syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	0-...!: (1 GPs behind) idle=e8bc/1/0x4000000000000000 softirq=37862/37863 fqs=0
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P11010/1:b..l
rcu: 	(detected by 1, t=10502 jiffies, g=32961, q=143 ncpus=2)
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.13.0-rc4-syzkaller-00071-gfd0584d220fe #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:__sanitizer_cov_trace_pc+0x18/0x70 kernel/kcov.c:213
Code: 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 65 48 8b 15 44 c3 69 7e 65 8b 05 45 c3 69 7e a9 00 01 ff 00 <48> 8b 34 24 74 1d f6 c4 01 74 43 a9 00 00 0f 00 75 3c a9 00 00 f0
RSP: 0018:ffffc90000007d78 EFLAGS: 00000006
RAX: 0000000080010303 RBX: 0000000004000000 RCX: ffffffff8941582e
RDX: ffff88801d6b8000 RSI: 0000000004000000 RDI: 0000000000000006
RBP: ffff88802acff000 R08: 0000000000000006 R09: 0000000004000000
R10: 0000000004000000 R11: 0000000000000007 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000002 R15: 0000000004000000
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c311ec9 CR3: 0000000053eec000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 advance_sched+0x43c/0xc60 net/sched/sch_taprio.c:962
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1803
 hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1865
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__seqprop_spinlock_sequence include/linux/seqlock.h:227 [inline]
RIP: 0010:read_seqbegin include/linux/seqlock.h:813 [inline]
RIP: 0010:zone_span_seqbegin include/linux/memory_hotplug.h:103 [inline]
RIP: 0010:page_outside_zone_boundaries mm/page_alloc.c:437 [inline]
RIP: 0010:bad_range+0xcd/0x440 mm/page_alloc.c:456
Code: 89 ef e8 76 ef 87 ff 48 8b 74 24 70 4c 89 ef e8 59 dc 87 ff 9c 5a 49 bb 00 00 00 00 00 fc ff df 80 e6 02 58 0f 85 2e 02 00 00 <41> 0f b6 16 41 38 d7 7c 08 84 d2 0f 85 57 02 00 00 8b 93 d0 00 00
RSP: 0018:ffffc90000156698 EFLAGS: 00000246
RAX: 000000000026001a RBX: ffff88813fffbc80 RCX: ffffffff81efd1be
RDX: 0000000000000002 RSI: ffffffff8b6cd9e0 RDI: ffffffff8bd1ed60
RBP: 000000000006cc95 R08: 0000000000000001 R09: fffffbfff2dca3cc
R10: ffffffff96e51e67 R11: dffffc0000000000 R12: ffffea0001b32540
R13: ffff88813fffbd58 R14: ffffed1027fff7aa R15: 0000000000000003
 rmqueue mm/page_alloc.c:3093 [inline]
 get_page_from_freelist+0xfae/0x2f80 mm/page_alloc.c:3473
 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
 alloc_slab_page mm/slub.c:2423 [inline]
 allocate_slab mm/slub.c:2589 [inline]
 new_slab+0x2c9/0x410 mm/slub.c:2642
 ___slab_alloc+0xd7d/0x17a0 mm/slub.c:3830
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3920
 __slab_alloc_node mm/slub.c:3995 [inline]
 slab_alloc_node mm/slub.c:4156 [inline]
 kmem_cache_alloc_noprof+0xfa/0x3d0 mm/slub.c:4175
 skb_clone+0x190/0x3f0 net/core/skbuff.c:2084
 netem_enqueue+0x1a98/0x3610 net/sched/sch_netem.c:490
 dev_qdisc_enqueue net/core/dev.c:3793 [inline]
 __dev_xmit_skb net/core/dev.c:3889 [inline]
 __dev_queue_xmit+0x2152/0x43e0 net/core/dev.c:4400
 dev_queue_xmit include/linux/netdevice.h:3168 [inline]
 neigh_hh_output include/net/neighbour.h:523 [inline]
 neigh_output include/net/neighbour.h:537 [inline]
 ip_finish_output2+0xc6c/0x2150 net/ipv4/ip_output.c:236
