[v6.6] INFO: rcu detected stall in schedule_timeout
0 views
Skip to first unread message
syzbot
Nov 4, 2025, 2:17:32 PM (3 days ago) Nov 4
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 0a805b6ea8cd Linux 6.6.116
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1739417c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=0f0e5c7e191f01eca401
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127ac012580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d44a58580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/13874446b4b2/disk-0a805b6e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/69a5e59e1ade/vmlinux-0a805b6e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/322c0711f976/bzImage-0a805b6e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0f0e5c...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5906/1:b..l
rcu: (detected by 1, t=10503 jiffies, g=10225, q=672 ncpus=2)
task:syz-executor state:R running task stack:21736 pid:5906 ppid:5904 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6866
preempt_schedule+0xab/0xc0 kernel/sched/core.c:6890
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
vprintk_emit+0x578/0x600 kernel/printk/printk.c:2342
dev_vprintk_emit+0x338/0x3e0 drivers/base/core.c:4953
dev_printk_emit+0xe1/0x130 drivers/base/core.c:4964
__netdev_printk+0x3bf/0x4a0 net/core/dev.c:11482
netdev_info+0x10b/0x160 net/core/dev.c:11537
nsim_udp_tunnel_set_port+0x297/0x440 drivers/net/netdevsim/udp_tunnels.c:34
udp_tunnel_nic_device_sync_one net/ipv4/udp_tunnel_nic.c:-1 [inline]
udp_tunnel_nic_device_sync_by_port net/ipv4/udp_tunnel_nic.c:246 [inline]
__udp_tunnel_nic_device_sync+0xa70/0x1370 net/ipv4/udp_tunnel_nic.c:289
udp_tunnel_nic_device_sync net/ipv4/udp_tunnel_nic.c:312 [inline]
__udp_tunnel_nic_add_port+0xaf8/0xdb0 net/ipv4/udp_tunnel_nic.c:531
udp_tunnel_nic_add_port include/net/udp_tunnel.h:333 [inline]
udp_tunnel_notify_add_rx_port+0x28e/0x3e0 net/ipv4/udp_tunnel_core.c:127
geneve_socket_create drivers/net/geneve.c:614 [inline]
geneve_sock_add+0x55e/0x910 drivers/net/geneve.c:689
geneve_open+0xd2/0x140 drivers/net/geneve.c:731
__dev_open+0x2bc/0x430 net/core/dev.c:1506
__dev_change_flags+0x20e/0x6a0 net/core/dev.c:8685
dev_change_flags+0x88/0x1a0 net/core/dev.c:8757
do_setlink+0xc74/0x3fb0 net/core/rtnetlink.c:2905
__rtnl_newlink net/core/rtnetlink.c:3703 [inline]
rtnl_newlink+0x175b/0x2020 net/core/rtnetlink.c:3750
rtnetlink_rcv_msg+0x7c7/0xf10 net/core/rtnetlink.c:6472
netlink_rcv_skb+0x216/0x480 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x751/0x8d0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8c1/0xbe0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x46a/0x620 net/socket.c:2201
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0xf0 net/socket.c:2209
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7a9259155c
RSP: 002b:00007ffce9ac50d0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f7a93314620 RCX: 00007f7a9259155c
RDX: 000000000000002c RSI: 00007f7a93314670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffce9ac5124 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f7a93314670 R15: 0000000000000000
</TASK>
rcu: rcu_preempt kthread starved for 10498 jiffies! g10225 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27272 pid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:destroy_timer_on_stack kernel/time/timer.c:812 [inline]
RIP: 0010:schedule_timeout+0x16a/0x280 kernel/time/timer.c:2171
Code: 6a 00 e8 29 76 ee f6 48 83 c4 08 4c 89 f7 48 89 de ba 04 00 00 00 e8 b5 b6 fc f6 e8 30 b3 fe ff 4c 89 f7 31 f6 e8 a6 d1 fc f6 <4c> 89 f7 48 c7 c6 00 9f ac 8a e8 e7 c4 ad f9 43 80 7c 3d 00 00 74
RSP: 0018:ffffc90000167b80 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000ffffad0c RCX: ffff88801b270000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000167c70 R08: ffffffff8e4a8d6f R09: 1ffffffff1c951ad
