[v6.6] INFO: rcu detected stall in sys_bpf
3 views
Skip to first unread message
syzbot
Aug 10, 2025, 7:50:29 AM8/10/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3a8ababb8b6a Linux 6.6.101
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1433b1a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a2bd95b6de4839b7
dashboard link: https://syzkaller.appspot.com/bug?extid=bc876f0532355e757c37
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ae2055ece513/disk-3a8ababb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72f91e4de841/vmlinux-3a8ababb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3dae292c190e/bzImage-3a8ababb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc876f...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 1-....: (1 GPs behind) idle=e66c/1/0x4000000000000000 softirq=11060/11061 fqs=5248
rcu: hardirqs softirqs csw/system
rcu: number: 15022069 0 0
rcu: cputime: 6306 46220 0 ==> 52510(ms)
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5943
rcu: (detected by 0, t=10502 jiffies, g=8325, q=869 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5943 Comm: syz.3.27 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4820 [inline]
RIP: 0010:__lock_acquire+0xbb8/0x7c80 kernel/locking/lockdep.c:5087
Code: 38 c1 0f 8c c1 fe ff ff 48 c7 c7 a0 b9 4a 8e e8 5e c2 75 00 49 b8 00 00 00 00 00 fc ff df e9 a6 fe ff ff 8b 84 24 88 00 00 00 <38> 44 24 38 4c 8b 6c 24 20 4c 8b 7c 24 10 76 38 e8 23 d3 b3 02 49
RSP: 0018:ffffc900001f03c0 EFLAGS: 00000046
RAX: 0000000000082002 RBX: 0000000000082002 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90da3520
RBP: ffffc900001f0608 R08: dffffc0000000000 R09: 1ffffffff21b46a4
R10: dffffc0000000000 R11: fffffbfff21b46a5 R12: 0000000000000000
R13: ffff88802d562900 R14: 0000000000000001 R15: ffff88802d561e00
FS: 00007f198646a6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e317ff8 CR3: 0000000075d0f000 CR4: 00000000003506e0
Call Trace:
<IRQ>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
rcu_read_lock include/linux/rcupdate.h:786 [inline]
__perf_event_output kernel/events/core.c:7955 [inline]
perf_event_output_forward+0xb5/0x3a0 kernel/events/core.c:7978
__perf_event_overflow+0x447/0x630 kernel/events/core.c:9703
perf_swevent_overflow kernel/events/core.c:9779 [inline]
perf_swevent_event+0x2f5/0x5c0 kernel/events/core.c:-1
perf_tp_event+0x4f9/0x13a0 kernel/events/core.c:10329
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10253
perf_trace_preemptirq_template+0x281/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:variable_ffs arch/x86/include/asm/bitops.h:319 [inline]
RIP: 0010:handle_softirqs+0x1b0/0x820 kernel/softirq.c:566
Code: 89 64 24 2c 0f b7 db 48 c7 c7 a0 b2 a9 8a e8 d7 99 1b 09 65 66 c7 05 1d 25 b2 7e 00 00 e8 a8 63 3a 00 fb 49 c7 c6 c0 a0 a0 8c <89> 5c 24 34 b8 ff ff ff ff 0f bc 44 24 34 41 89 c5 41 ff c5 0f 84
RSP: 0018:ffffc900001f0e40 EFLAGS: 00000286
RAX: 0ac2837db3539500 RBX: 0000000000000200 RCX: 0ac2837db3539500
RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780
RBP: ffffc900001f0f50 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 000000000000000a
R13: 0000000000000000 R14: ffffffff8ca0a0c0 R15: ffff88802d561e00
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:32 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:107 [inline]
RIP: 0010:rcu_read_unlock_special+0xe4/0x4c0 kernel/rcu/tree_plugin.h:637
Code: 5d 03 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 49 89 ff 48 c7 84 24 80 00 00 00 00 00 00 00 9c 8f 84 24 80 00 00 00 <4c> 8b a4 24 80 00 00 00 fa 41 f7 c4 00 02 00 00 74 0f e8 25 8e 1b
RSP: 0018:ffffc90005227a20 EFLAGS: 00000246
RAX: f2f2f200f1f1f1f1 RBX: 1ffff92000a44f4c RCX: 0000000000080000
RDX: ffffc9000d32c000 RSI: 000000000005d8c8 RDI: ffff88802d561e00
RBP: ffffc90005227b20 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 1ffff11005aac447
R13: dffffc0000000000 R14: 0000000080000000 R15: ffff88802d561e00
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
