[v5.15] INFO: rcu detected stall in filemap_fault (4)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: c86c4726e7f0 Linux 5.15.211
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=101120b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6f8e2266b61925dc
dashboard link: https://syzkaller.appspot.com/bug?extid=196d7dfb853fc17cf2e2
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c3e980557785/disk-c86c4726.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5fbaf3714ad0/vmlinux-c86c4726.xz
kernel image: https://storage.googleapis.com/syzbot-assets/de60a4f1e940/bzImage-c86c4726.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+196d7d...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 0-...!: (10912 ticks this GP) idle=e7b/1/0x4000000000000000 softirq=49940/49942 fqs=163
(t=10500 jiffies g=77657 q=17)
rcu: rcu_preempt kthread starved for 10172 jiffies! g77657 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:26384 pid: 15 ppid: 2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_timeout+0x184/0x2d0 kernel/time/timer.c:2117
rcu_gp_fqs_loop+0x2be/0x11f0 kernel/rcu/tree.c:1972
rcu_gp_kthread+0x9a/0x370 kernel/rcu/tree.c:2145
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1 skipped: idling at native_safe_halt arch/x86/include/asm/irqflags.h:51 [inline]
NMI backtrace for cpu 1 skipped: idling at arch_safe_halt arch/x86/include/asm/irqflags.h:89 [inline]
NMI backtrace for cpu 1 skipped: idling at default_idle+0xb/0x10 arch/x86/kernel/process.c:729
NMI backtrace for cpu 0
CPU: 0 PID: 11883 Comm: syz.9.1783 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:166 [inline]
rcu_dump_cpu_stacks+0x22d/0x380 kernel/rcu/tree_stall.h:349
print_cpu_stall+0x31f/0x5f0 kernel/rcu/tree_stall.h:633
check_cpu_stall kernel/rcu/tree_stall.h:727 [inline]
rcu_pending kernel/rcu/tree.c:3936 [inline]
rcu_sched_clock_irq+0x6ec/0x1120 kernel/rcu/tree.c:2619
update_process_times+0x193/0x200 kernel/time/timer.c:2021
tick_sched_handle kernel/time/tick-sched.c:254 [inline]
tick_sched_timer+0x37d/0x560 kernel/time/tick-sched.c:1473
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x4b0/0xb60 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x397/0x8b0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1108
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:check_kcov_mode kernel/kcov.c:183 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x32/0x60 kernel/kcov.c:206
Code: 14 7d 89 7e 65 8b 15 15 7d 89 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 34 16 00 00 00 74 2c 8b 91 10 16 00 00 <83> fa 02 75 21 48 8b 91 18 16 00 00 48 8b 32 48 8d 7e 01 8b 89 14
RSP: 0018:ffffc900032272b0 EFLAGS: 00000246
RAX: ffffffff83d65b65 RBX: ffff8881457b3ac0 RCX: ffff88807e15bb80
RDX: 0000000000000002 RSI: 000000000007ffff RDI: ffff88807e15bb80
RBP: 0000000000000000 R08: ffffffff8d8aeaef R09: 1ffffffff1b15d5d
R10: dffffc0000000000 R11: fffffbfff1b15d5e R12: dffffc0000000000
R13: 1ffff1102b709b69 R14: ffff88815b84db40 R15: ffff888051b6d2b8
rcu_lock_release+0x5/0x20 include/linux/rcupdate.h:317
submit_bh_wbc+0x339/0x670 fs/buffer.c:3033
submit_bh fs/buffer.c:3062 [inline]
block_read_full_page+0x8c2/0xd20 fs/buffer.c:2341
do_mpage_readpage+0x1979/0x1f00 fs/mpage.c:332
mpage_readpage+0xf7/0x210 fs/mpage.c:408
filemap_read_page+0x18d/0x4b0 mm/filemap.c:2386
filemap_fault+0xcd3/0x13a0 mm/filemap.c:3174
__do_fault+0x141/0x330 mm/memory.c:3928
do_read_fault mm/memory.c:4264 [inline]
do_fault mm/memory.c:4392 [inline]
handle_pte_fault mm/memory.c:4650 [inline]
__handle_mm_fault mm/memory.c:4785 [inline]
handle_mm_fault+0x2982/0x4440 mm/memory.c:4883
faultin_page mm/gup.c:976 [inline]
__get_user_pages+0x952/0x11e0 mm/gup.c:1197
populate_vma_page_range+0x213/0x290 mm/gup.c:1529
__mm_populate+0x275/0x3b0 mm/gup.c:1638
do_mlock+0x49c/0x550 mm/mlock.c:688
__do_sys_mlock mm/mlock.c:696 [inline]
__se_sys_mlock mm/mlock.c:694 [inline]
__x64_sys_mlock+0x5c/0x70 mm/mlock.c:694
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f4686a17e59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4684c70028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095
RAX: ffffffffffffffda RBX: 00007f4686c9ffa0 RCX: 00007f4686a17e59
RDX: 0000000000000000 RSI: 0000000000800000 RDI: 0000200000000000
RBP: 00007f4686aade6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4686ca0038 R14: 00007f4686c9ffa0 R15: 00007ffd5eb97bc8
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

