syzbot
INFO: rcu detected stall in vhost_task_fn
Status:
upstream: reported on 2026/11/04 10:46
Reported-by: syzbot+936577cc9fcb61a780e3@syzkaller.appspotmail.com
First crash: 1d19h, last: 1d19h
Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: (detected by 0, t=10502 jiffies, g=12977, q=449 ncpus=1)
rcu: All QSes seen, last rcu_preempt kthread activity 10502 (4294960723-4294950221), jiffies_till_next_fqs=1, root ->qsmask 0x0
rcu: rcu_preempt kthread starved for 10502 jiffies! g12977 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:27664 pid:17 ppid:2 flags:0x00004000
Call Trace:
<TASK>
context_switch kernel/sched/core.c:5393 [inline]
__schedule+0x156f/0x4720 kernel/sched/core.c:6722
schedule+0xbd/0x170 kernel/sched/core.c:6796
schedule_timeout+0x188/0x2d0 kernel/time/timer.c:2168
rcu_gp_fqs_loop+0x30d/0x15e0 kernel/rcu/tree.c:1667
rcu_gp_kthread+0x9e/0x400 kernel/rcu/tree.c:1866
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 PID: 6098 Comm: vhost-6097 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026
RIP: 0010:variable_ffs arch/x86/include/asm/bitops.h:319 [inline]
RIP: 0010:handle_softirqs+0x1ab/0x820 kernel/softirq.c:566
Code: 89 64 24 34 0f b7 db 48 c7 c7 20 c8 e9 8a e8 9c e3 44 09 65 66 c7 05 a2 a2 b0 7e 00 00 e8 0d 3f 3b 00 fb 49 c7 c5 c0 a0 e0 8d <89> 5c 24 3c b8 ff ff ff ff 0f bc 44 24 3c 41 89 c6 41 ff c6 0f 84
RSP: 0018:ffffc90000007e40 EFLAGS: 00000286
RAX: 0574337b90ed9c00 RBX: 0000000000000100 RCX: 0574337b90ed9c00
RDX: dffffc0000000000 RSI: ffffffff8aead140 RDI: ffffffff8b3c5260
RBP: ffffc90000007f50 R08: ffffffff92223627 R09: 1ffffffff24446c4
R10: dffffc0000000000 R11: fffffbfff24446c5 R12: 000000000000000a
R13: ffffffff8de0a0c0 R14: dffffc0000000000 R15: ffff88802ed7da00
FS: 00007fef95f076c0(0000) GS:ffff8880b8c00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 000000002ad10000 CR4: 00000000003506f0
Call Trace:
<IRQ>
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:internal_get_user_pages_fast+0x204d/0x27a0 mm/gup.c:3205
Code: ff df e9 48 ff ff ff e8 81 31 be ff e8 5c 35 ce 08 48 83 bc 24 b0 00 00 00 00 74 a6 e8 6c 31 be ff fb 83 bc 24 84 00 00 00 00 <48> 8b 44 24 70 75 07 e8 57 31 be ff eb 73 48 8b 8c 24 d8 00 00 00
RSP: 0018:ffffc90004cc7840 EFLAGS: 00000206
RAX: ffffffff81c9ad34 RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc900186c5000 RSI: 0000000000000037 RDI: 0000000000000038
RBP: ffffc90004cc7a50 R08: ffffffff92223627 R09: 1ffffffff24446c4
R10: dffffc0000000000 R11: fffffbfff24446c5 R12: 0000000000000000
R13: dffffc0000000000 R14: 0000000000001000 R15: ffff888025855000
set_bit_to_user drivers/vhost/vhost.c:2294 [inline]
log_write+0xc3/0x370 drivers/vhost/vhost.c:2320
vhost_update_used_flags+0x1c3/0x280 drivers/vhost/vhost.c:2439
vhost_disable_notify+0xad/0x1a0 drivers/vhost/vhost.c:3000
vhost_vsock_handle_tx_kick+0x159/0xdd0 drivers/vhost/vsock.c:487
vhost_run_work_list+0x13d/0x1b0 drivers/vhost/vhost.c:430
vhost_task_fn+0x2ae/0x450 kernel/vhost_task.c:49
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
</TASK>
* Struck through repros no longer work on HEAD.