bpf_test_timer_leave+0x109/0x150 net/bpf/test_run.c:57
bpf_test_timer_continue+0x284/0x380 net/bpf/test_run.c:83
bpf_prog_test_run_flow_dissector+0x42d/0x600 net/bpf/test_run.c:1355
bpf_prog_test_run+0x321/0x390 kernel/bpf/syscall.c:4123
__sys_bpf+0x440/0x800 kernel/bpf/syscall.c:5485
__do_sys_bpf kernel/bpf/syscall.c:5571 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5569 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5569
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f198558ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f198646a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f19857b5fa0 RCX: 00007f198558ebe9
RDX: 0000000000000050 RSI: 0000200000000440 RDI: 000000000000000a
RBP: 00007f1985611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f19857b6038 R14: 00007f19857b5fa0 R15: 00007fff181dfc58
</TASK>
task:syz.3.27 state:R running task stack:23592 pid:5943 ppid:5787 flags:0x0000400a
Call Trace:
<TASK>
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 3a8ababb8b6a Linux 6.6.101
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1433b1a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a2bd95b6de4839b7
dashboard link: https://syzkaller.appspot.com/bug?extid=bc876f0532355e757c37
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ae2055ece513/disk-3a8ababb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72f91e4de841/vmlinux-3a8ababb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3dae292c190e/bzImage-3a8ababb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc876f...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 1-....: (1 GPs behind) idle=e66c/1/0x4000000000000000 softirq=11060/11061 fqs=5248
rcu: hardirqs softirqs csw/system
rcu: number: 15022069 0 0
rcu: cputime: 6306 46220 0 ==> 52510(ms)
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5943
rcu: (detected by 0, t=10502 jiffies, g=8325, q=869 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 5943 Comm: syz.3.27 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4820 [inline]
RIP: 0010:__lock_acquire+0xbb8/0x7c80 kernel/locking/lockdep.c:5087
Code: 38 c1 0f 8c c1 fe ff ff 48 c7 c7 a0 b9 4a 8e e8 5e c2 75 00 49 b8 00 00 00 00 00 fc ff df e9 a6 fe ff ff 8b 84 24 88 00 00 00 <38> 44 24 38 4c 8b 6c 24 20 4c 8b 7c 24 10 76 38 e8 23 d3 b3 02 49
RSP: 0018:ffffc900001f03c0 EFLAGS: 00000046
RAX: 0000000000082002 RBX: 0000000000082002 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90da3520
RBP: ffffc900001f0608 R08: dffffc0000000000 R09: 1ffffffff21b46a4
R10: dffffc0000000000 R11: fffffbfff21b46a5 R12: 0000000000000000
R13: ffff88802d562900 R14: 0000000000000001 R15: ffff88802d561e00
FS: 00007f198646a6c0(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e317ff8 CR3: 0000000075d0f000 CR4: 00000000003506e0
Call Trace:
<IRQ>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
rcu_read_lock include/linux/rcupdate.h:786 [inline]
__perf_event_output kernel/events/core.c:7955 [inline]
perf_event_output_forward+0xb5/0x3a0 kernel/events/core.c:7978
__perf_event_overflow+0x447/0x630 kernel/events/core.c:9703
perf_swevent_overflow kernel/events/core.c:9779 [inline]
perf_swevent_event+0x2f5/0x5c0 kernel/events/core.c:-1
perf_tp_event+0x4f9/0x13a0 kernel/events/core.c:10329
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10253
perf_trace_preemptirq_template+0x281/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:variable_ffs arch/x86/include/asm/bitops.h:319 [inline]
RIP: 0010:handle_softirqs+0x1b0/0x820 kernel/softirq.c:566
Code: 89 64 24 2c 0f b7 db 48 c7 c7 a0 b2 a9 8a e8 d7 99 1b 09 65 66 c7 05 1d 25 b2 7e 00 00 e8 a8 63 3a 00 fb 49 c7 c6 c0 a0 a0 8c <89> 5c 24 34 b8 ff ff ff ff 0f bc 44 24 34 41 89 c5 41 ff c5 0f 84
RSP: 0018:ffffc900001f0e40 EFLAGS: 00000286
RAX: 0ac2837db3539500 RBX: 0000000000000200 RCX: 0ac2837db3539500
RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780
RBP: ffffc900001f0f50 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 000000000000000a
