INFO: rcu detected stall in cfg80211_wiphy_work (2)

Status: upstream: reported C repro on 2026/07/18 16:31
Reported-by: syzbot+b753c7154176e6621555@syzkaller.appspotmail.com
First crash: 78d, last: 7d05h
▶ ▼ Similar bugs (5)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in cfg80211_wiphy_work wireless 1 syz, C done done 4 997d 1148d 0/29 auto-obsoleted due to no activity on 2024/04/20 07:53
linux-5.15 INFO: rcu detected stall in cfg80211_wiphy_work 1 1 234d 234d 0/3 auto-obsoleted due to no activity on 2026/05/23 07:13
linux-6.1 INFO: rcu detected stall in cfg80211_wiphy_work 1 1 192d 192d 0/3 auto-obsoleted due to no activity on 2026/07/04 20:13
upstream INFO: rcu detected stall in cfg80211_wiphy_work (2) prio:normal wireless 1 syz, C done error 101 50d 685d 0/29 upstream: reported C repro on 2024/11/18 08:54
linux-5.15 INFO: rcu detected stall in cfg80211_wiphy_work (2) origin:lts-only 1 syz 4 3d06h 119d 0/3 upstream: reported syz repro on 2026/06/08 04:12

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (2 GPs behind) idle=5eb4/1/0x4000000000000000 softirq=9520/9522 fqs=8
	(detected by 1, t=10502 jiffies, g=9777, q=462 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 58 Comm: kworker/u4:4 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound cfg80211_wiphy_work
RIP: 0010:__lock_acquire+0x3bd/0x7c40 kernel/locking/lockdep.c:4998
Code: 24 40 42 0f b6 04 01 84 c0 0f 85 a4 62 00 00 48 8b 5d 18 b8 00 e0 ff ff 41 23 46 20 41 81 e7 ff 1f 00 00 44 09 f8 41 89 46 20 <49> 8d 7e 08 48 89 f8 48 c1 e8 03 42 80 3c 00 00 74 0f e8 6c 74 6f
RSP: 0018:ffffc90000007940 EFLAGS: 00000006
RAX: 00000000000a4060 RBX: ffffffff81722209 RCX: 1ffff110038d38f9
RDX: 0000000000000060 RSI: 0000000000000000 RDI: ffff8880b8e2a5d8
RBP: ffffc90000007b70 R08: dffffc0000000000 R09: 0000000000000001
R10: dffffc0000000000 R11: fffffbfff1c4168e R12: 0000000000000000
R13: ffff8880b8e2a5d8 R14: ffff88801c69c7a8 R15: 0000000000000060
FS:  0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f81c52df040 CR3: 00000000285fc000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5678
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irq+0xab/0xf0 kernel/locking/spinlock.c:170
 __run_hrtimer kernel/time/hrtimer.c:1755 [inline]
 __hrtimer_run_queues+0x5e9/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_interrupt+0x399/0x980 kernel/time/hrtimer.c:1877
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline]
 __sysvec_apic_timer_interrupt+0x153/0x5a0 arch/x86/kernel/apic/apic.c:1124
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:memset_erms+0xb/0x10 arch/x86/lib/memset_64.S:65
Code: 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 f3 aa <4c> 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01 01 01
RSP: 0018:ffffc90001596d78 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ffffc90001596e28 RCX: 0000000000000000
RDX: 0000000000000010 RSI: 0000000000000000 RDI: ffffc90001596e88
RBP: dffffc0000000000 R08: ffffc90001596e87 R09: ffffc90001596e78
R10: dffffc0000000000 R11: fffff520002b2dd1 R12: dffffc0000000000
R13: ffffc90001598000 R14: ffffc90001596e60 R15: ffffc90001596e5d
 unwind_next_frame+0x8da/0x1fd0 arch/x86/kernel/unwind_orc.c:546
 arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
 kvfree_call_rcu+0x103/0x890 kernel/rcu/tree.c:3405
 cfg80211_update_known_bss+0x184/0xb60 net/wireless/scan.c:-1
 cfg80211_bss_update+0x156/0x21a0 net/wireless/scan.c:1847
 cfg80211_inform_single_bss_frame_data net/wireless/scan.c:2509 [inline]
 cfg80211_inform_bss_frame_data+0xa77/0x1390 net/wireless/scan.c:2542
 ieee80211_bss_info_update+0x6ef/0xbf0 net/mac80211/scan.c:190
 ieee80211_rx_bss_info net/mac80211/ibss.c:1120 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1609 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1931/0x2eb0 net/mac80211/ibss.c:1638
 ieee80211_iface_process_skb net/mac80211/iface.c:1685 [inline]
 ieee80211_iface_work+0x72c/0xc70 net/mac80211/iface.c:1739
 cfg80211_wiphy_work+0x224/0x260 net/wireless/core.c:433
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: rcu_preempt kthread starved for 10486 jiffies! g9777 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27920 pid:16    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5246 [inline]
 __schedule+0x107f/0x4030 kernel/sched/core.c:6563
 schedule+0xb9/0x180 kernel/sched/core.c:6639
 schedule_timeout+0x184/0x2d0 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x303/0x1350 kernel/rcu/tree.c:1706
 rcu_gp_kthread+0x99/0x3b0 kernel/rcu/tree.c:1905
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 PID: 9 Comm: kworker/u4:0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:424 [inline]
RIP: 0010:smp_call_function_many_cond+0x1148/0x1250 kernel/smp.c:998
Code: 41 8b 1f 89 de 83 e6 01 31 ff e8 53 02 0b 00 83 e3 01 48 bb 00 00 00 00 00 fc ff df 75 0a e8 df fe 0a 00 e9 34 ff ff ff f3 90 <41> 0f b6 04 1c 84 c0 75 14 41 f7 07 01 00 00 00 0f 84 17 ff ff ff
RSP: 0018:ffffc900000e7800 EFLAGS: 00000293
RAX: ffffffff81773423 RBX: dffffc0000000000 RCX: ffff88813feb0000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900000e7960 R08: ffffffff90b0f247 R09: 1ffffffff2161e48
R10: dffffc0000000000 R11: fffffbfff2161e49 R12: 1ffff110171c85f5
R13: ffff8880b8f3bd80 R14: 0000000000000000 R15: ffff8880b8e42fa8
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000300 CR3: 000000000c88e000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 on_each_cpu_cond_mask+0x3b/0x80 kernel/smp.c:1165
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1574 [inline]
 text_poke_bp_batch+0x5ae/0x850 arch/x86/kernel/alternative.c:1836
 text_poke_flush arch/x86/kernel/alternative.c:1965 [inline]
 text_poke_finish+0x16/0x30 arch/x86/kernel/alternative.c:1972
 arch_jump_label_transform_apply+0x13/0x20 arch/x86/kernel/jump_label.c:146
 static_key_enable_cpuslocked+0x11f/0x240 kernel/jump_label.c:207
 static_key_enable+0x16/0x20 kernel/jump_label.c:220
 toggle_allocation_gate+0xba/0x470 mm/kfence/core.c:821
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/28 01:16 linux-6.1.y 1a8763b93150 a3c7249d .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: rcu detected stall in cfg80211_wiphy_work
2026/07/18 16:30 linux-6.1.y 090666d3cc90 72524a66 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan INFO: rcu detected stall in cfg80211_wiphy_work
* Struck through repros no longer work on HEAD.