syzbot


INFO: rcu detected stall in tipc_recvstream (3)

Status: auto-obsoleted due to no activity on 2026/03/08 18:51
Subsystems: mm
[Documentation on labels]
First crash: 92d, last: 92d
✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision Error
4da85903-0229-4ee6-a363-5ca4c6ac0734 repro INFO: rcu detected stall in tipc_recvstream (3) 2026/03/07 10:40 2026/03/07 10:40 2026/03/07 10:50 31e9c887f7dc24e04b3ca70d0d54fc34141844b0
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in tipc_recvstream (2) kvm 1 3 512d 525d 0/29 auto-obsoleted due to no activity on 2025/01/12 16:43
upstream INFO: rcu detected stall in tipc_recvstream mm 1 1 958d 958d 0/29 auto-obsoleted due to no activity on 2023/10/25 06:34

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P12084/1:b..l
rcu: 	(detected by 0, t=10502 jiffies, g=47785, q=488 ncpus=2)
task:syz.0.1593      state:R  running task     stack:25848 pid:12084 tgid:12083 ppid:5809   task_flags:0x400040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0x1139/0x6150 kernel/sched/core.c:6863
 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7190
 irqentry_exit+0x1d8/0x8c0 kernel/entry/common.c:216
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:__sanitizer_cov_trace_pc+0x56/0x70 kernel/kcov.c:222
Code: 00 f0 00 75 35 8b 82 6c 16 00 00 85 c0 74 2b 8b 82 48 16 00 00 83 f8 02 75 20 48 8b 8a 50 16 00 00 8b 92 4c 16 00 00 48 8b 01 <48> 83 c0 01 48 39 d0 73 07 48 89 01 48 89 34 c1 e9 c5 3e bb 09 0f
RSP: 0018:ffffc90011627490 EFLAGS: 00000246
RAX: 0000000000055c74 RBX: ffff888034c6821e RCX: ffffc9000bc29000
RDX: 0000000000080000 RSI: ffffffff8b70bdf6 RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000007 R09: 0000000000001000
R10: ffff888034c6821e R11: ffff888031ac0b30 R12: 0000000000000000
R13: ffffc900116275d8 R14: 0000000000000300 R15: 0000000000000002
 mas_start lib/maple_tree.c:1203 [inline]
 mas_state_walk lib/maple_tree.c:3291 [inline]
 mt_find+0x436/0xa20 lib/maple_tree.c:6497
 find_vma+0xbf/0x140 mm/mmap.c:906
 lock_mm_and_find_vma+0x62/0x6e0 mm/mmap_lock.c:453
 do_user_addr_fault+0x2ac/0x1370 arch/x86/mm/fault.c:1359
 handle_page_fault arch/x86/mm/fault.c:1476 [inline]
 exc_page_fault+0x64/0xc0 arch/x86/mm/fault.c:1532
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:618
RIP: 0010:rep_movs_alternative+0x4a/0x90 arch/x86/lib/copy_user_64.S:74
Code: 81 04 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 <f3> a4 e9 4f 81 04 00 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48
RSP: 0018:ffffc900116277c8 EFLAGS: 00050206
RAX: 0000000000000001 RBX: 00000000000101d0 RCX: 000000000000d150
RDX: ffffed1007d7a057 RSI: ffff88803ebc3168 RDI: 0000200000186000
RBP: 0000200000182f80 R08: 0000000000000000 R09: ffffed1007d7a056
R10: ffff88803ebd02b7 R11: 0000000000000000 R12: ffffc90011627e48
R13: 0000200000193150 R14: ffff88803ebc00e8 R15: 00007ffffffff000
 copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline]
 raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline]
 copy_to_user_iter lib/iov_iter.c:25 [inline]
 iterate_ubuf include/linux/iov_iter.h:30 [inline]
 iterate_and_advance2 include/linux/iov_iter.h:302 [inline]
 iterate_and_advance include/linux/iov_iter.h:330 [inline]
 _copy_to_iter+0x383/0x1710 lib/iov_iter.c:197
 copy_to_iter include/linux/uio.h:220 [inline]
 simple_copy_to_iter+0x46/0x90 net/core/datagram.c:521