R13: 0000000000000000 R14: ffffffff8ca0a0c0 R15: ffff88802d561e00
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:32 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:arch_local_irq_save arch/x86/include/asm/irqflags.h:107 [inline]
RIP: 0010:rcu_read_unlock_special+0xe4/0x4c0 kernel/rcu/tree_plugin.h:637
Code: 5d 03 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 49 89 ff 48 c7 84 24 80 00 00 00 00 00 00 00 9c 8f 84 24 80 00 00 00 <4c> 8b a4 24 80 00 00 00 fa 41 f7 c4 00 02 00 00 74 0f e8 25 8e 1b
RSP: 0018:ffffc90005227a20 EFLAGS: 00000246
RAX: f2f2f200f1f1f1f1 RBX: 1ffff92000a44f4c RCX: 0000000000080000
RDX: ffffc9000d32c000 RSI: 000000000005d8c8 RDI: ffff88802d561e00
RBP: ffffc90005227b20 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 1ffff11005aac447
R13: dffffc0000000000 R14: 0000000080000000 R15: ffff88802d561e00
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
bpf_test_timer_leave+0x109/0x150 net/bpf/test_run.c:57
bpf_test_timer_continue+0x284/0x380 net/bpf/test_run.c:83
bpf_prog_test_run_flow_dissector+0x42d/0x600 net/bpf/test_run.c:1355
bpf_prog_test_run+0x321/0x390 kernel/bpf/syscall.c:4123
__sys_bpf+0x440/0x800 kernel/bpf/syscall.c:5485
__do_sys_bpf kernel/bpf/syscall.c:5571 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5569 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5569
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f198558ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f198646a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f19857b5fa0 RCX: 00007f198558ebe9
RDX: 0000000000000050 RSI: 0000200000000440 RDI: 000000000000000a
RBP: 00007f1985611e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f19857b6038 R14: 00007f19857b5fa0 R15: 00007fff181dfc58
</TASK>
task:syz.3.27 state:R running task stack:23592 pid:5943 ppid:5787 flags:0x0000400a
Call Trace:
<TASK>
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Aug 13, 2025, 9:48:32 PM8/13/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 3a8ababb8b6a Linux 6.6.101
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1137a5a2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ae2055ece513/disk-3a8ababb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72f91e4de841/vmlinux-3a8ababb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3dae292c190e/bzImage-3a8ababb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc876f...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 0-....: (1 ticks this GP) idle=e4dc/1/0x4000000000000000 softirq=43322/43322 fqs=5248
rcu: hardirqs softirqs csw/system
rcu: number: 17030188 0 0
rcu: cputime: 6280 46247 0 ==> 52510(ms)
rcu: (detected by 1, t=10502 jiffies, g=44757, q=1175 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 11790 Comm: syz.1.5254 Not tainted 6.6.101-syzkaller #0
Code: 8b 74 24 60 83 fe 31 0f 83 20 67 00 00 48 8d 04 b6 49 8d 54 c6 f8 49 89 d6 49 c1 ee 03 43 0f b6 04 06 84 c0 0f 85 29 67 00 00 <48> 83 7d 10 00 0f 84 df 00 00 00 44 8b 22 44 89 e0 25 ff 1f 00 00
RSP: 0018:ffffc90000006f20 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000021
RDX: ffff88802c3ea9c8 RSI: 0000000000000006 RDI: ffffffff8cd2fba0
RBP: ffffc90000007168 R08: dffffc0000000000 R09: 0000000000000001
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 0000000000000000
R13: 0000000000000021 R14: 1ffff1100587d539 R15: 0000000000000000
FS: 00005555679ca500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
perf_output_begin_forward+0xc0/0xa20 kernel/events/ring_buffer.c:273
__perf_event_output kernel/events/core.c:7960 [inline]
perf_event_output_forward+0x22b/0x3a0 kernel/events/core.c:7978
Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 a9 4e 93 7e 41 f7 c6 00 00 f0 00 74 45 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
RSP: 0018:ffffc90000007b00 EFLAGS: 00000206
RAX: dbaec9fb54bd9200 RBX: 1ffff92000000f68 RCX: dbaec9fb54bd9200
R10: dffffc0000000000 R11: fffffbfff21b46a5 R12: ffffffff8cd35400
R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000001