syzbot has found a reproducer for the following issue on:

HEAD commit: c86c4726e7f0 Linux 5.15.211
git tree: linux-5.15.y

console output: https://syzkaller.appspot.com/x/log.txt?x=16ec1b89580000

kernel config: https://syzkaller.appspot.com/x/.config?x=6f8e2266b61925dc
dashboard link: https://syzkaller.appspot.com/bug?extid=196d7dfb853fc17cf2e2
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

syz repro: https://syzkaller.appspot.com/x/repro.syz?x=11ec1b89580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=141b70b9580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/c3e980557785/disk-c86c4726.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/5fbaf3714ad0/vmlinux-c86c4726.xz
kernel image: https://storage.googleapis.com/syzbot-assets/de60a4f1e940/bzImage-c86c4726.xz

mounted in repro: https://storage.googleapis.com/syzbot-assets/f5a75be8e334/mount_3.gz
fsck result: failed (log: https://syzkaller.appspot.com/x/fsck.log?x=12179346580000)

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+196d7d...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P4434/1:b..l
(detected by 0, t=10502 jiffies, g=8373, q=173)
task:modprobe state:R running task stack:27696 pid: 4434 ppid: 156 flags:0x00004002

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395

preempt_schedule_common+0x82/0xd0 kernel/sched/core.c:6571
preempt_schedule+0xbc/0xd0 kernel/sched/core.c:6596
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
__raw_spin_unlock include/linux/spinlock_api_smp.h:152 [inline]
_raw_spin_unlock+0x36/0x40 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:404 [inline]
filemap_map_pages+0x10a5/0x1450 mm/filemap.c:3353
do_fault_around mm/memory.c:4243 [inline]
do_read_fault mm/memory.c:4258 [inline]

do_fault mm/memory.c:4392 [inline]
handle_pte_fault mm/memory.c:4650 [inline]
__handle_mm_fault mm/memory.c:4785 [inline]

handle_mm_fault+0x25bb/0x4440 mm/memory.c:4883
do_user_addr_fault+0x494/0xc90 arch/x86/mm/fault.c:1355
handle_page_fault arch/x86/mm/fault.c:1443 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1496
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:606
RIP: 0033:0x7f5ad58add90
RSP: 002b:00007fff022e5f18 EFLAGS: 00010202
RAX: 00007f5ad592ae38 RBX: 00007fff022e5fb8 RCX: 00007f5ad5922960
RDX: 00007fff022e5fe0 RSI: 000000000000002f RDI: 00007fff022e7f91
RBP: 00007fff022e7f91 R08: 00007f5ad5a29af8 R09: 0000000000000000
R10: 00007fff022e5be0 R11: 0000000000000246 R12: 00007fff022e5fb8
R13: 00007fff022e5fe0 R14: 00007f5ad591fc40 R15: 0000000000000000
</TASK>
rcu: rcu_preempt kthread starved for 10515 jiffies! g8373 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0

rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:

task:rcu_preempt state:R running task stack:28240 pid: 15 ppid: 2 flags:0x00004000

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5049 [inline]
__schedule+0x11c3/0x4350 kernel/sched/core.c:6395
schedule+0x11b/0x1e0 kernel/sched/core.c:6478
schedule_timeout+0x184/0x2d0 kernel/time/timer.c:2117
rcu_gp_fqs_loop+0x2be/0x11f0 kernel/rcu/tree.c:1972
rcu_gp_kthread+0x9a/0x370 kernel/rcu/tree.c:2145
kthread+0x42e/0x520 kernel/kthread.c:334
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
</TASK>
rcu: Stack dump where RCU GP kthread last ran:

NMI backtrace for cpu 0

CPU: 0 PID: 4438 Comm: syz.0.17 Not tainted syzkaller #0

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
nmi_cpu_backtrace+0x3a2/0x3d0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x163/0x280 lib/nmi_backtrace.c:62
trigger_single_cpu_backtrace include/linux/nmi.h:166 [inline]

rcu_check_gp_kthread_starvation+0x1cd/0x250 kernel/rcu/tree_stall.h:487
print_other_cpu_stall+0x1110/0x1270 kernel/rcu/tree_stall.h:592
check_cpu_stall kernel/rcu/tree_stall.h:745 [inline]
rcu_pending kernel/rcu/tree.c:3936 [inline]
rcu_sched_clock_irq+0x845/0x1120 kernel/rcu/tree.c:2619

update_process_times+0x193/0x200 kernel/time/timer.c:2021
tick_sched_handle kernel/time/tick-sched.c:254 [inline]
tick_sched_timer+0x37d/0x560 kernel/time/tick-sched.c:1473
__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
__hrtimer_run_queues+0x4b0/0xb60 kernel/time/hrtimer.c:1749
hrtimer_interrupt+0x397/0x8b0 kernel/time/hrtimer.c:1811
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0x137/0x4a0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1108
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676

RIP: 0010:lock_acquire+0x208/0x400 kernel/locking/lockdep.c:5627
Code: f7 84 24 80 00 00 00 00 02 00 00 43 c6 44 3d 04 f8 0f 85 f1 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 43 c7 44 3d 08 00 00 00 00 65 48 8b 04
RSP: 0018:ffffc9000383f700 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: a4bb5c3382046700
RDX: 0000000000000000 RSI: ffffffff8a2b3e80 RDI: ffffffff8a7a2a40
RBP: ffffc9000383f810 R08: dffffc0000000000 R09: 1ffffffff203d23d
R10: dffffc0000000000 R11: fffffbfff203d23e R12: ffff88805d1c96e0
R13: 1ffff92000707eec R14: 0000000000000246 R15: dffffc0000000000
down_read+0x44/0x2e0 kernel/locking/rwsem.c:1498
filemap_invalidate_lock_shared include/linux/fs.h:842 [inline]
filemap_fault+0x69f/0x13a0 mm/filemap.c:3081

__do_fault+0x141/0x330 mm/memory.c:3928
do_read_fault mm/memory.c:4264 [inline]
do_fault mm/memory.c:4392 [inline]
handle_pte_fault mm/memory.c:4650 [inline]
__handle_mm_fault mm/memory.c:4785 [inline]
handle_mm_fault+0x2982/0x4440 mm/memory.c:4883
faultin_page mm/gup.c:976 [inline]
__get_user_pages+0x952/0x11e0 mm/gup.c:1197
populate_vma_page_range+0x213/0x290 mm/gup.c:1529
__mm_populate+0x275/0x3b0 mm/gup.c:1638
do_mlock+0x49c/0x550 mm/mlock.c:688
__do_sys_mlock mm/mlock.c:696 [inline]
__se_sys_mlock mm/mlock.c:694 [inline]
__x64_sys_mlock+0x5c/0x70 mm/mlock.c:694
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0

RIP: 0033:0x7fdb0a651e59

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fdb09cb2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000095
RAX: ffffffffffffffda RBX: 00007fdb0a8d9fa0 RCX: 00007fdb0a651e59

RDX: 0000000000000000 RSI: 0000000000800000 RDI: 0000200000000000

RBP: 00007fdb0a6e7e6f R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fdb0a8da038 R14: 00007fdb0a8d9fa0 R15: 00007fff66e76968
</TASK>


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.