 __skb_datagram_iter+0x129/0x900 net/core/datagram.c:402
 skb_copy_datagram_iter+0xa6/0x220 net/core/datagram.c:535
 skb_copy_datagram_msg include/linux/skbuff.h:4217 [inline]
 tipc_recvstream+0x3fb/0x970 net/tipc/socket.c:2067
 sock_recvmsg_nosec net/socket.c:1078 [inline]
 sock_recvmsg+0x1f9/0x250 net/socket.c:1100
 ____sys_recvmsg+0x218/0x6b0 net/socket.c:2812
 ___sys_recvmsg+0x114/0x1a0 net/socket.c:2854
 __sys_recvmsg+0x16a/0x220 net/socket.c:2887
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbe8b38f749
RSP: 002b:00007fbe8c293038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f
RAX: ffffffffffffffda RBX: 00007fbe8b5e5fa0 RCX: 00007fbe8b38f749
RDX: 0000000000001f00 RSI: 0000200000000500 RDI: 0000000000000004
RBP: 00007fbe8b413f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fbe8b5e6038 R14: 00007fbe8b5e5fa0 R15: 00007ffe84d4ca28
 </TASK>
rcu: rcu_preempt kthread starved for 10522 jiffies! g47785 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:28440 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5256 [inline]
 __schedule+0x1139/0x6150 kernel/sched/core.c:6863
 __schedule_loop kernel/sched/core.c:6945 [inline]
 schedule+0xe7/0x3a0 kernel/sched/core.c:6960
 schedule_timeout+0x123/0x290 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1ea/0xaf0 kernel/rcu/tree.c:2083
 rcu_gp_kthread+0x26d/0x380 kernel/rcu/tree.c:2285
 kthread+0x3c5/0x780 kernel/kthread.c:463
 ret_from_fork+0x983/0xb10 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 12099 Comm: syz.3.1597 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:lock_acquire+0x62/0x330 kernel/locking/lockdep.c:5872
Code: 76 17 12 83 f8 07 0f 87 a2 02 00 00 89 c0 48 0f a3 05 82 fe ed 0e 0f 82 74 02 00 00 8b 35 1a 2f ee 0e 85 f6 0f 85 8d 00 00 00 <48> 8b 44 24 30 65 48 2b 05 99 76 17 12 0f 85 ad 02 00 00 48 83 c4
RSP: 0018:ffffc90010e8fe70 EFLAGS: 00000206
RAX: 0000000000000046 RBX: ffffffff8e3c9620 RCX: 0000000068c1bacb
RDX: 0000000000000000 RSI: ffffffff8da9bf6a RDI: ffffffff8bf24280
RBP: 0000000000000002 R08: 00000000ffffffff R09: 00000000ffffffff
R10: 0000000000000002 R11: ffff888022a90b30 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  00007f7b30baf6c0(0000) GS:ffff888124909000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000000058 CR3: 0000000079625000 CR4: 00000000003526f0
DR0: 0000000000000001 DR1: fffffffffffffff7 DR2: 0000000000000000
DR3: 000000000000000a DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
 rcu_read_lock include/linux/rcupdate.h:867 [inline]
 __task_pid_nr_ns+0x3f/0x500 kernel/pid.c:515
 task_tgid_vnr include/linux/pid.h:298 [inline]
 __do_sys_getpid+0x1d/0x30 kernel/sys.c:1001
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7b2fd865e7
Code: 0b e9 68 fe ff ff 48 83 c4 18 48 8d 3d b2 62 d9 00 5b 5d 41 5c 41 5d 41 5e 41 5f e9 23 f8 fb ff 0f 1f 00 b8 27 00 00 00 0f 05 <c3> 0f 1f 84 00 00 00 00 00 b8 6e 00 00 00 0f 05 c3 0f 1f 84 00 00
RSP: 002b:00007f7b30bae3c8 EFLAGS: 00000202 ORIG_RAX: 0000000000000027
RAX: ffffffffffffffda RBX: 00007f7b30bae530 RCX: 00007f7b2fd865e7
RDX: 00007f7b30bae400 RSI: 00007f7b30bae530 RDI: 0000000000000021
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f7b2ffe6038 R14: 00007ffcafa3cc90 R15: 00007ffcafa3cd78
 </TASK>

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/08 18:45 upstream c2f2b01b74be d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in tipc_recvstream
* Struck through repros no longer work on HEAD.