mac80211_hwsim_beacon+0xbb/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2295
__run_hrtimer kernel/time/hrtimer.c:1755 [inline]
__hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1819
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1836
handle_softirqs+0x280/0x820 kernel/softirq.c:578
Code: 00 00 00 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 75 75 f7 44 24 50 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 2f 00 00 00 00 66 43 c7 44 2f 09 00 00 43 c6 44 2f 0b 00
RSP: 0018:ffffc9000c5ef960 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 2a0d031927040563 RCX: dbaec9fb54bd9200
RDX: 0000000000000004 RSI: ffffffff8aaacbc0 RDI: ffffffff8afc6780
RBP: ffffc9000c5efa70 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffff88802c3ea980
R13: dffffc0000000000 R14: ffff88802c3ea8d0 R15: 1ffff920018bdf38
rcu_lock_release include/linux/rcupdate.h:344 [inline]
rcu_read_unlock include/linux/rcupdate.h:819 [inline]
pte_unmap include/linux/pgtable.h:113 [inline]
__text_poke+0x96c/0xb20 arch/x86/kernel/alternative.c:2097
text_poke arch/x86/kernel/alternative.c:2121 [inline]
text_poke_bp_batch+0x768/0x930 arch/x86/kernel/alternative.c:2510
text_poke_flush arch/x86/kernel/alternative.c:2623 [inline]
text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2630
arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
static_key_slow_inc_cpuslocked+0x80/0xe0 kernel/jump_label.c:165
static_key_slow_inc+0x1a/0x30 kernel/jump_label.c:188
bpf_enable_runtime_stats kernel/bpf/syscall.c:5312 [inline]
bpf_enable_stats+0x101/0x140 kernel/bpf/syscall.c:5331
__sys_bpf+0x5de/0x800 kernel/bpf/syscall.c:5550
RAX: ffffffffffffffda RBX: 00007f32659b5fa0 RCX: 00007f326578ebe9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000020
RBP: 00007f3265811e19 R08: 0000000000000000 R09: 0000000000000000
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 3a8ababb8b6a Linux 6.6.101
git tree: linux-6.6.y
kernel config: https://syzkaller.appspot.com/x/.config?x=a2bd95b6de4839b7
dashboard link: https://syzkaller.appspot.com/bug?extid=bc876f0532355e757c37
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=163fcda2580000
dashboard link: https://syzkaller.appspot.com/bug?extid=bc876f0532355e757c37
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ae2055ece513/disk-3a8ababb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72f91e4de841/vmlinux-3a8ababb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3dae292c190e/bzImage-3a8ababb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc876f...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: hardirqs softirqs csw/system
rcu: number: 17030188 0 0
rcu: cputime: 6280 46247 0 ==> 52510(ms)
rcu: (detected by 1, t=10502 jiffies, g=44757, q=1175 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 11790 Comm: syz.1.5254 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:__lock_acquire+0x25d/0x7c80 kernel/locking/lockdep.c:-1
Code: 8b 74 24 60 83 fe 31 0f 83 20 67 00 00 48 8d 04 b6 49 8d 54 c6 f8 49 89 d6 49 c1 ee 03 43 0f b6 04 06 84 c0 0f 85 29 67 00 00 <48> 83 7d 10 00 0f 84 df 00 00 00 44 8b 22 44 89 e0 25 ff 1f 00 00
RSP: 0018:ffffc90000006f20 EFLAGS: 00000046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000021
RDX: ffff88802c3ea9c8 RSI: 0000000000000006 RDI: ffffffff8cd2fba0
RBP: ffffc90000007168 R08: dffffc0000000000 R09: 0000000000000001
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 0000000000000000
R13: 0000000000000021 R14: 1ffff1100587d539 R15: 0000000000000000
FS: 00005555679ca500(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000075c07000 CR4: 00000000003506f0
Call Trace:
<IRQ>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
rcu_read_lock include/linux/rcupdate.h:786 [inline]
__perf_output_begin kernel/events/ring_buffer.c:163 [inline]
<IRQ>
lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
rcu_read_lock include/linux/rcupdate.h:786 [inline]
perf_output_begin_forward+0xc0/0xa20 kernel/events/ring_buffer.c:273
