[syzbot] [mm?] INFO: rcu detected stall in schedule_tail (8)

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 12a0094839d0 Merge tag 'timers-urgent-2026-01-24' of git:/..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=105cc05a580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f1fac0919970b671
dashboard link: https://syzkaller.appspot.com/bug?extid=42836f91edd58eb82c6a
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14557d22580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15d0105a580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/4ede6f8f9210/disk-12a00948.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/47f57ac656a5/vmlinux-12a00948.xz
kernel image: https://storage.googleapis.com/syzbot-assets/22586c0d39b7/bzImage-12a00948.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+42836f...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P6967/1:b..l
rcu: (detected by 0, t=10503 jiffies, g=14029, q=726 ncpus=2)
task:syz-executor state:R running task stack:29456 pid:6967 tgid:6967 ppid:6192 task_flags:0x400040 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xfe4/0x5e10 kernel/sched/core.c:6867
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7194
irqentry_exit+0x17b/0x670 kernel/entry/common.c:216
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:ptlock_ptr include/linux/mm.h:3240 [inline]
RIP: 0010:pte_lockptr include/linux/mm.h:3264 [inline]
RIP: 0010:pte_offset_map_rw_nolock+0xbd/0x1c0 mm/pgtable-generic.c:330
Code: 80 3c 10 00 0f 85 bb 00 00 00 48 03 1d 5c 91 92 0b 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 28 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 c0 00 00 00 4c 89 e2 48 8b 5b 28 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffc9000bba7ad8 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffffea0001ee7580 RCX: ffffffff825bf480
RDX: 1ffffd40003dceb5 RSI: ffffffff825bf3de RDI: ffffea0001ee75a8
RBP: ffff88807b9d60c8 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000bba7c38
R13: 000000007b9d6067 R14: 0000000000000067 R15: 0000000000000001
handle_pte_fault mm/memory.c:6261 [inline]
__handle_mm_fault+0xc0e/0x2b50 mm/memory.c:6414
handle_mm_fault+0x36d/0xa20 mm/memory.c:6583
do_user_addr_fault+0x74c/0x12f0 arch/x86/mm/fault.c:1385
handle_page_fault arch/x86/mm/fault.c:1474 [inline]
exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1527
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0010:__put_user_4+0xd/0x20 arch/x86/lib/putuser.S:94
Code: 66 89 01 31 c9 0f 01 ca c3 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 89 cb 48 c1 fb 3f 48 09 d9 0f 01 cb <89> 01 31 c9 0f 01 ca e9 07 ba 03 00 0f 1f 80 00 00 00 00 90 90 90
RSP: 0018:ffffc9000bba7e78 EFLAGS: 00050202
RAX: 000000000000001b RBX: 0000000000000000 RCX: 0000555562a197d0
RDX: dffffc0000000000 RSI: ffffffff8dc45476 RDI: ffff888025b2a944
RBP: ffff888025b2aba0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 1ffffffff1cbde81 R12: 1ffff92001774fd6
R13: ffffc9000bba7f48 R14: 0000000000000000 R15: dffffc0000000000
schedule_tail+0x9e/0xd0 kernel/sched/core.c:5193
ret_from_fork+0x79/0xaf0 arch/x86/kernel/process.c:154
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
rcu: rcu_preempt kthread starved for 10518 jiffies! g14029 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27368 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xfe4/0x5e10 kernel/sched/core.c:6867
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7194
irqentry_exit+0x17b/0x670 kernel/entry/common.c:216
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:debug_object_assert_init+0x7b/0x300 lib/debugobjects.c:1000
Code: f1 f1 f1 c7 40 04 f1 f1 00 00 c7 40 08 00 00 00 f3 c7 40 0c f3 f3 f3 f3 65 48 8b 05 17 95 f4 0e 48 89 84 24 b8 00 00 00 31 c0 <80> 3d 7e bc c7 0b 00 48 89 7c 24 68 48 c7 44 24 60 00 00 00 00 48
RSP: 0018:ffffc90000157910 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffc90000157b58 RCX: 0000000000000000
RDX: ffff88801e290000 RSI: ffffffff8b92b940 RDI: ffffc90000157b58
RBP: ffffc90000157a00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000
R13: 0000000000000004 R14: ffff88801e290000 R15: 1ffff9200002af26
debug_timer_assert_init kernel/time/timer.c:803 [inline]
debug_assert_init kernel/time/timer.c:848 [inline]
__mod_timer+0xad/0xca0 kernel/time/timer.c:1025
add_timer+0x62/0x90 kernel/time/timer.c:1249
schedule_timeout+0x122/0x280 kernel/time/sleep_timeout.c:98
rcu_gp_fqs_loop+0x1a9/0xb00 kernel/rcu/tree.c:2083
rcu_gp_kthread+0x21e/0x320 kernel/rcu/tree.c:2285
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 6972 Comm: syz.8.313 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
RIP: 0010:__get_user_nocheck_4+0x8/0x20 arch/x86/lib/getuser.S:142
Code: c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 01 cb 0f ae e8 8b 10 <31> c0 0f 01 ca c3 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f
RSP: 0018:ffffc9000546fad8 EFLAGS: 00040202
RAX: 00007f4f28dcf040 RBX: ffff888021280000 RCX: 1ffff1100425033a
RDX: 0000000046505845 RSI: 00007f4f28dce5c0 RDI: ffff888021281a04
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00007f4f28dce5c0
R13: ffffc9000546fb90 R14: 0000000000000000 R15: ffff888021281a00
FS: 00007f4f28dcf6c0(0000) GS:ffff8881245dc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555562a197d0 CR3: 0000000028f6b000 CR4: 00000000003526f0
Call Trace:
<TASK>
check_xstate_in_sigframe arch/x86/kernel/fpu/signal.c:46 [inline]
__fpu_restore_sig+0x836/0x12f0 arch/x86/kernel/fpu/signal.c:335
fpu__restore_sig+0x151/0x190 arch/x86/kernel/fpu/signal.c:480
restore_sigcontext+0x4cb/0x6a0 arch/x86/kernel/signal_64.c:95
__do_sys_rt_sigreturn+0x229/0x2c0 arch/x86/kernel/signal_64.c:268
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4f27f9acb7
Code: 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 <0f> 05 48 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89
RSP: 002b:00007f4f28dcf0e8 EFLAGS: 00000246
RAX: 00000000000000ca RBX: 00007f4f28215fa8 RCX: 00007f4f27f9acb9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f4f28215fa8
RBP: 00007f4f28215fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4f28216038 R14: 00007ffd840d3410 R15: 00007ffd840d34f8
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] mm: Fix KASAN-induced recursive page faults in ptlock_ptr
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When pte_offset_map_rw_nolock() is called during signal frame setup
in the ret_from_fork path, KASAN instrumentation of ptlock_ptr() can
trigger recursive page faults. The KASAN shadow memory access itself
may cause a page fault while already handling a page fault.

