syzbot

 sign-in | mailing list | source | docs | 🏰
🐞 Open [1330]
≡ Subsystems
🐞 Fixed [7140]
🐞 Invalid [18879]
⬇ Missing Backports [220]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
Total Repo Heatmap Subsystems Heatmap
✨ AI
💬 Send us feedback

INFO: rcu detected stall in sys_unlinkat (2)

Status: auto-obsoleted due to no activity on 2023/11/25 04:08
Subsystems: tomoyo
[Documentation on labels]
First crash: 1012d, last: 1012d
▶ ▼ Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in sys_unlinkat net ext4 1 4 1147d 1349d 0/29 auto-obsoleted due to no activity on 2023/07/13 16:11
upstream INFO: rcu detected stall in sys_unlinkat (3) tomoyo mm 1 31 338d 363d 0/29 auto-obsoleted due to no activity on 2025/10/09 16:45
linux-5.15 INFO: rcu detected stall in sys_unlinkat 1 1 718d 718d 0/3 auto-obsoleted due to no activity on 2024/09/24 13:32
linux-6.1 INFO: rcu detected stall in sys_unlinkat 1 syz error 1 39d 39d 0/3 upstream: reported syz repro on 2026/04/27 03:08
linux-6.6 INFO: rcu detected stall in sys_unlinkat 1 2 147d 230d 0/2 auto-obsoleted due to no activity on 2026/04/18 09:38
upstream INFO: rcu detected stall in sys_unlinkat (4) tomoyo fs 1 2 153d 168d 0/29 auto-obsoleted due to no activity on 2026/04/02 11:46

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (1 GPs behind) idle=5ac4/1/0x4000000000000000 softirq=164981/164982 fqs=1
rcu: 	(detected by 1, t=10502 jiffies, g=216165, q=87 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 19657 Comm: syz-executor.1 Not tainted 6.5.0-rc7-syzkaller-00185-g28f20a19294d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:variable_test_bit arch/x86/include/asm/bitops.h:228 [inline]
RIP: 0010:arch_test_bit arch/x86/include/asm/bitops.h:240 [inline]
RIP: 0010:_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
RIP: 0010:cpumask_test_cpu include/linux/cpumask.h:504 [inline]
RIP: 0010:cpu_online include/linux/cpumask.h:1082 [inline]
RIP: 0010:trace_hrtimer_expire_entry include/trace/events/timer.h:239 [inline]
RIP: 0010:__run_hrtimer kernel/time/hrtimer.c:1685 [inline]
RIP: 0010:__hrtimer_run_queues+0x5dd/0xc10 kernel/time/hrtimer.c:1752
Code: 00 e8 a7 e0 10 00 45 89 ed be 08 00 00 00 4c 89 e8 48 c1 e8 06 48 8d 3c c5 d0 a6 ab 8e e8 ab 10 65 00 4c 0f a3 2d 73 7e 36 0d <41> 0f 92 c5 31 ff 44 89 ee e8 a5 db 10 00 45 84 ed 0f 85 d9 03 00
RSP: 0018:ffffc90000007e40 EFLAGS: 00000047
RAX: 0000000000000001 RBX: ffff8880b982b980 RCX: ffffffff81752855
RDX: fffffbfff1d574db RSI: 0000000000000008 RDI: ffffffff8eaba6d0
RBP: 0000000000000001 R08: 0000000000000000 R09: fffffbfff1d574da
R10: ffffffff8eaba6d7 R11: ffffc90000007ff8 R12: ffff8880b982b880
R13: 0000000000000000 R14: ffff888035995340 R15: ffffffff885a6ba0
FS:  0000555556f8b480(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002000cf3d CR3: 0000000054d1f000 CR4: 0000000000350ef0
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 hrtimer_interrupt+0x31b/0x800 kernel/time/hrtimer.c:1814
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1098 [inline]
 __sysvec_apic_timer_interrupt+0x14a/0x430 arch/x86/kernel/apic/apic.c:1115
 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1109
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:unwind_get_return_address+0x4a/0xa0 arch/x86/kernel/unwind_orc.c:369
Code: 74 04 3c 03 7e 51 8b 03 85 c0 75 05 5b 31 c0 5d c3 48 8d 6b 48 48 b8 00 00 00 00 00 fc ff df 48 89 ea 48 c1 ea 03 80 3c 02 00 <75> 32 48 8b 7b 48 e8 1b 87 1c 00 85 c0 74 d3 48 b8 00 00 00 00 00
RSP: 0018:ffffc900034cf6a0 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffffc900034cf6b8 RCX: 0000000000000000
RDX: 1ffff92000699ee0 RSI: 0000000000000001 RDI: ffffc900034cf6b8
RBP: ffffc900034cf700 R08: ffffc900034cf6ec R09: ffffffff8f36af2a
R10: ffffc900034cf6b8 R11: 00000000000073df R12: ffffffff8173dd50
R13: ffffc900034cf778 R14: 0000000000000000 R15: ffff888014fabb80
 arch_stack_walk+0x9d/0xf0 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x96/0xd0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383
 kasan_kmalloc include/linux/kasan.h:196 [inline]
 __do_kmalloc_node mm/slab_common.c:985 [inline]
 __kmalloc+0x5d/0x100 mm/slab_common.c:998
 kmalloc include/linux/slab.h:586 [inline]
 kzalloc include/linux/slab.h:703 [inline]
 tomoyo_encode2+0x100/0x3d0 security/tomoyo/realpath.c:45
 tomoyo_encode+0x29/0x50 security/tomoyo/realpath.c:80
 tomoyo_realpath_from_path+0x196/0x710 security/tomoyo/realpath.c:283
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x271/0x450 security/tomoyo/file.c:822
 tomoyo_path_rmdir+0x92/0xd0 security/tomoyo/tomoyo.c:194
 security_path_rmdir+0xf9/0x160 security/security.c:1712
 do_rmdir+0x2d7/0x400 fs/namei.c:4256
 __do_sys_unlinkat fs/namei.c:4437 [inline]
 __se_sys_unlinkat fs/namei.c:4431 [inline]
 __x64_sys_unlinkat+0xef/0x130 fs/namei.c:4431
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb14267c2c7
Code: 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 07 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffe7e462dd8 EFLAGS: 00000207 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 00007fb14267c2c7
RDX: 0000000000000200 RSI: 00007ffe7e463f50 RDI: 00000000ffffff9c
RBP: 00007fb1426c73b9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000100 R11: 0000000000000207 R12: 00007ffe7e463f50
R13: 00007fb1426c73b9 R14: 00000000002fd41a R15: 0000000000000019
 </TASK>
rcu: rcu_preempt kthread starved for 10500 jiffies! g216165 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28320 pid:16    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5381 [inline]
 __schedule+0xee1/0x59f0 kernel/sched/core.c:6710
 schedule+0xe7/0x1b0 kernel/sched/core.c:6786
 schedule_timeout+0x157/0x2c0 kernel/time/timer.c:2167
 rcu_gp_fqs_loop+0x1ec/0xa50 kernel/rcu/tree.c:1609
 rcu_gp_kthread+0x249/0x380 kernel/rcu/tree.c:1808
 kthread+0x33a/0x430 kernel/kthread.c:389
 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 PID: 4248 Comm: kworker/u4:48 Not tainted 6.5.0-rc7-syzkaller-00185-g28f20a19294d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:296 [inline]
RIP: 0010:smp_call_function_many_cond+0x4db/0x1570 kernel/smp.c:835
Code: 4d 48 b8 00 00 00 00 00 fc ff df 4d 89 fc 4c 89 fd 49 c1 ec 03 83 e5 07 49 01 c4 83 c5 03 e8 1c 5f 0b 00 f3 90 41 0f b6 04 24 <40> 38 c5 7c 08 84 c0 0f 85 3c 0e 00 00 8b 43 08 31 ff 83 e0 01 41
RSP: 0018:ffffc90005ee7938 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff8880b9844fe0 RCX: 0000000000000000
RDX: ffff888028ba3b80 RSI: ffffffff817aa9c4 RDI: 0000000000000005
RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffed10173089fd
R13: 0000000000000001 R14: ffff8880b993d580 R15: ffff8880b9844fe8
FS:  0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fe9c8375198 CR3: 000000000c776000 CR4: 0000000000350ee0
Call Trace:
 <IRQ>
 </IRQ>
 <TASK>
 on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1003
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:1997 [inline]
 text_poke_bp_batch+0x46b/0x780 arch/x86/kernel/alternative.c:2207
 text_poke_flush arch/x86/kernel/alternative.c:2398 [inline]
 text_poke_flush arch/x86/kernel/alternative.c:2395 [inline]
 text_poke_finish+0x1a/0x30 arch/x86/kernel/alternative.c:2405
 arch_jump_label_transform_apply+0x17/0x30 arch/x86/kernel/jump_label.c:146
 jump_label_update+0x32e/0x410 kernel/jump_label.c:829
 static_key_enable_cpuslocked+0x1b5/0x270 kernel/jump_label.c:205
 static_key_enable+0x1a/0x20 kernel/jump_label.c:218
 toggle_allocation_gate mm/kfence/core.c:831 [inline]
 toggle_allocation_gate+0xf4/0x250 mm/kfence/core.c:823
 process_one_work+0xaa2/0x16f0 kernel/workqueue.c:2600
 worker_thread+0x687/0x1110 kernel/workqueue.c:2751
 kthread+0x33a/0x430 kernel/kthread.c:389
 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:145
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2023/08/27 04:01 upstream 28f20a19294d 03d9c195 .config console log report info ci-upstream-kasan-gce-root INFO: rcu detected stall in sys_unlinkat
* Struck through repros no longer work on HEAD.