[v6.6] INFO: rcu detected stall in close

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 5fa4793a2d2d Linux 6.6.119
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=167a3992580000
kernel config: https://syzkaller.appspot.com/x/.config?x=691a6769a86ac817
dashboard link: https://syzkaller.appspot.com/bug?extid=ba59d4f0c39c60c288c2
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135e5eb4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12be6a1a580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/857fe583cdec/disk-5fa4793a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ed4d3c1402bc/vmlinux-5fa4793a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40296d968c3d/bzImage-5fa4793a.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ba59d4...@syzkaller.appspotmail.com

rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-....: (10496 ticks this GP) idle=67f4/1/0x4000000000000000 softirq=9979/9980 fqs=4583
rcu: hardirqs softirqs csw/system
rcu: number: 1457622 0 0
rcu: cputime: 15913 36566 42 ==> 52480(ms)
rcu: (t=10500 jiffies g=8969 q=685 ncpus=2)
CPU: 1 PID: 5797 Comm: syz-executor795 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 0a d9 1a f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> e2 53 ea f6 65 8b 05 d3 9a 92 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc900001f02e0 EFLAGS: 00000206
RAX: dd87a22369a12c00 RBX: 0000000000000a06 RCX: dd87a22369a12c00
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc900001f0360 R08: ffffffff90d945c7 R09: 1ffffffff21b28b8
R10: dffffc0000000000 R11: fffffbfff21b28b9 R12: dffffc0000000000
R13: ffff88807e43c280 R14: ffffffff9713e9b8 R15: 1ffff9200003e05c
FS: 0000555560d29480(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000071f36000 CR4: 00000000003506e0
Call Trace:
<IRQ>
__debug_check_no_obj_freed lib/debugobjects.c:999 [inline]
debug_check_no_obj_freed+0x51f/0x540 lib/debugobjects.c:1020
slab_free_hook mm/slub.c:1786 [inline]
slab_free_freelist_hook+0xd2/0x1b0 mm/slub.c:1837
slab_free mm/slub.c:3830 [inline]
kmem_cache_free+0xf8/0x280 mm/slub.c:3852
dev_kfree_skb_any_reason+0x10c/0x120 net/core/dev.c:3228
free_old_xmit_skbs+0x114/0x3c0 drivers/net/virtio_net.c:780
start_xmit+0x161/0x1420 drivers/net/virtio_net.c:2420
__netdev_start_xmit include/linux/netdevice.h:4943 [inline]
netdev_start_xmit include/linux/netdevice.h:4957 [inline]
xmit_one net/core/dev.c:3619 [inline]
dev_hard_start_xmit+0x246/0x740 net/core/dev.c:3635
sch_direct_xmit+0x252/0x4a0 net/sched/sch_generic.c:345
__dev_xmit_skb net/core/dev.c:3856 [inline]
__dev_queue_xmit+0x173e/0x35a0 net/core/dev.c:4391
lapb_data_transmit+0x8a/0xa0 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x163/0x200 net/lapb/lapb_out.c:149
lapb_t1timer_expiry+0x699/0xab0 net/lapb/lapb_timer.c:-1
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x52d/0x7d0 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:get_lock_parent_ip include/linux/ftrace.h:974 [inline]
RIP: 0010:preempt_latency_start kernel/sched/core.c:5826 [inline]
RIP: 0010:preempt_count_add+0x89/0x1a0 kernel/sched/core.c:5851
Code: 15 00 75 11 65 8b 05 2e 48 a8 7e 0f b6 c0 3d f5 00 00 00 73 58 65 8b 05 1d 48 a8 7e 25 ff ff ff 7f 39 f8 75 42 48 8b 5c 24 18 <48> 89 df e8 6f c9 0c 00 85 c0 74 09 31 db 31 ff e8 62 c9 0c 00 65
RSP: 0018:ffffc9000463fe98 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffffffff8a7117b2 RCX: ffffffff96e9b403
RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000001
RBP: ffffc9000463ff48 R08: ffffffff8e4a212f R09: 1ffffffff1c94425
R10: dffffc0000000000 R11: fffffbfff1c94426 R12: 0000000000000000
R13: 0000000000000000 R14: ffff888030525a40 R15: dffffc0000000000
__raw_spin_lock include/linux/spinlock_api_smp.h:132 [inline]
_raw_spin_lock+0x12/0x40 kernel/locking/spinlock.c:154
spin_lock include/linux/spinlock.h:351 [inline]
close_fd_get_file+0x50/0x70 fs/file.c:789
__do_sys_close fs/open.c:1563 [inline]
__se_sys_close+0x19/0x220 fs/open.c:1558
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f97d194dcca
Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 83 83 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 e3 83 02 00 8b 44 24
RSP: 002b:00007ffd617f6640 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f97d194dcca
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 000000000000000a R09: 00007ffd617f6678
R10: ffffffffffffffff R11: 0000000000000293 R12: 00007ffd617f6678
R13: 00007ffd617f6690 R14: 00007ffd617f66d0 R15: 0000000000000004
</TASK>


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup