Re: [v6.1] INFO: rcu detected stall in sys_close_range
2 views
Skip to first unread message
syzbot
Aug 12, 2025, 3:58:05 PM8/12/25
to sumanth...@yahoo.com, syzkaller...@googlegroups.com
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+296695...@syzkaller.appspotmail.com
Tested-by: syzbot+296695...@syzkaller.appspotmail.com
Tested on:
commit: 3594f306 Linux 6.1.147
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1026f5bc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=676c3e447bef4eed
dashboard link: https://syzkaller.appspot.com/bug?extid=296695c8ae3c7da3d511
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch: https://syzkaller.appspot.com/x/patch.diff?x=15e0caf0580000
Note: testing is done by a robot and is best-effort only.
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+296695...@syzkaller.appspotmail.com
Tested-by: syzbot+296695...@syzkaller.appspotmail.com
Tested on:
commit: 3594f306 Linux 6.1.147
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1026f5bc580000
kernel config: https://syzkaller.appspot.com/x/.config?x=676c3e447bef4eed
dashboard link: https://syzkaller.appspot.com/bug?extid=296695c8ae3c7da3d511
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
patch: https://syzkaller.appspot.com/x/patch.diff?x=15e0caf0580000
Note: testing is done by a robot and is best-effort only.
syzbot
Aug 13, 2025, 12:29:30 PM8/13/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 3a8ababb8b6a Linux 6.6.101
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1556e842580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a2bd95b6de4839b7
dashboard link: https://syzkaller.appspot.com/bug?extid=793af646fd66df0b254e
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ae2055ece513/disk-3a8ababb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72f91e4de841/vmlinux-3a8ababb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3dae292c190e/bzImage-3a8ababb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+793af6...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 1-...!: (1 ticks this GP) idle=89c4/1/0x4000000000000000 softirq=27408/27408 fqs=0
rcu: (detected by 0, t=10506 jiffies, g=28697, q=5164 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8605 Comm: syz.0.2575 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:perf_trace_buf_alloc+0x16c/0x290 kernel/trace/trace_event_perf.c:416
Code: 00 89 ee e8 76 e1 f7 ff 83 fd 03 0f 87 d5 00 00 00 e8 b8 dd f7 ff 4e 8d 34 fd c0 60 ef 96 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 <74> 08 4c 89 f7 e8 9a 23 4f 00 4d 8b 36 e8 a2 75 df 08 89 c5 41 89
RSP: 0018:ffffc900001f0a80 EFLAGS: 00000046
RAX: 1ffffffff2ddec19 RBX: 0000000000000014 RCX: ffff8880234c1e00
RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000004
RBP: 0000000000000001 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8c7d0a38
R13: dffffc0000000000 R14: ffffffff96ef60c8 R15: 0000000000000001
FS: 0000555580c71500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d863fff CR3: 0000000074441000 CR4: 00000000003506e0
Call Trace:
<IRQ>
perf_trace_preemptirq_template+0x14a/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:rcu_read_unlock_special+0x88/0x4c0 kernel/rcu/tree_plugin.h:682
Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 a9 4e 93 7e 41 f7 c6 00 00 f0 00 74 45 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
RSP: 0018:ffffc900001f0c60 EFLAGS: 00000206
RAX: 7b452cd74dfe8100 RBX: 1ffff9200003e194 RCX: 7b452cd74dfe8100
RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780
RBP: ffffc900001f0d48 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8cd35400
R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000002
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
rebalance_domains+0x89c/0x9d0 kernel/sched/fair.c:11794
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__preempt_count_add arch/x86/include/asm/preempt.h:80 [inline]
RIP: 0010:rcu_is_watching+0x8/0xb0 kernel/rcu/tree.c:699
Code: e8 dd 77 fd 08 48 c7 c7 00 6a d3 8c 4c 89 f6 e8 5e 75 e1 02 e9 53 ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 41 57 41 56 <53> 65 ff 05 28 1a 94 7e e8 bb 8d fd 08 89 c3 83 f8 08 73 60 49 bf
RSP: 0018:ffffc90004f17788 EFLAGS: 00000257
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff81678a9b
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e4a84e8
RBP: ffffc90004f178b8 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8192c2d6
R13: dffffc0000000000 R14: 00007f846f18ebe9 R15: 1ffff920009e2f00
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0xba/0x8b0 kernel/locking/lockdep.c:5765
rcu_lock_release include/linux/rcupdate.h:344 [inline]
rcu_read_unlock include/linux/rcupdate.h:819 [inline]
is_bpf_text_address+0x28f/0x2a0 kernel/bpf/core.c:743
kernel_text_address+0xa0/0xd0 kernel/extable.c:125
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x5d/0xc0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0x11d/0x190 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
task_work_add+0xd3/0x440 kernel/task_work.c:77
fput+0xdd/0x1a0 fs/file_table.c:440
filp_close+0x10f/0x150 fs/open.c:1545
__range_close fs/file.c:700 [inline]
__close_range+0x342/0x630 fs/file.c:757
__do_sys_close_range fs/open.c:1597 [inline]
__se_sys_close_range fs/open.c:1594 [inline]
__x64_sys_close_range+0x7a/0x90 fs/open.c:1594
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f846f18ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffda256b568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 000000000002ea3b RCX: 00007f846f18ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002a256b85f
R10: 0000001b2cc20000 R11: 0000000000000246 R12: 00007f846f3b5fac
R13: 00007f846f3b5fa0 R14: ffffffffffffffff R15: 0000000000000005
</TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10505 jiffies! g28697 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=1 timer-softirq=9832
rcu: rcu_preempt kthread starved for 10506 jiffies! g28697 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27528 pid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_timeout+0x160/0x280 kernel/time/timer.c:2167
rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8605 Comm: syz.0.2575 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:get_current arch/x86/include/asm/current.h:41 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x60 kernel/kcov.c:215
Code: 00 00 f3 0f 1e fa 53 48 89 fb e8 13 00 00 00 48 8b 3d 8c f1 c4 0c 48 89 de 5b e9 63 75 56 00 cc cc cc f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 60 24 7e 7e 65 8b 15 61 24 7e 7e 81 e2 00 01 ff 00 74
RSP: 0018:ffffc900001f0458 EFLAGS: 00000046
RAX: ffffffff81ac380f RBX: 0000000000000510 RCX: ffff8880234c1e00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001f0550 R08: dffffc0000000000 R09: 1ffffffff21b46a4
R10: dffffc0000000000 R11: fffffbfff21b46a5 R12: ffffc900001f0840
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000010
FS: 0000555580c71500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d863fff CR3: 0000000074441000 CR4: 00000000003506e0
Call Trace:
<IRQ>
perf_prepare_sample+0x40f/0x1c40 kernel/events/core.c:7771
__perf_event_output kernel/events/core.c:7957 [inline]
perf_event_output_forward+0x152/0x3a0 kernel/events/core.c:7978
__perf_event_overflow+0x447/0x630 kernel/events/core.c:9703
perf_swevent_overflow kernel/events/core.c:9779 [inline]
perf_swevent_event+0x2f5/0x5c0 kernel/events/core.c:-1
perf_tp_event+0x4f9/0x13a0 kernel/events/core.c:10329
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10253
perf_trace_preemptirq_template+0x281/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:rcu_read_unlock_special+0x88/0x4c0 kernel/rcu/tree_plugin.h:682
Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 a9 4e 93 7e 41 f7 c6 00 00 f0 00 74 45 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
RSP: 0018:ffffc900001f0c60 EFLAGS: 00000206
RAX: 7b452cd74dfe8100 RBX: 1ffff9200003e194 RCX: 7b452cd74dfe8100
RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780
RBP: ffffc900001f0d48 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8cd35400
R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000002
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
rebalance_domains+0x89c/0x9d0 kernel/sched/fair.c:11794
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__preempt_count_add arch/x86/include/asm/preempt.h:80 [inline]
RIP: 0010:rcu_is_watching+0x8/0xb0 kernel/rcu/tree.c:699
Code: e8 dd 77 fd 08 48 c7 c7 00 6a d3 8c 4c 89 f6 e8 5e 75 e1 02 e9 53 ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 41 57 41 56 <53> 65 ff 05 28 1a 94 7e e8 bb 8d fd 08 89 c3 83 f8 08 73 60 49 bf
RSP: 0018:ffffc90004f17788 EFLAGS: 00000257
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff81678a9b
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e4a84e8
RBP: ffffc90004f178b8 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8192c2d6
R13: dffffc0000000000 R14: 00007f846f18ebe9 R15: 1ffff920009e2f00
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0xba/0x8b0 kernel/locking/lockdep.c:5765
rcu_lock_release include/linux/rcupdate.h:344 [inline]
rcu_read_unlock include/linux/rcupdate.h:819 [inline]
is_bpf_text_address+0x28f/0x2a0 kernel/bpf/core.c:743
kernel_text_address+0xa0/0xd0 kernel/extable.c:125
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x5d/0xc0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0x11d/0x190 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
task_work_add+0xd3/0x440 kernel/task_work.c:77
fput+0xdd/0x1a0 fs/file_table.c:440
filp_close+0x10f/0x150 fs/open.c:1545
__range_close fs/file.c:700 [inline]
__close_range+0x342/0x630 fs/file.c:757
__do_sys_close_range fs/open.c:1597 [inline]
__se_sys_close_range fs/open.c:1594 [inline]
__x64_sys_close_range+0x7a/0x90 fs/open.c:1594
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f846f18ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffda256b568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 000000000002ea3b RCX: 00007f846f18ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002a256b85f
R10: 0000001b2cc20000 R11: 0000000000000246 R12: 00007f846f3b5fac
R13: 00007f846f3b5fa0 R14: ffffffffffffffff R15: 0000000000000005
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 3a8ababb8b6a Linux 6.6.101
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1556e842580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a2bd95b6de4839b7
dashboard link: https://syzkaller.appspot.com/bug?extid=793af646fd66df0b254e
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14df75a2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/ae2055ece513/disk-3a8ababb.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/72f91e4de841/vmlinux-3a8ababb.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3dae292c190e/bzImage-3a8ababb.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+793af6...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 1-...!: (1 ticks this GP) idle=89c4/1/0x4000000000000000 softirq=27408/27408 fqs=0
rcu: (detected by 0, t=10506 jiffies, g=28697, q=5164 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8605 Comm: syz.0.2575 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:perf_trace_buf_alloc+0x16c/0x290 kernel/trace/trace_event_perf.c:416
Code: 00 89 ee e8 76 e1 f7 ff 83 fd 03 0f 87 d5 00 00 00 e8 b8 dd f7 ff 4e 8d 34 fd c0 60 ef 96 4c 89 f0 48 c1 e8 03 42 80 3c 28 00 <74> 08 4c 89 f7 e8 9a 23 4f 00 4d 8b 36 e8 a2 75 df 08 89 c5 41 89
RSP: 0018:ffffc900001f0a80 EFLAGS: 00000046
RAX: 1ffffffff2ddec19 RBX: 0000000000000014 RCX: ffff8880234c1e00
RDX: 0000000000000100 RSI: 0000000000000001 RDI: 0000000000000004
RBP: 0000000000000001 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8c7d0a38
R13: dffffc0000000000 R14: ffffffff96ef60c8 R15: 0000000000000001
FS: 0000555580c71500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d863fff CR3: 0000000074441000 CR4: 00000000003506e0
Call Trace:
<IRQ>
perf_trace_preemptirq_template+0x14a/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:rcu_read_unlock_special+0x88/0x4c0 kernel/rcu/tree_plugin.h:682
Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 a9 4e 93 7e 41 f7 c6 00 00 f0 00 74 45 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
RSP: 0018:ffffc900001f0c60 EFLAGS: 00000206
RAX: 7b452cd74dfe8100 RBX: 1ffff9200003e194 RCX: 7b452cd74dfe8100
RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780
RBP: ffffc900001f0d48 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8cd35400
R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000002
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
rebalance_domains+0x89c/0x9d0 kernel/sched/fair.c:11794
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__preempt_count_add arch/x86/include/asm/preempt.h:80 [inline]
RIP: 0010:rcu_is_watching+0x8/0xb0 kernel/rcu/tree.c:699
Code: e8 dd 77 fd 08 48 c7 c7 00 6a d3 8c 4c 89 f6 e8 5e 75 e1 02 e9 53 ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 41 57 41 56 <53> 65 ff 05 28 1a 94 7e e8 bb 8d fd 08 89 c3 83 f8 08 73 60 49 bf
RSP: 0018:ffffc90004f17788 EFLAGS: 00000257
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff81678a9b
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e4a84e8
RBP: ffffc90004f178b8 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8192c2d6
R13: dffffc0000000000 R14: 00007f846f18ebe9 R15: 1ffff920009e2f00
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0xba/0x8b0 kernel/locking/lockdep.c:5765
rcu_lock_release include/linux/rcupdate.h:344 [inline]
rcu_read_unlock include/linux/rcupdate.h:819 [inline]
is_bpf_text_address+0x28f/0x2a0 kernel/bpf/core.c:743
kernel_text_address+0xa0/0xd0 kernel/extable.c:125
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x5d/0xc0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0x11d/0x190 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
task_work_add+0xd3/0x440 kernel/task_work.c:77
fput+0xdd/0x1a0 fs/file_table.c:440
filp_close+0x10f/0x150 fs/open.c:1545
__range_close fs/file.c:700 [inline]
__close_range+0x342/0x630 fs/file.c:757
__do_sys_close_range fs/open.c:1597 [inline]
__se_sys_close_range fs/open.c:1594 [inline]
__x64_sys_close_range+0x7a/0x90 fs/open.c:1594
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f846f18ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffda256b568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 000000000002ea3b RCX: 00007f846f18ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002a256b85f
R10: 0000001b2cc20000 R11: 0000000000000246 R12: 00007f846f3b5fac
R13: 00007f846f3b5fa0 R14: ffffffffffffffff R15: 0000000000000005
</TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10505 jiffies! g28697 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: Possible timer handling issue on cpu=1 timer-softirq=9832
rcu: rcu_preempt kthread starved for 10506 jiffies! g28697 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:I stack:27528 pid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5381 [inline]
__schedule+0x14d2/0x44d0 kernel/sched/core.c:6700
schedule+0xbd/0x170 kernel/sched/core.c:6774
schedule_timeout+0x160/0x280 kernel/time/timer.c:2167
rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8605 Comm: syz.0.2575 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:get_current arch/x86/include/asm/current.h:41 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x8/0x60 kernel/kcov.c:215
Code: 00 00 f3 0f 1e fa 53 48 89 fb e8 13 00 00 00 48 8b 3d 8c f1 c4 0c 48 89 de 5b e9 63 75 56 00 cc cc cc f3 0f 1e fa 48 8b 04 24 <65> 48 8b 0d 60 24 7e 7e 65 8b 15 61 24 7e 7e 81 e2 00 01 ff 00 74
RSP: 0018:ffffc900001f0458 EFLAGS: 00000046
RAX: ffffffff81ac380f RBX: 0000000000000510 RCX: ffff8880234c1e00
RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc900001f0550 R08: dffffc0000000000 R09: 1ffffffff21b46a4
R10: dffffc0000000000 R11: fffffbfff21b46a5 R12: ffffc900001f0840
R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000010
FS: 0000555580c71500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2d863fff CR3: 0000000074441000 CR4: 00000000003506e0
Call Trace:
<IRQ>
perf_prepare_sample+0x40f/0x1c40 kernel/events/core.c:7771
__perf_event_output kernel/events/core.c:7957 [inline]
perf_event_output_forward+0x152/0x3a0 kernel/events/core.c:7978
__perf_event_overflow+0x447/0x630 kernel/events/core.c:9703
perf_swevent_overflow kernel/events/core.c:9779 [inline]
perf_swevent_event+0x2f5/0x5c0 kernel/events/core.c:-1
perf_tp_event+0x4f9/0x13a0 kernel/events/core.c:10329
perf_trace_run_bpf_submit+0xf4/0x1c0 kernel/events/core.c:10253
perf_trace_preemptirq_template+0x281/0x340 include/trace/events/preemptirq.h:14
trace_irq_enable+0xbf/0xe0 include/trace/events/preemptirq.h:40
trace_hardirqs_on+0x18/0x40 kernel/trace/trace_preemptirq.c:56
asm_sysvec_irq_work+0x1a/0x20 arch/x86/include/asm/idtentry.h:723
RIP: 0010:rcu_read_unlock_special+0x88/0x4c0 kernel/rcu/tree_plugin.h:682
Code: f1 f1 f1 00 f2 f2 f2 4a 89 04 2b 66 42 c7 44 2b 09 f3 f3 42 c6 44 2b 0b f3 65 44 8b 35 a9 4e 93 7e 41 f7 c6 00 00 f0 00 74 45 <48> c7 44 24 40 0e 36 e0 45 4a c7 04 2b 00 00 00 00 66 42 c7 44 2b
RSP: 0018:ffffc900001f0c60 EFLAGS: 00000206
RAX: 7b452cd74dfe8100 RBX: 1ffff9200003e194 RCX: 7b452cd74dfe8100
RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780
RBP: ffffc900001f0d48 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8cd35400
R13: dffffc0000000000 R14: 0000000000000246 R15: 0000000000000002
__rcu_read_unlock+0x7c/0xd0 kernel/rcu/tree_plugin.h:426
rcu_read_unlock include/linux/rcupdate.h:818 [inline]
rebalance_domains+0x89c/0x9d0 kernel/sched/fair.c:11794
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__preempt_count_add arch/x86/include/asm/preempt.h:80 [inline]
RIP: 0010:rcu_is_watching+0x8/0xb0 kernel/rcu/tree.c:699
Code: e8 dd 77 fd 08 48 c7 c7 00 6a d3 8c 4c 89 f6 e8 5e 75 e1 02 e9 53 ff ff ff 66 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 41 57 41 56 <53> 65 ff 05 28 1a 94 7e e8 bb 8d fd 08 89 c3 83 f8 08 73 60 49 bf
RSP: 0018:ffffc90004f17788 EFLAGS: 00000257
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff81678a9b
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff8e4a84e8
RBP: ffffc90004f178b8 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffffffff8192c2d6
R13: dffffc0000000000 R14: 00007f846f18ebe9 R15: 1ffff920009e2f00
trace_lock_release include/trace/events/lock.h:69 [inline]
lock_release+0xba/0x8b0 kernel/locking/lockdep.c:5765
rcu_lock_release include/linux/rcupdate.h:344 [inline]
rcu_read_unlock include/linux/rcupdate.h:819 [inline]
is_bpf_text_address+0x28f/0x2a0 kernel/bpf/core.c:743
kernel_text_address+0xa0/0xd0 kernel/extable.c:125
__kernel_text_address+0xd/0x30 kernel/extable.c:79
unwind_get_return_address+0x5d/0xc0 arch/x86/kernel/unwind_orc.c:369
arch_stack_walk+0x11d/0x190 arch/x86/kernel/stacktrace.c:26
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
task_work_add+0xd3/0x440 kernel/task_work.c:77
fput+0xdd/0x1a0 fs/file_table.c:440
filp_close+0x10f/0x150 fs/open.c:1545
__range_close fs/file.c:700 [inline]
__close_range+0x342/0x630 fs/file.c:757
__do_sys_close_range fs/open.c:1597 [inline]
__se_sys_close_range fs/open.c:1594 [inline]
__x64_sys_close_range+0x7a/0x90 fs/open.c:1594
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f846f18ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffda256b568 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 000000000002ea3b RCX: 00007f846f18ebe9
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 00000002a256b85f
R10: 0000001b2cc20000 R11: 0000000000000246 R12: 00007f846f3b5fac
R13: 00007f846f3b5fa0 R14: ffffffffffffffff R15: 0000000000000005
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Dec 22, 2025, 4:06:20 AM12/22/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 5fa4793a2d2d Linux 6.6.119
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13988b58580000
kernel config: https://syzkaller.appspot.com/x/.config?x=691a6769a86ac817
dashboard link: https://syzkaller.appspot.com/bug?extid=793af646fd66df0b254e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=147ac3c2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12ab3f14580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/857fe583cdec/disk-5fa4793a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ed4d3c1402bc/vmlinux-5fa4793a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40296d968c3d/bzImage-5fa4793a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+793af6...@syzkaller.appspotmail.com
rcu: INFO: rcu_preempt self-detected stall on CPU
rcu: 1-....: (10498 ticks this GP) idle=de6c/1/0x4000000000000000 softirq=11972/11972 fqs=5249
rcu: hardirqs softirqs csw/system
rcu: number: 1420275 0 0
rcu: cputime: 14956 37523 73 ==> 52500(ms)
rcu: (t=10502 jiffies g=10657 q=829 ncpus=2)
CPU: 1 PID: 5925 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 0a d9 1a f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> e2 53 ea f6 65 8b 05 d3 9a 92 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc900001f09e0 EFLAGS: 00000206
RAX: e9ca711d471bf700 RBX: 0000000000000a06 RCX: e9ca711d471bf700
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc900001f0a68 R08: ffffffff90d945c7 R09: 1ffffffff21b28b8
R10: dffffc0000000000 R11: fffffbfff21b28b9 R12: dffffc0000000000
R13: ffff88801bb2b8f8 R14: ffffffff9705e390 R15: 1ffff9200003e13c
FS: 000055555645f500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
Call Trace:
<IRQ>
debug_object_assert_init+0x1f1/0x2f0 lib/debugobjects.c:900
debug_timer_assert_init kernel/time/timer.c:792 [inline]
debug_assert_init kernel/time/timer.c:837 [inline]
__timer_delete+0x3f/0x290 kernel/time/timer.c:1321
del_timer include/linux/timer.h:213 [inline]
lapb_start_t1timer net/lapb/lapb_timer.c:38 [inline]
lapb_t1timer_expiry+0x6a6/0xab0 net/lapb/lapb_timer.c:202
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x52d/0x7d0 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
Code: 44 24 20 f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 63 bf 01 00 00 00 e8 8b b3 eb f6 e8 26 3a 1c f7 fb bf 01 00 00 00 <e8> db b5 ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24
RSP: 0018:ffffc90003367280 EFLAGS: 00000282
RAX: e9ca711d471bf700 RBX: 0000000000000000 RCX: e9ca711d471bf700
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc90003367330 R08: ffffffff8e4a212f R09: 1ffffffff1c94425
R10: dffffc0000000000 R11: fffffbfff1c94426 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200066ce50
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:unwind_next_frame+0x38/0x2970 arch/x86/kernel/unwind_orc.c:470
Code: 48 81 ec 98 00 00 00 49 89 fc 49 bd 00 00 00 00 00 fc ff df e8 59 ed 4a 00 49 8d 5c 24 48 48 89 d8 48 c1 e8 03 48 89 44 24 40 <42> 80 3c 28 00 74 08 48 89 df e8 29 5b a2 00 48 89 5c 24 20 4d 8b
RSP: 0018:ffffc900033673f8 EFLAGS: 00000a02
RAX: 1ffff9200066cea2 RBX: ffffc90003367510 RCX: ffff888077b0da00
RDX: 0000000000000000 RSI: ffffffff81d13fcc RDI: ffffc900033674c8
RBP: ffffc90003367550 R08: ffffc90003367590 R09: 0000000000000001
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc900033674c8
R13: dffffc0000000000 R14: ffffffff81746d20 R15: ffffc900033674c8
arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
save_stack+0xf7/0x1f0 mm/page_owner.c:128
__set_page_owner+0x1d/0x60 mm/page_owner.c:192
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
__stack_depot_save+0x435/0x630 lib/stackdepot.c:410
kasan_save_stack+0x4d/0x60 mm/kasan/common.c:46
__range_close fs/file.c:698 [inline]
__close_range+0x342/0x630 fs/file.c:755
__do_sys_close_range fs/open.c:1599 [inline]
__se_sys_close_range fs/open.c:1596 [inline]
__x64_sys_close_range+0x7a/0x90 fs/open.c:1596
RAX: ffffffffffffffda RBX: 000000000001af25 RCX: 00007f2db5f8f749
R10: 0000001b33520000 R11: 0000000000000246 R12: 00007f2db61e5fac
R13: 00007f2db61e5fa0 R14: ffffffffffffffff R15: 0000000000000005
</TASK>
---
HEAD commit: 5fa4793a2d2d Linux 6.6.119
git tree: linux-6.6.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13988b58580000
kernel config: https://syzkaller.appspot.com/x/.config?x=691a6769a86ac817
dashboard link: https://syzkaller.appspot.com/bug?extid=793af646fd66df0b254e
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=147ac3c2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12ab3f14580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/857fe583cdec/disk-5fa4793a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/ed4d3c1402bc/vmlinux-5fa4793a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40296d968c3d/bzImage-5fa4793a.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+793af6...@syzkaller.appspotmail.com
rcu: 1-....: (10498 ticks this GP) idle=de6c/1/0x4000000000000000 softirq=11972/11972 fqs=5249
rcu: hardirqs softirqs csw/system
rcu: number: 1420275 0 0
rcu: cputime: 14956 37523 73 ==> 52500(ms)
rcu: (t=10502 jiffies g=10657 q=829 ncpus=2)
CPU: 1 PID: 5925 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa9/0x110 kernel/locking/spinlock.c:194
Code: 74 05 e8 0a d9 1a f7 48 c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f6 44 24 21 02 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> e2 53 ea f6 65 8b 05 d3 9a 92 75 85 c0 74 3c 48 c7 04 24 0e 36
RSP: 0018:ffffc900001f09e0 EFLAGS: 00000206
RAX: e9ca711d471bf700 RBX: 0000000000000a06 RCX: e9ca711d471bf700
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc900001f0a68 R08: ffffffff90d945c7 R09: 1ffffffff21b28b8
R10: dffffc0000000000 R11: fffffbfff21b28b9 R12: dffffc0000000000
R13: ffff88801bb2b8f8 R14: ffffffff9705e390 R15: 1ffff9200003e13c
FS: 000055555645f500(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000076cb1000 CR4: 00000000003506e0
Call Trace:
<IRQ>
debug_object_assert_init+0x1f1/0x2f0 lib/debugobjects.c:900
debug_timer_assert_init kernel/time/timer.c:792 [inline]
debug_assert_init kernel/time/timer.c:837 [inline]
__timer_delete+0x3f/0x290 kernel/time/timer.c:1321
del_timer include/linux/timer.h:213 [inline]
lapb_start_t1timer net/lapb/lapb_timer.c:38 [inline]
lapb_t1timer_expiry+0x6a6/0xab0 net/lapb/lapb_timer.c:202
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1752 [inline]
__run_timers+0x52d/0x7d0 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:preempt_schedule_irq+0xb0/0x140 kernel/sched/core.c:7009
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
Code: 44 24 20 f6 44 24 21 02 74 0b 0f 0b 48 f7 03 08 00 00 00 74 63 bf 01 00 00 00 e8 8b b3 eb f6 e8 26 3a 1c f7 fb bf 01 00 00 00 <e8> db b5 ff ff 48 c7 44 24 40 00 00 00 00 9c 8f 44 24 40 8b 44 24
RSP: 0018:ffffc90003367280 EFLAGS: 00000282
RAX: e9ca711d471bf700 RBX: 0000000000000000 RCX: e9ca711d471bf700
RDX: dffffc0000000000 RSI: ffffffff8aaabce0 RDI: 0000000000000001
RBP: ffffc90003367330 R08: ffffffff8e4a212f R09: 1ffffffff1c94425
R10: dffffc0000000000 R11: fffffbfff1c94426 R12: 0000000000000000
R13: 0000000000000000 R14: dffffc0000000000 R15: 1ffff9200066ce50
irqentry_exit+0x67/0x70 kernel/entry/common.c:438
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:unwind_next_frame+0x38/0x2970 arch/x86/kernel/unwind_orc.c:470
Code: 48 81 ec 98 00 00 00 49 89 fc 49 bd 00 00 00 00 00 fc ff df e8 59 ed 4a 00 49 8d 5c 24 48 48 89 d8 48 c1 e8 03 48 89 44 24 40 <42> 80 3c 28 00 74 08 48 89 df e8 29 5b a2 00 48 89 5c 24 20 4d 8b
RSP: 0018:ffffc900033673f8 EFLAGS: 00000a02
RAX: 1ffff9200066cea2 RBX: ffffc90003367510 RCX: ffff888077b0da00
RDX: 0000000000000000 RSI: ffffffff81d13fcc RDI: ffffc900033674c8
RBP: ffffc90003367550 R08: ffffc90003367590 R09: 0000000000000001
R10: 0000000000000004 R11: 0000000000000000 R12: ffffc900033674c8
R13: dffffc0000000000 R14: ffffffff81746d20 R15: ffffc900033674c8
arch_stack_walk+0x144/0x190 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122
save_stack+0xf7/0x1f0 mm/page_owner.c:128
__set_page_owner+0x1d/0x60 mm/page_owner.c:192
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
__stack_depot_save+0x435/0x630 lib/stackdepot.c:410
kasan_save_stack+0x4d/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
task_work_add+0xd3/0x440 kernel/task_work.c:77
fput+0xdd/0x1a0 fs/file_table.c:440
filp_close+0x10f/0x150 fs/open.c:1547
task_work_add+0xd3/0x440 kernel/task_work.c:77
fput+0xdd/0x1a0 fs/file_table.c:440
__range_close fs/file.c:698 [inline]
__close_range+0x342/0x630 fs/file.c:755
__do_sys_close_range fs/open.c:1599 [inline]
__se_sys_close_range fs/open.c:1596 [inline]
__x64_sys_close_range+0x7a/0x90 fs/open.c:1596
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f2db5f8f749
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc9216e618 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4
RAX: ffffffffffffffda RBX: 000000000001af25 RCX: 00007f2db5f8f749
RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000001 R09: 000000029216e90f
R10: 0000001b33520000 R11: 0000000000000246 R12: 00007f2db61e5fac
R13: 00007f2db61e5fa0 R14: ffffffffffffffff R15: 0000000000000005
</TASK>
---
Reply all
Reply to author
Forward
0 new messages