__perf_event_output kernel/events/core.c:7960 [inline]
perf_event_output_forward+0x22b/0x3a0 kernel/events/core.c:7978
__perf_event_overflow+0x447/0x630 kernel/events/core.c:9703
perf_swevent_overflow kernel/events/core.c:9779 [inline]
perf_swevent_event+0x2f5/0x5c0 kernel/events/core.c:-1
perf_tp_event+0x4f9/0x13a0 kernel/events/core.c:10329
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10253
perf_trace_preemptirq_template+0x281/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:rcu_read_unlock_special+0x88/0x4c0 kernel/rcu/tree_plugin.h:682
perf_swevent_overflow kernel/events/core.c:9779 [inline]
perf_swevent_event+0x2f5/0x5c0 kernel/events/core.c:-1
perf_tp_event+0x4f9/0x13a0 kernel/events/core.c:10329
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10253
perf_trace_preemptirq_template+0x281/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 a9 4e 93 7e 41 f7 c6 00 00 f0 00 74 45 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
RSP: 0018:ffffc90000007b00 EFLAGS: 00000206
RAX: dbaec9fb54bd9200 RBX: 1ffff92000000f68 RCX: dbaec9fb54bd9200
RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780
RBP: ffffc90000007bf0 R08: ffffffff90da3527 R09: 1ffffffff21b46a4
R10: dffffc0000000000 R11: fffffbfff21b46a5 R12: ffffffff8cd35400
R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000001
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
ieee80211_iterate_active_interfaces_atomic+0x15a/0x180 net/mac80211/util.c:804
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
mac80211_hwsim_beacon+0xbb/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2295
__run_hrtimer kernel/time/hrtimer.c:1755 [inline]
__hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1819
hrtimer_run_softirq+0x187/0x2b0 kernel/time/hrtimer.c:1836
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:lock_release+0x57c/0x8b0 kernel/locking/lockdep.c:5778
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
Code: 00 00 00 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 75 75 f7 44 24 50 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 2f 00 00 00 00 66 43 c7 44 2f 09 00 00 43 c6 44 2f 0b 00
RSP: 0018:ffffc9000c5ef960 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 2a0d031927040563 RCX: dbaec9fb54bd9200
RDX: 0000000000000004 RSI: ffffffff8aaacbc0 RDI: ffffffff8afc6780
RBP: ffffc9000c5efa70 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffff88802c3ea980
R13: dffffc0000000000 R14: ffff88802c3ea8d0 R15: 1ffff920018bdf38
rcu_lock_release include/linux/rcupdate.h:344 [inline]
rcu_read_unlock include/linux/rcupdate.h:819 [inline]
pte_unmap include/linux/pgtable.h:113 [inline]
__text_poke+0x96c/0xb20 arch/x86/kernel/alternative.c:2097
text_poke arch/x86/kernel/alternative.c:2121 [inline]
text_poke_bp_batch+0x768/0x930 arch/x86/kernel/alternative.c:2510
text_poke_flush arch/x86/kernel/alternative.c:2623 [inline]
text_poke_finish+0x30/0x50 arch/x86/kernel/alternative.c:2630
arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
static_key_slow_inc_cpuslocked+0x80/0xe0 kernel/jump_label.c:165
static_key_slow_inc+0x1a/0x30 kernel/jump_label.c:188
bpf_enable_runtime_stats kernel/bpf/syscall.c:5312 [inline]
bpf_enable_stats+0x101/0x140 kernel/bpf/syscall.c:5331
__sys_bpf+0x5de/0x800 kernel/bpf/syscall.c:5550
__do_sys_bpf kernel/bpf/syscall.c:5571 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5569 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5569
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f326578ebe9
__se_sys_bpf kernel/bpf/syscall.c:5569 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5569
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff048c3148 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f32659b5fa0 RCX: 00007f326578ebe9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000020
RBP: 00007f3265811e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f32659b5fa0 R14: 00007f32659b5fa0 R15: 0000000000000003
</TASK>