In RT priority contexts (SCHED_FIFO), this recursive faulting prevents
the task from yielding, causing RCU stalls as the grace period kthread
cannot get CPU time.

Disable KASAN instrumentation for both variants of ptlock_ptr() to
prevent this recursion.

Reported-by: syzbot+42836f...@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=42836f91edd58eb82c6a
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
include/linux/mm.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/mm.h b/include/linux/mm.h
index f0d5be9dc736..e4c33731bdd6 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -3235,7 +3235,7 @@ void __init ptlock_cache_init(void);
bool ptlock_alloc(struct ptdesc *ptdesc);
void ptlock_free(struct ptdesc *ptdesc);

-static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc)
+static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc) __no_sanitize_address
{
return ptdesc->ptl;
}
@@ -3253,7 +3253,7 @@ static inline void ptlock_free(struct ptdesc *ptdesc)
{
}

-static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc)
+static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc) __no_sanitize_address
{
return &ptdesc->ptl;
}
--
2.43.0

[syzbot]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

./include/linux/mm.h:3238:1: error: attributes should be specified before the declarator in a function definition
./include/linux/mm.h:3264:16: error: implicit declaration of function 'ptlock_ptr'; did you mean 'pte_lockptr'? [-Wimplicit-function-declaration]
./include/linux/mm.h:3264:16: error: returning 'int' from a function with return type 'spinlock_t *' {aka 'struct spinlock *'} makes pointer from integer without a cast [-Wint-conversion]
./include/linux/mm.h:3271:16: error: returning 'int' from a function with return type 'spinlock_t *' {aka 'struct spinlock *'} makes pointer from integer without a cast [-Wint-conversion]
./include/linux/mm.h:3286:24: error: passing argument 1 of 'spinlock_check' makes pointer from integer without a cast [-Wint-conversion]
./include/linux/mm.h:3409:16: error: returning 'int' from a function with return type 'spinlock_t *' {aka 'struct spinlock *'} makes pointer from integer without a cast [-Wint-conversion]


Tested on:

commit: fcb70a56 Merge tag 'vfs-6.19-rc8.fixes' of git://git.k..
git tree: upstream

kernel config: https://syzkaller.appspot.com/x/.config?x=f1fac0919970b671
dashboard link: https://syzkaller.appspot.com/bug?extid=42836f91edd58eb82c6a
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=163c705a580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] mm: Fix KASAN-induced recursive page faults in ptlock_ptr
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

When pte_offset_map_rw_nolock() is called during signal frame setup
in the ret_from_fork path, KASAN instrumentation of ptlock_ptr() can
trigger recursive page faults. The KASAN shadow memory access itself
may cause a page fault while already handling a page fault.

In RT priority contexts (SCHED_FIFO), this recursive faulting prevents
the task from yielding, causing RCU stalls as the grace period kthread
cannot get CPU time.

Disable KASAN instrumentation for both variants of ptlock_ptr() to
prevent this recursion.

