: d1cfde2d5d15 Linux 6.6.143
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=11f40e1c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=441765643cbfb8d
dashboard link: https://syzkaller.appspot.com/bug?extid=e75ee9208fc01cbc1013
compiler: Debian clang version 22.1.6 (++20260514074242+fc4aad7b5db3-1~exp1~20260514074407.73), Debian LLD 22.1.6
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=150900d6580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1530a9fe580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4e37bcd98892/disk-d1cfde2d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/64b2ed856057/vmlinux-d1cfde2d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/0a6949479d66/bzImage-d1cfde2d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+e75ee9...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P23/1:b..l
rcu: (detected by 0, t=10502 jiffies, g=9585, q=175 ncpus=2)
task:kworker/1:0 state:R running task stack:27120 pid:23 ppid:2 flags:0x00004000
Workqueue: events_power_efficient gc_worker
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6700
preempt_schedule_irq+0xbf/0x150 kernel/sched/core.c:7010
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:692
RIP: 0010:seqcount_lockdep_reader_access+0x19a/0x1d0 include/linux/seqlock.h:105
Code: f8 4d 85 e4 75 16 e8 c5 fd cb f8 eb 15 e8 be fd cb f8 e8 a9 f0 c8 01 4d 85 e4 74 ea e8 af fd cb f8 fb 48 c7 04 24 0e 36 e0 45 <4b> c7 04 3e 00 00 00 00 43 c7 44 3e 08 00 00 00 00 65 48 8b 04 25
RSP: 0018:ffffc900001d79a0 EFLAGS: 00000293
RAX: ffffffff88bae7a1 RBX: 0000000000000000 RCX: ffff88801be75a00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001d7a50 R08: ffffffff911bc597 R09: 1ffffffff22378b2
R10: dffffc0000000000 R11: fffffbfff22378b3 R12: 0000000000000200
R13: dffffc0000000000 R14: 1ffff9200003af34 R15: dffffc0000000000
nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:350 [inline]
gc_worker+0x314/0x14a0 net/netfilter/nf_conntrack_core.c:1504
process_one_work kernel/workqueue.c:2653 [inline]
process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
rcu: rcu_preempt kthread starved for 10409 jiffies! g9585 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27848 pid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x15ae/0x4660 kernel/sched/core.c:6700
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6867
preempt_schedule+0xc0/0xd0 kernel/sched/core.c:6891
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock_irqrestore+0x111/0x120 kernel/locking/spinlock.c:194
debug_object_free+0x2c2/0x470 lib/debugobjects.c:866
destroy_timer_on_stack kernel/time/timer.c:812 [inline]
schedule_timeout+0x1a1/0x2d0 kernel/time/timer.c:2172
rcu_gp_fqs_loop+0x30d/0x1590 kernel/rcu/tree.c:1667
rcu_gp_kthread+0x9d/0x3b0 kernel/rcu/tree.c:1866
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 6096 Comm: syz-executor140 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:arch_static_branch arch/x86/include/asm/jump_label.h:27 [inline]
RIP: 0010:static_key_false include/linux/jump_label.h:207 [inline]
RIP: 0010:native_write_msr arch/x86/include/asm/msr.h:147 [inline]
RIP: 0010:wrmsrl arch/x86/include/asm/msr.h:262 [inline]
RIP: 0010:lapic_next_deadline+0x25/0x40 arch/x86/kernel/apic/apic.c:461
Code: 00 00 00 00 00 f3 0f 1e fa 0f ae f0 0f ae e8 0f 31 48 c1 e2 20 48 09 c2 48 8d 04 fa 48 89 c2 48 c1 ea 20 b9 e0 06 00 00 0f 30 <66> 90 31 c0 c3 bf e0 06 00 00 48 89 c6 31 d2 e8 c7 6e 24 03 31 c0
RSP: 0018:ffffc900001f0e88 EFLAGS: 00000003
RAX: 00000086de0eef5e RBX: ffff8880b8f282c0 RCX: 00000000000006e0
RDX: 0000000000000086 RSI: ffff8880b8f282c0 RDI: 0000000000229e2d
RBP: 0000000000000000 R08: ffffffff8e8ae5ef R09: 1ffffffff1d15cbd
R10: dffffc0000000000 R11: fffffbfff1d15cbe R12: dffffc0000000000
R13: 00000000008cccc4 R14: 0000000000229e2d R15: 0000000000000019
FS: 00007f977d54f6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f977d5ec036 CR3: 0000000025125000 CR4: 00000000003506e0
Call Trace:
<IRQ>
clockevents_program_event+0x1c0/0x310 kernel/time/clockevents.c:334
hrtimer_interrupt+0x565/0x980 kernel/time/hrtimer.c:1893
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
__sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__syscall_enter_from_user_work kernel/entry/common.c:97 [inline]
RIP: 0010:syscall_enter_from_user_mode+0x2e/0x80 kernel/entry/common.c:118
Code: 41 56 53 48 89 f3 49 89 fe 48 8b 7c 24 10 e8 e9 fa ff ff 66 90 66 90 e8 70 75 09 f7 e8 2b 75 09 f7 fb 65 48 8b 05 52 d9 7f 75 <48> 8b 70 08 40 f6 c6 3f 74 0b 4c 89 f7 5b 41 5e e9 cd c0 ef f6 48
RSP: 0018:ffffc90004c47f08 EFLAGS: 00000286
RAX: ffff888024c55a00 RBX: 000000000000000f RCX: 63a761d2e2bb9200
RDX: dffffc0000000000 RSI: ffffffff8acacb60 RDI: ffffffff8b1c7be0
RBP: ffffc90004c47f48 R08: ffffffff8e8ae5ef R09: 1ffffffff1d15cbd
R10: dffffc0000000000 R11: fffffbfff1d15cbe R12: 0000000000000000
R13: 0000000000000000 R14: ffffc90004c47f58 R15: 0000000000000000
do_syscall_64+0x28/0xb0 arch/x86/entry/common.c:72
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f977d55dc49
Code: df 01 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25
RSP: 002b:00007f977d54ebc0 EFLAGS: 00000202 ORIG_RAX: 000000000000000f
RAX: ffffffffffffffda RBX: 00007f977d621b68 RCX: 00007f977d55dc49
RDX: 00007f977d54ebc0 RSI: 00007f977d54ecf0 RDI: 0000000000000021
RBP: 00007f977d621b60 R08: 00007f977d54fcdc R09: 0000000000000000
R10: 00007f977d54fcdc R11: 0000000000000202 R12: 00007f977d621b6c
R13: 0000000000000016 R14: 00007ffd4ab206e0 R15: 00007ffd4ab207c8
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup