syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P5833/1:b..l P7368/1:b..l P6423/1:b..l P7361/1:b..l
rcu: 	(detected by 1, t=10502 jiffies, g=26325, q=413 ncpus=2)
task:syz.3.277       state:R  running task     stack:26632 pid:7361  ppid:5765   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:lock_acquire+0x1f2/0x410 kernel/locking/lockdep.c:5758
Code: 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 0f 85 f5 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 04 3c 00 00 00 00 66 43 c7 44 3c 09 00 00 43 c6 44 3c 0b 00
RSP: 0018:ffffc9000c90f1c0 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: 94293f9eddcd4600
RDX: 0000000000000000 RSI: ffffffff8aaace60 RDI: ffffffff8afc6f80
RBP: ffffc9000c90f2c8 R08: dffffc0000000000 R09: 1ffffffff21b28a0
R10: dffffc0000000000 R11: fffffbfff21b28a1 R12: 1ffff92001921e44
R13: ffffffff8cd2ff20 R14: 0000000000000246 R15: dffffc0000000000
 rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 rcu_read_lock include/linux/rcupdate.h:786 [inline]
 page_ext_get+0x3e/0x2b0 mm/page_ext.c:508
 __page_table_check_zero+0x138/0x4b0 mm/page_table_check.c:148
 prep_new_page mm/page_alloc.c:1561 [inline]
 get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
 __folio_alloc+0x10/0x20 mm/page_alloc.c:4489
 vma_alloc_folio+0x47a/0x8f0 mm/mempolicy.c:2242
 shmem_alloc_folio+0x179/0x230 mm/shmem.c:1679
 shmem_alloc_and_acct_folio+0x189/0x630 mm/shmem.c:1704
 shmem_get_folio_gfp+0xcde/0x2ac0 mm/shmem.c:2041
 shmem_get_folio mm/shmem.c:2164 [inline]
 shmem_write_begin+0xf2/0x420 mm/shmem.c:2706
 generic_perform_write+0x2fb/0x5b0 mm/filemap.c:4031
 shmem_file_write_iter+0xfb/0x120 mm/shmem.c:2883
 call_write_iter include/linux/fs.h:2018 [inline]
 new_sync_write fs/read_write.c:491 [inline]
 vfs_write+0x43b/0x940 fs/read_write.c:584
 ksys_write+0x147/0x250 fs/read_write.c:637
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f8c8eb8e1ff
RSP: 002b:00007f8c8fafedf0 EFLAGS: 00000293 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000400000 RCX: 00007f8c8eb8e1ff
RDX: 0000000000400000 RSI: 00007f8c849f7000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 00000000000010fd
R10: 0000200000002242 R11: 0000000000000293 R12: 0000000000000003
R13: 00007f8c8fafeef0 R14: 00007f8c8fafeeb0 R15: 00007f8c849f7000
 </TASK>
task:syz-executor    state:R  running task     stack:20760 pid:6423  ppid:6405   flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 preempt_schedule_common+0x82/0xc0 kernel/sched/core.c:6866
 preempt_schedule+0xab/0xc0 kernel/sched/core.c:6890
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk_64.S:45
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x3a/0x40 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 copy_pte_range mm/memory.c:1107 [inline]
 copy_pmd_range mm/memory.c:1168 [inline]
 copy_pud_range mm/memory.c:1205 [inline]
 copy_p4d_range mm/memory.c:1229 [inline]
 copy_page_range+0x2b7c/0x3600 mm/memory.c:1323
 dup_mmap kernel/fork.c:764 [inline]
 dup_mm kernel/fork.c:1692 [inline]
 copy_mm+0x11a8/0x1ca0 kernel/fork.c:1741
 copy_process+0x16d3/0x3d70 kernel/fork.c:2506
 kernel_clone+0x21b/0x840 kernel/fork.c:2914
 __do_sys_clone kernel/fork.c:3057 [inline]
 __se_sys_clone kernel/fork.c:3041 [inline]
 __x64_sys_clone+0x18c/0x1e0 kernel/fork.c:3041
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f6d3f585e93
RSP: 002b:00007ffc658bd248 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6d3f585e93
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 000055557c4337d0 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000000927c0 R14: 0000000000033b4e R15: 00007ffc658bd3e0
 </TASK>
task:syz.1.280       state:R  running task     stack:27592 pid:7368  ppid:5776   flags:0x00004002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:692
RIP: 0010:mas_validate_parent_slot lib/maple_tree.c:7042 [inline]
RIP: 0010:mt_validate+0x7ef/0x4530 lib/maple_tree.c:7230
Code: 30 f7 eb 26 e8 b2 5e 19 f7 41 89 c4 31 ff 89 c6 e8 96 7f 30 f7 45 85 e4 0f 84 a1 00 00 00 e8 d8 7b 30 f7 eb 05 e8 d1 7b 30 f7 <48> 89 df 4c 89 f6 e8 d6 7d 30 f7 4c 8b a4 24 38 01 00 00 49 39 de
RSP: 0018:ffffc9000c487760 EFLAGS: 00000293
RAX: ffffffff8a5514c7 RBX: 0000000000000009 RCX: ffff88807a3b9e00
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000c487930 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffffbfff2e5551c R12: 0000000000000001
R13: 0000000000000000 R14: 0000000000000001 R15: ffff88802e44bc98
 validate_mm+0xb1/0x420 mm/mmap.c:288
 mmap_region+0xeaa/0x2020 mm/mmap.c:2947
 do_mmap+0x92f/0x10a0 mm/mmap.c:1385
 vm_mmap_pgoff+0x1c0/0x400 mm/util.c:556
 ksys_mmap_pgoff+0x520/0x700 mm/mmap.c:1431
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f32a9f8f783
RSP: 002b:00007ffc30837678 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 0000001b2cd64000 RCX: 00007f32a9f8f783
RDX: 0000000000000003 RSI: 00000000003c0000 RDI: 0000001b2cd64000
RBP: 0000000000400000 R08: 0000000000000004 R09: 0000000000040000
R10: 0000000000100001 R11: 0000000000000246 R12: 0000000000000038
R13: 00000000000927c0 R14: 0000000000033b89 R15: 00007ffc30837960
 </TASK>
task:kworker/0:4     state:R  running task     stack:23384 pid:5833  ppid:2      flags:0x00004000
Workqueue: events_power_efficient gc_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 preempt_schedule_irq+0xb5/0x140 kernel/sched/core.c:7009
 irqentry_exit+0x67/0x70 kernel/entry/common.c:438
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:seqcount_lockdep_reader_access+0x17f/0x1c0 include/linux/seqlock.h:105
Code: f8 4d 85 e4 75 16 e8 80 c1 e0 f8 eb 15 e8 79 c1 e0 f8 e8 04 a8 c2 01 4d 85 e4 74 ea e8 6a c1 e0 f8 fb 48 c7 04 24 0e 36 e0 45 <4b> c7 04 3e 00 00 00 00 66 43 c7 44 3e 09 00 00 43 c6 44 3e 0b 00
RSP: 0018:ffffc9000496f9a0 EFLAGS: 00000293
RAX: ffffffff88a4cf56 RBX: 0000000000000000 RCX: ffff888029ff1e00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffffc9000496fa50 R08: ffffffff90d94597 R09: 1ffffffff21b28b2
R10: dffffc0000000000 R11: fffffbfff21b28b3 R12: 0000000000000200
R13: dffffc0000000000 R14: 1ffff9200092df34 R15: dffffc0000000000
 nf_conntrack_get_ht include/net/netfilter/nf_conntrack.h:350 [inline]
 gc_worker+0x317/0x14b0 net/netfilter/nf_conntrack_core.c:1504
 process_one_work kernel/workqueue.c:2634 [inline]
 process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
 worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: rcu_preempt kthread starved for 10628 jiffies! g26325 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:26728 pid:17    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 schedule_timeout+0x160/0x280 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
 rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:pv_native_safe_halt+0x13/0x20 arch/x86/kernel/paravirt.c:148
Code: cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d 23 bb 40 00 f3 0f 1e fa fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc 66 0f 1f 00 55 41 57 41 56
RSP: 0018:ffffc90000187de0 EFLAGS: 000002c2
RAX: 884188844359cc00 RBX: ffffffff8161881b RCX: 884188844359cc00
RDX: 0000000000000001 RSI: ffffffff8aaabce0 RDI: ffffffff8afc6f80
RBP: ffffc90000187f20 R08: ffff8880b8f36b2b R09: 1ffff110171e6d65
R10: dffffc0000000000 R11: ffffed10171e6d66 R12: ffffffff8e4a2128
R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff1100374c780
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6d403156c0 CR3: 000000005e569000 CR4: 00000000003506e0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
 default_idle+0x13/0x20 arch/x86/kernel/process.c:753
 default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
 cpuidle_idle_call kernel/sched/idle.c:170 [inline]
 do_idle+0x1eb/0x510 kernel/sched/idle.c:282
 cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:380
 start_secondary+0xee/0xf0 arch/x86/kernel/smpboot.c:323
 secondary_startup_64_no_verify+0x179/0x17b
 </TASK>