Reported-by: syzbot+42836f...@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=42836f91edd58eb82c6a
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
include/linux/mm.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/linux/mm.h b/include/linux/mm.h

index f0d5be9dc736..093ea042f973 100644

--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -3235,7 +3235,7 @@ void __init ptlock_cache_init(void);
bool ptlock_alloc(struct ptdesc *ptdesc);
void ptlock_free(struct ptdesc *ptdesc);

-static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc)

+__no_sanitize_address static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc)

{
return ptdesc->ptl;
}
@@ -3253,7 +3253,7 @@ static inline void ptlock_free(struct ptdesc *ptdesc)
{
}

-static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc)

+__no_sanitize_address static inline spinlock_t *ptlock_ptr(struct ptdesc *ptdesc)

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
INFO: rcu detected stall in schedule_timeout

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:

rcu: (detected by 0, t=10502 jiffies, g=14829, q=576 ncpus=2)
rcu: All QSes seen, last rcu_preempt kthread activity 10504 (4294959943-4294949439), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 10505 jiffies! g14829 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0

rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:

task:rcu_preempt state:R running task stack:28408 pid:16 tgid:16 ppid:2 task_flags:0x208040 flags:0x00080000

Call Trace:
<TASK>
context_switch kernel/sched/core.c:5260 [inline]
__schedule+0xfe4/0x5e10 kernel/sched/core.c:6867
preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7194
irqentry_exit+0x17b/0x670 kernel/entry/common.c:216
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

RIP: 0010:__free_object+0x2b5/0x400 lib/debugobjects.c:524
Code: 00 0f 85 f7 00 00 00 48 c7 43 08 e0 7b 0d 9b 4d 85 e4 0f 84 66 ff ff ff e8 38 50 1f fd 9c 58 f6 c4 02 0f 85 12 01 00 00 fb 5b <5d> 41 5c 41 5d c3 cc cc cc cc 48 c7 c7 60 d2 15 8f e8 25 fd 89 06
RSP: 0018:ffffc90000157a20 EFLAGS: 00000246
RAX: 0000000000000002 RBX: ffff88801f332968 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8dc4581b RDI: ffffffff8bfa35a0
RBP: ffff8880b853c680 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000200
R13: ffff8880532ca5e8 R14: ffffc90000157b58 R15: 1ffff9200002af4c
free_object lib/debugobjects.c:532 [inline]
debug_object_free+0x295/0x550 lib/debugobjects.c:976
schedule_timeout+0x137/0x280 kernel/time/sleep_timeout.c:103

rcu_gp_fqs_loop+0x1a9/0xb00 kernel/rcu/tree.c:2083
rcu_gp_kthread+0x21e/0x320 kernel/rcu/tree.c:2285
kthread+0x3b3/0x730 kernel/kthread.c:463
ret_from_fork+0x754/0xaf0 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
</TASK>
rcu: Stack dump where RCU GP kthread last ran:

CPU: 0 UID: 0 PID: 6551 Comm: syz.0.34 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026

RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 8d 69 f6 48 89 df e8 32 db 69 f6 e8 9d 4e 95 f6 fb bf 01 00 00 00 <e8> e2 29 5a f6 65 8b 05 ab da 6a 08 85 c0 74 06 5b e9 91 4a 00 00
RSP: 0018:ffffc900040afe40 EFLAGS: 00000202
RAX: 0000000005276bf1 RBX: ffff88802e958000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8dc4581b RDI: 0000000000000001
RBP: ffff88807cc28968 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88807cc28000
R13: 0000000100000000 R14: 0000000000000007 R15: 0000000000000000
FS: 00007f02334076c0(0000) GS:ffff8881245d9000(0000) knlGS:0000000000000000

CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033

CR2: 0000200000000058 CR3: 00000000533f5000 CR4: 00000000003526f0
Call Trace:
<TASK>
spin_unlock_irq include/linux/spinlock.h:401 [inline]
__set_current_blocked kernel/signal.c:3222 [inline]
set_current_blocked+0xdd/0x120 kernel/signal.c:3206
__do_sys_rt_sigreturn+0x1a2/0x2c0 arch/x86/kernel/signal_64.c:263

do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc9/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f023253c0d9
Code: 11 06 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 c7 c0 0f 00 00 00 0f 05 <0f> 1f 80 00 00 00 00 48 81 ec 48 01 00 00 49 89 d0 64 48 8b 0c 25
RSP: 002b:00007f0233406400 EFLAGS: 00000206 ORIG_RAX: 000000000000000f
RAX: ffffffffffffffda RBX: 00007f0232815fa8 RCX: 00007f023253c0d9
RDX: 00007f0233406400 RSI: 00007f0233406530 RDI: 0000000000000021
RBP: 00007f0232815fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f0232816038 R14: 00007ffc229935c0 R15: 00007ffc229936a8
</TASK>

Tested on:

commit: fcb70a56 Merge tag 'vfs-6.19-rc8.fixes' of git://git.k..
git tree: upstream

console output: https://syzkaller.appspot.com/x/log.txt?x=128aa05a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=f1fac0919970b671
dashboard link: https://syzkaller.appspot.com/bug?extid=42836f91edd58eb82c6a
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44

patch: https://syzkaller.appspot.com/x/patch.diff?x=11be505a580000