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Aug 23, 2025, 11:58:38 AM8/23/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: bb9c90ab9c5a Linux 6.6.102
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=166d8ef0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7b989b97a0687b0a
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15636a34580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3741b512b75a/disk-bb9c90ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dedce7f4c998/vmlinux-bb9c90ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/acd529da0064/bzImage-bb9c90ab.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc876f...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 0-....: (10499 ticks this GP) idle=c80c/1/0x4000000000000000 softirq=10203/2408275 fqs=5027
rcu: hardirqs softirqs csw/system
rcu: number: 1236599 1216187 0
rcu: cputime: 1060 50294 1126 ==> 52490(ms)
rcu: (t=10500 jiffies g=9173 q=310 ncpus=2)
CPU: 0 PID: 5846 Comm: syz-executor267 Not tainted 6.6.102-syzkaller #0
RIP: 0010:__sanitizer_cov_trace_pc+0x2e/0x60 kernel/kcov.c:216
Code: 48 8b 04 24 65 48 8b 0d d0 2e 7e 7e 65 8b 15 d1 2e 7e 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 1c 16 00 00 00 <74> 2c 8b 91 f8 15 00 00 83 fa 02 75 21 48 8b 91 00 16 00 00 48 8b
RSP: 0018:ffffc90000007490 EFLAGS: 00000246
RAX: ffffffff81889336 RBX: 00000032f2801440 RCX: ffff888030e9bc00
RDX: 0000000000000100 RSI: ffffffff8cd79180 RDI: 0000000000000004
RBP: 0000000000000f78 R08: ffff888030e9bc00 R09: 0000000000000020
R10: 000000000000001f R11: 0000000000000100 R12: 0000000000000064
R13: f800000000000000 R14: 0000000000000064 R15: 00000032f28023a8
FS: 0000555576263380(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
Call Trace:
<IRQ>
check_buffer+0x556/0x950 kernel/trace/ring_buffer.c:3491
__rb_reserve_next+0x511/0xd50 kernel/trace/ring_buffer.c:3624
rb_reserve_next_event kernel/trace/ring_buffer.c:3759 [inline]
ring_buffer_lock_reserve+0xae1/0xed0 kernel/trace/ring_buffer.c:3818
__trace_buffer_lock_reserve kernel/trace/trace.c:992 [inline]
trace_event_buffer_lock_reserve+0x1d0/0x6e0 kernel/trace/trace.c:2902
trace_event_buffer_reserve+0x29b/0x3c0 kernel/trace/trace_events.c:661
do_trace_event_raw_event_bpf_trace_printk kernel/trace/bpf_trace.h:11 [inline]
trace_event_raw_event_bpf_trace_printk+0x101/0x210 kernel/trace/bpf_trace.h:11
trace_bpf_trace_printk+0x142/0x1a0 kernel/trace/bpf_trace.h:11
____bpf_trace_printk kernel/trace/bpf_trace.c:388 [inline]
bpf_trace_printk+0x11f/0x190 kernel/trace/bpf_trace.c:371
bpf_prog_0605f9f479290f07+0x37/0x3b
bpf_dispatcher_nop_func include/linux/bpf.h:1213 [inline]
__bpf_prog_run include/linux/filter.h:612 [inline]
bpf_prog_run include/linux/filter.h:619 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2322 [inline]
bpf_trace_run1+0x1c9/0x3b0 kernel/trace/bpf_trace.c:2360
__bpf_trace_rcu_utilization+0xa2/0xe0 include/trace/events/rcu.h:27
trace_rcu_utilization+0x179/0x1a0 include/trace/events/rcu.h:27
rcu_core+0x1341/0x1720 kernel/rcu/tree.c:2475
handle_softirqs+0x280/0x820 kernel/softirq.c:578
sysvec_irq_work+0xa1/0xc0 arch/x86/kernel/irq_work.c:17
</IRQ>
<TASK>
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:preempt_schedule_irq+0xb0/0x140 kernel/sched/core.c:7009
Code: 44 24 20 f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 63 bf 01 00 00 00 e8 4b da e5 f6 e8 46 5f 16 f7 fb bf 01 00 00 00 <e8> db b5 ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24
RSP: 0018:ffffc9000492eb20 EFLAGS: 00000282
RAX: df1405895ab93800 RBX: 0000000000000000 RCX: df1405895ab93800
RDX: dffffc0000000000 RSI: ffffffff8aaab9c0 RDI: 0000000000000001
RBP: ffffc9000492ebc0 R08: ffffffff8e4a882f R09: 1ffffffff1c95105
R10: dffffc0000000000 R11: fffffbfff1c95106 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000925d64
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:memset_orig+0x42/0xac arch/x86/lib/memset_64.S:71
Code: c1 41 89 f9 41 83 e1 07 75 6c 48 89 d1 48 c1 e9 06 74 35 0f 1f 44 00 00 48 ff c9 48 89 07 48 89 47 08 48 89 47 10 48 89 47 18 <48> 89 47 20 48 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d8
RSP: 0018:ffffc9000492ec88 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 0000000000000cc0 RCX: 0000000000000004
RDX: 0000000000000200 RSI: 0000000000000000 RDI: ffffc9000492ed50
RBP: ffffc9000492eeb8 R08: dffffc0000000000 R09: 0000000000000000
R10: ffffc9000492ec90 R11: fffffbfff1c95106 R12: ffff8880178418c0
R13: 0000000000000000 R14: ffff88801d7d5480 R15: ffffc9000492ec90
kasan_save_stack mm/kasan/common.c:42 [inline]
kasan_set_track+0x3f/0x70 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc_node_track_caller+0xb2/0x230 mm/slab_common.c:1027
__do_krealloc mm/slab_common.c:1402 [inline]
krealloc+0x86/0x120 mm/slab_common.c:1435
copy_array+0x64/0xf0 kernel/bpf/verifier.c:1572
copy_stack_state kernel/bpf/verifier.c:1626 [inline]
copy_func_state kernel/bpf/verifier.c:1755 [inline]
copy_verifier_state+0x7f3/0xd20 kernel/bpf/verifier.c:1796
push_stack+0x1b9/0x500 kernel/bpf/verifier.c:2059
check_cond_jmp_op+0xdd0/0x2680 kernel/bpf/verifier.c:14630
do_check+0x672e/0xdbe0 kernel/bpf/verifier.c:17353
do_check_common+0xadb/0x13e0 kernel/bpf/verifier.c:19699
do_check_main kernel/bpf/verifier.c:19762 [inline]
bpf_check+0x649f/0xe970 kernel/bpf/verifier.c:20430
bpf_prog_load+0x11cb/0x16d0 kernel/bpf/syscall.c:2744
__sys_bpf+0x55a/0x800 kernel/bpf/syscall.c:5467
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff295cb2b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f41c84b0fb9
RDX: 000000000000002e RSI: 0000200000000080 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
HEAD commit: bb9c90ab9c5a Linux 6.6.102
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=166d8ef0580000
kernel config: https://syzkaller.appspot.com/x/.config?x=7b989b97a0687b0a
dashboard link: https://syzkaller.appspot.com/bug?extid=bc876f0532355e757c37
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=117f4c42580000
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=15636a34580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/3741b512b75a/disk-bb9c90ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/dedce7f4c998/vmlinux-bb9c90ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/acd529da0064/bzImage-bb9c90ab.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+bc876f...@syzkaller.appspotmail.com
rcu: 0-....: (10499 ticks this GP) idle=c80c/1/0x4000000000000000 softirq=10203/2408275 fqs=5027
rcu: hardirqs softirqs csw/system
rcu: number: 1236599 1216187 0
rcu: cputime: 1060 50294 1126 ==> 52490(ms)
rcu: (t=10500 jiffies g=9173 q=310 ncpus=2)
CPU: 0 PID: 5846 Comm: syz-executor267 Not tainted 6.6.102-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:check_kcov_mode kernel/kcov.c:182 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x2e/0x60 kernel/kcov.c:216
Code: 48 8b 04 24 65 48 8b 0d d0 2e 7e 7e 65 8b 15 d1 2e 7e 7e 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 35 83 b9 1c 16 00 00 00 <74> 2c 8b 91 f8 15 00 00 83 fa 02 75 21 48 8b 91 00 16 00 00 48 8b
RSP: 0018:ffffc90000007490 EFLAGS: 00000246
RAX: ffffffff81889336 RBX: 00000032f2801440 RCX: ffff888030e9bc00
RDX: 0000000000000100 RSI: ffffffff8cd79180 RDI: 0000000000000004
RBP: 0000000000000f78 R08: ffff888030e9bc00 R09: 0000000000000020
R10: 000000000000001f R11: 0000000000000100 R12: 0000000000000064
R13: f800000000000000 R14: 0000000000000064 R15: 00000032f28023a8
FS: 0000555576263380(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000004000 CR3: 000000007d486000 CR4: 00000000003506f0
Call Trace:
<IRQ>
check_buffer+0x556/0x950 kernel/trace/ring_buffer.c:3491
__rb_reserve_next+0x511/0xd50 kernel/trace/ring_buffer.c:3624
rb_reserve_next_event kernel/trace/ring_buffer.c:3759 [inline]
ring_buffer_lock_reserve+0xae1/0xed0 kernel/trace/ring_buffer.c:3818
__trace_buffer_lock_reserve kernel/trace/trace.c:992 [inline]
trace_event_buffer_lock_reserve+0x1d0/0x6e0 kernel/trace/trace.c:2902
trace_event_buffer_reserve+0x29b/0x3c0 kernel/trace/trace_events.c:661
do_trace_event_raw_event_bpf_trace_printk kernel/trace/bpf_trace.h:11 [inline]
trace_event_raw_event_bpf_trace_printk+0x101/0x210 kernel/trace/bpf_trace.h:11
trace_bpf_trace_printk+0x142/0x1a0 kernel/trace/bpf_trace.h:11
____bpf_trace_printk kernel/trace/bpf_trace.c:388 [inline]
bpf_trace_printk+0x11f/0x190 kernel/trace/bpf_trace.c:371
bpf_prog_0605f9f479290f07+0x37/0x3b
bpf_dispatcher_nop_func include/linux/bpf.h:1213 [inline]
__bpf_prog_run include/linux/filter.h:612 [inline]
bpf_prog_run include/linux/filter.h:619 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2322 [inline]
bpf_trace_run1+0x1c9/0x3b0 kernel/trace/bpf_trace.c:2360
__bpf_trace_rcu_utilization+0xa2/0xe0 include/trace/events/rcu.h:27
trace_rcu_utilization+0x179/0x1a0 include/trace/events/rcu.h:27
rcu_core+0x1341/0x1720 kernel/rcu/tree.c:2475
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_irq_work arch/x86/kernel/irq_work.c:17 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
sysvec_irq_work+0xa1/0xc0 arch/x86/kernel/irq_work.c:17
</IRQ>
<TASK>
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:preempt_schedule_irq+0xb0/0x140 kernel/sched/core.c:7009
Code: 44 24 20 f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 63 bf 01 00 00 00 e8 4b da e5 f6 e8 46 5f 16 f7 fb bf 01 00 00 00 <e8> db b5 ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24
RSP: 0018:ffffc9000492eb20 EFLAGS: 00000282
RAX: df1405895ab93800 RBX: 0000000000000000 RCX: df1405895ab93800
RDX: dffffc0000000000 RSI: ffffffff8aaab9c0 RDI: 0000000000000001
RBP: ffffc9000492ebc0 R08: ffffffff8e4a882f R09: 1ffffffff1c95105
R10: dffffc0000000000 R11: fffffbfff1c95106 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff92000925d64
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:memset_orig+0x42/0xac arch/x86/lib/memset_64.S:71
Code: c1 41 89 f9 41 83 e1 07 75 6c 48 89 d1 48 c1 e9 06 74 35 0f 1f 44 00 00 48 ff c9 48 89 07 48 89 47 08 48 89 47 10 48 89 47 18 <48> 89 47 20 48 89 47 28 48 89 47 30 48 89 47 38 48 8d 7f 40 75 d8
RSP: 0018:ffffc9000492ec88 EFLAGS: 00000202
RAX: 0000000000000000 RBX: 0000000000000cc0 RCX: 0000000000000004
RDX: 0000000000000200 RSI: 0000000000000000 RDI: ffffc9000492ed50
RBP: ffffc9000492eeb8 R08: dffffc0000000000 R09: 0000000000000000
R10: ffffc9000492ec90 R11: fffffbfff1c95106 R12: ffff8880178418c0
R13: 0000000000000000 R14: ffff88801d7d5480 R15: ffffc9000492ec90
kasan_save_stack mm/kasan/common.c:42 [inline]
kasan_set_track+0x3f/0x70 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc_node_track_caller+0xb2/0x230 mm/slab_common.c:1027
__do_krealloc mm/slab_common.c:1402 [inline]
krealloc+0x86/0x120 mm/slab_common.c:1435
copy_array+0x64/0xf0 kernel/bpf/verifier.c:1572
copy_stack_state kernel/bpf/verifier.c:1626 [inline]
copy_func_state kernel/bpf/verifier.c:1755 [inline]
copy_verifier_state+0x7f3/0xd20 kernel/bpf/verifier.c:1796
push_stack+0x1b9/0x500 kernel/bpf/verifier.c:2059
check_cond_jmp_op+0xdd0/0x2680 kernel/bpf/verifier.c:14630
do_check+0x672e/0xdbe0 kernel/bpf/verifier.c:17353
do_check_common+0xadb/0x13e0 kernel/bpf/verifier.c:19699
do_check_main kernel/bpf/verifier.c:19762 [inline]
bpf_check+0x649f/0xe970 kernel/bpf/verifier.c:20430
bpf_prog_load+0x11cb/0x16d0 kernel/bpf/syscall.c:2744
__sys_bpf+0x55a/0x800 kernel/bpf/syscall.c:5467
__do_sys_bpf kernel/bpf/syscall.c:5571 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5569 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5569
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f41c84b0fb9
__se_sys_bpf kernel/bpf/syscall.c:5569 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5569
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 01 1a 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fff295cb2b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f41c84b0fb9
RDX: 000000000000002e RSI: 0000200000000080 RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
Reply all
Reply to author
Forward
0 new messages