R10: dffffc0000000000 R11: fffffbfff1c951ae R12: 1ffff9200002cf70
R13: 1ffffffff1941e40 R14: ffffc90000167ba0 R15: dffffc0000000000
rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6178 Comm: syz.2.100 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:trace_irq_enable+0x30/0xe0 include/trace/events/preemptirq.h:40
Code: 8b 05 00 c6 77 7e 83 f8 08 73 2e 89 c3 c1 e8 06 48 8d 3c c5 68 8d 4a 8e be 08 00 00 00 e8 b8 fa 50 00 48 0f a3 1d 78 9b be 0c <73> 09 e8 59 a7 e3 ff 84 c0 74 08 5b 41 5e c3 0f 0b eb ce 0f 0b eb
RSP: 0018:ffffc900045bfee8 EFLAGS: 00000057
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff818bf1e8
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e4a8d68
RBP: ffffc900045bff48 R08: ffffffff8e4a8d6f R09: 1ffffffff1c951ad
R10: dffffc0000000000 R11: fffffbfff1c951ae R12: 0000000000000000
R13: 0000000000000000 R14: ffffc900045bff58 R15: 0000000000000000
FS: 00007f9fd01db6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000058 CR3: 000000007729a000 CR4: 00000000003506f0
Call Trace:
<TASK>
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
syscall_enter_from_user_mode+0x25/0x80 kernel/entry/common.c:117
do_syscall_64+0x28/0xb0 arch/x86/entry/common.c:77
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9fcf386567
Code: 0b e9 68 fe ff ff 48 83 c4 18 48 8d 3d 32 63 d9 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 f3 f7 fb ff 0f 1f 00 b8 27 00 00 00 0f 05 <c3> 0f 1f 84 00 00 00 00 00 b8 6e 00 00 00 0f 05 c3 0f 1f 84 00 00
RSP: 002b:00007f9fd01dab08 EFLAGS: 00000202 ORIG_RAX: 0000000000000027
RAX: ffffffffffffffda RBX: 00007f9fd01dac70 RCX: 00007f9fcf386567
RDX: 00007f9fd01dab40 RSI: 00007f9fd01dac70 RDI: 0000000000000021
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f9fcf5e6038 R14: 00007ffc676628e0 R15: 00007ffc676629c8
</TASK>
sched: RT throttling activated
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 0a805b6ea8cd Linux 6.6.116
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1739417c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=12606d4b8832c7e4
dashboard link: https://syzkaller.appspot.com/bug?extid=0f0e5c7e191f01eca401
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127ac012580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12d44a58580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/13874446b4b2/disk-0a805b6e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/69a5e59e1ade/vmlinux-0a805b6e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/322c0711f976/bzImage-0a805b6e.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+0f0e5c...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P5906/1:b..l
rcu: (detected by 1, t=10503 jiffies, g=10225, q=672 ncpus=2)
task:syz-executor state:R running task stack:21736 pid:5906 ppid:5904 flags:0x00004002
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6866
preempt_schedule+0xab/0xc0 kernel/sched/core.c:6890
preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
vprintk_emit+0x578/0x600 kernel/printk/printk.c:2342
dev_vprintk_emit+0x338/0x3e0 drivers/base/core.c:4953
dev_printk_emit+0xe1/0x130 drivers/base/core.c:4964
__netdev_printk+0x3bf/0x4a0 net/core/dev.c:11482
netdev_info+0x10b/0x160 net/core/dev.c:11537
nsim_udp_tunnel_set_port+0x297/0x440 drivers/net/netdevsim/udp_tunnels.c:34
udp_tunnel_nic_device_sync_one net/ipv4/udp_tunnel_nic.c:-1 [inline]
udp_tunnel_nic_device_sync_by_port net/ipv4/udp_tunnel_nic.c:246 [inline]
__udp_tunnel_nic_device_sync+0xa70/0x1370 net/ipv4/udp_tunnel_nic.c:289
udp_tunnel_nic_device_sync net/ipv4/udp_tunnel_nic.c:312 [inline]
__udp_tunnel_nic_add_port+0xaf8/0xdb0 net/ipv4/udp_tunnel_nic.c:531
udp_tunnel_nic_add_port include/net/udp_tunnel.h:333 [inline]
udp_tunnel_notify_add_rx_port+0x28e/0x3e0 net/ipv4/udp_tunnel_core.c:127
geneve_socket_create drivers/net/geneve.c:614 [inline]
geneve_sock_add+0x55e/0x910 drivers/net/geneve.c:689
geneve_open+0xd2/0x140 drivers/net/geneve.c:731
__dev_open+0x2bc/0x430 net/core/dev.c:1506
__dev_change_flags+0x20e/0x6a0 net/core/dev.c:8685
dev_change_flags+0x88/0x1a0 net/core/dev.c:8757
do_setlink+0xc74/0x3fb0 net/core/rtnetlink.c:2905
__rtnl_newlink net/core/rtnetlink.c:3703 [inline]
rtnl_newlink+0x175b/0x2020 net/core/rtnetlink.c:3750
rtnetlink_rcv_msg+0x7c7/0xf10 net/core/rtnetlink.c:6472
netlink_rcv_skb+0x216/0x480 net/netlink/af_netlink.c:2545
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x751/0x8d0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8c1/0xbe0 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
__sys_sendto+0x46a/0x620 net/socket.c:2201
__do_sys_sendto net/socket.c:2213 [inline]
__se_sys_sendto net/socket.c:2209 [inline]
__x64_sys_sendto+0xde/0xf0 net/socket.c:2209
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7a9259155c
RSP: 002b:00007ffce9ac50d0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f7a93314620 RCX: 00007f7a9259155c
RDX: 000000000000002c RSI: 00007f7a93314670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffce9ac5124 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007f7a93314670 R15: 0000000000000000
</TASK>
rcu: rcu_preempt kthread starved for 10498 jiffies! g10225 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27272 pid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5380 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:destroy_timer_on_stack kernel/time/timer.c:812 [inline]
RIP: 0010:schedule_timeout+0x16a/0x280 kernel/time/timer.c:2171
Code: 6a 00 e8 29 76 ee f6 48 83 c4 08 4c 89 f7 48 89 de ba 04 00 00 00 e8 b5 b6 fc f6 e8 30 b3 fe ff 4c 89 f7 31 f6 e8 a6 d1 fc f6 <4c> 89 f7 48 c7 c6 00 9f ac 8a e8 e7 c4 ad f9 43 80 7c 3d 00 00 74
RSP: 0018:ffffc90000167b80 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 00000000ffffad0c RCX: ffff88801b270000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc90000167c70 R08: ffffffff8e4a8d6f R09: 1ffffffff1c951ad
R10: dffffc0000000000 R11: fffffbfff1c951ae R12: 1ffff9200002cf70
R13: 1ffffffff1941e40 R14: ffffc90000167ba0 R15: dffffc0000000000
rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 6178 Comm: syz.2.100 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:trace_irq_enable+0x30/0xe0 include/trace/events/preemptirq.h:40
Code: 8b 05 00 c6 77 7e 83 f8 08 73 2e 89 c3 c1 e8 06 48 8d 3c c5 68 8d 4a 8e be 08 00 00 00 e8 b8 fa 50 00 48 0f a3 1d 78 9b be 0c <73> 09 e8 59 a7 e3 ff 84 c0 74 08 5b 41 5e c3 0f 0b eb ce 0f 0b eb
RSP: 0018:ffffc900045bfee8 EFLAGS: 00000057
RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffffff818bf1e8
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e4a8d68
RBP: ffffc900045bff48 R08: ffffffff8e4a8d6f R09: 1ffffffff1c951ad
R10: dffffc0000000000 R11: fffffbfff1c951ae R12: 0000000000000000
R13: 0000000000000000 R14: ffffc900045bff58 R15: 0000000000000000
FS: 00007f9fd01db6c0(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000058 CR3: 000000007729a000 CR4: 00000000003506f0
Call Trace:
<TASK>
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
syscall_enter_from_user_mode+0x25/0x80 kernel/entry/common.c:117
do_syscall_64+0x28/0xb0 arch/x86/entry/common.c:77
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f9fcf386567
Code: 0b e9 68 fe ff ff 48 83 c4 18 48 8d 3d 32 63 d9 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 f3 f7 fb ff 0f 1f 00 b8 27 00 00 00 0f 05 <c3> 0f 1f 84 00 00 00 00 00 b8 6e 00 00 00 0f 05 c3 0f 1f 84 00 00
RSP: 002b:00007f9fd01dab08 EFLAGS: 00000202 ORIG_RAX: 0000000000000027
RAX: ffffffffffffffda RBX: 00007f9fd01dac70 RCX: 00007f9fcf386567
RDX: 00007f9fd01dab40 RSI: 00007f9fd01dac70 RDI: 0000000000000021
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f9fcf5e6038 R14: 00007ffc676628e0 R15: 00007ffc676629c8
</TASK>
sched: RT throttling activated
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
Reply all
Reply to author
Forward
0 new messages