 __ip_finish_output net/ipv4/ip_output.c:314 [inline]
 __ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:296
 ip_finish_output+0x35/0x380 net/ipv4/ip_output.c:324
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:434
 dst_output include/net/dst.h:450 [inline]
 ip_local_out+0x33e/0x4a0 net/ipv4/ip_output.c:130
 __ip_queue_xmit+0x777/0x1970 net/ipv4/ip_output.c:536
 __tcp_transmit_skb+0x2b39/0x3e10 net/ipv4/tcp_output.c:1468
 tcp_transmit_skb net/ipv4/tcp_output.c:1486 [inline]
 tcp_write_xmit+0x12b1/0x8560 net/ipv4/tcp_output.c:2829
 __tcp_push_pending_frames+0xaf/0x390 net/ipv4/tcp_output.c:3012
 tcp_push_pending_frames include/net/tcp.h:2107 [inline]
 tcp_data_snd_check net/ipv4/tcp_input.c:5741 [inline]
 tcp_rcv_established+0x868/0x20d0 net/ipv4/tcp_input.c:6266
 tcp_v4_do_rcv+0x5ca/0xa90 net/ipv4/tcp_ipv4.c:1916
 tcp_v4_rcv+0x33a0/0x4380 net/ipv4/tcp_ipv4.c:2351
 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205
 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254
 dst_input include/net/dst.h:460 [inline]
 ip_rcv_finish net/ipv4/ip_input.c:447 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:567
 __netif_receive_skb_one_core+0x199/0x1e0 net/core/dev.c:5672
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785
 process_backlog+0x443/0x15f0 net/core/dev.c:6117
 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883
 napi_poll net/core/dev.c:6952 [inline]
 net_rx_action+0xa94/0x1010 net/core/dev.c:7074
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
 run_ksoftirqd kernel/softirq.c:950 [inline]
 run_ksoftirqd+0x3a/0x60 kernel/softirq.c:942
 smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
task:syz.0.1303      state:R  running task     stack:27264 pid:11010 tgid:11007 ppid:5834   flags:0x00000002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0xe58/0x5ad0 kernel/sched/core.c:6756
 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6935
 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186
 spin_unlock include/linux/spinlock.h:391 [inline]
 copy_pte_range mm/memory.c:1200 [inline]
 copy_pmd_range mm/memory.c:1261 [inline]
 copy_pud_range mm/memory.c:1298 [inline]
 copy_p4d_range mm/memory.c:1322 [inline]
 copy_page_range+0x1e27/0x5790 mm/memory.c:1420
 dup_mmap kernel/fork.c:748 [inline]
 dup_mm kernel/fork.c:1691 [inline]
 copy_mm kernel/fork.c:1743 [inline]
 copy_process+0x7ef3/0x8e50 kernel/fork.c:2394
 kernel_clone+0xfd/0x960 kernel/fork.c:2806
 __do_sys_clone+0xba/0x100 kernel/fork.c:2949
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f593bd85d29
RSP: 002b:00007f593caf1fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007f593bf75fa0 RCX: 00007f593bd85d29
RDX: 0000000020006400 RSI: 0000000020006400 RDI: 0000000000000000
RBP: 00007f593be01b08 R08: 0000000020006480 R09: 0000000020006480
R10: 0000000020006440 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f593bf75fa0 R15: 00007ffeafbaefe8
 </TASK>
rcu: rcu_preempt kthread starved for 10502 jiffies! g32961 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27600 pid:17    tgid:17    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5369 [inline]
 __schedule+0xe58/0x5ad0 kernel/sched/core.c:6756
 __schedule_loop kernel/sched/core.c:6833 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6848
 schedule_timeout+0x124/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2045
 rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2247
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 2956 Comm: kworker/u8:8 Not tainted 6.13.0-rc4-syzkaller-00071-gfd0584d220fe #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:kvm_wait+0x146/0x180 arch/x86/kernel/kvm.c:1068
Code: 5b 5d 41 5c 41 5d e9 99 7b 51 00 e8 94 7b 51 00 e8 af 1e 59 00 66 90 e8 88 7b 51 00 0f 00 2d 91 2d 21 0a e8 7c 7b 51 00 fb f4 <5b> 5d 41 5c 41 5d e9 6f 7b 51 00 e8 6a 7b 51 00 e8 a5 1c 59 00 e9
RSP: 0018:ffffc90000a17c88 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000003 RCX: 1ffffffff2ddec61
RDX: ffff888031bf8000 RSI: ffffffff81489a34 RDI: ffffffff8bd1ed60
RBP: ffff888021ac40f0 R08: 0000000000000001 R09: fffffbfff2dca3cc
R10: ffffffff96e51e67 R11: ffffffff961f67c8 R12: 0000000000000003
R13: 0000000000000003 R14: ffff8880b873fb00 R15: ffffed100435881e
FS:  0000000000000000(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33ff8ff8 CR3: 000000000df7e000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 pv_wait arch/x86/include/asm/paravirt.h:596 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:466 [inline]
 __pv_queued_spin_lock_slowpath+0x4cd/0xc90 kernel/locking/qspinlock.c:508
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:584 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x210/0x2c0 kernel/locking/spinlock_debug.c:116
 spin_lock include/linux/spinlock.h:351 [inline]
 __dev_xmit_skb net/core/dev.c:3863 [inline]
 __dev_queue_xmit+0x1fe5/0x43e0 net/core/dev.c:4400
 dev_queue_xmit include/linux/netdevice.h:3168 [inline]
 neigh_hh_output include/net/neighbour.h:523 [inline]
 neigh_output include/net/neighbour.h:537 [inline]
 ip_finish_output2+0xc6c/0x2150 net/ipv4/ip_output.c:236
 __ip_finish_output net/ipv4/ip_output.c:314 [inline]
 __ip_finish_output+0x49e/0x950 net/ipv4/ip_output.c:296
 ip_finish_output+0x35/0x380 net/ipv4/ip_output.c:324
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip_output+0x13b/0x2a0 net/ipv4/ip_output.c:434
 dst_output include/net/dst.h:450 [inline]
 ip_local_out+0x33e/0x4a0 net/ipv4/ip_output.c:130
 iptunnel_xmit+0x5d9/0xa00 net/ipv4/ip_tunnel_core.c:82
 geneve_xmit_skb drivers/net/geneve.c:916 [inline]
 geneve_xmit+0x2ae2/0x56f0 drivers/net/geneve.c:1039
 __netdev_start_xmit include/linux/netdevice.h:5002 [inline]
 netdev_start_xmit include/linux/netdevice.h:5011 [inline]
 xmit_one net/core/dev.c:3590 [inline]
 dev_hard_start_xmit+0x9a/0x7b0 net/core/dev.c:3606
 __dev_queue_xmit+0x7f0/0x43e0 net/core/dev.c:4434
 dev_queue_xmit include/linux/netdevice.h:3168 [inline]
 neigh_resolve_output net/core/neighbour.c:1514 [inline]
 neigh_resolve_output+0x5bc/0x950 net/core/neighbour.c:1494
 neigh_output include/net/neighbour.h:539 [inline]
 ip6_finish_output2+0xb1b/0x2070 net/ipv6/ip6_output.c:141
 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline]
 ip6_finish_output+0x3f9/0x1360 net/ipv6/ip6_output.c:226
 NF_HOOK_COND include/linux/netfilter.h:303 [inline]
 ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:247
 dst_output include/net/dst.h:450 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 ndisc_send_skb+0xa69/0x1c50 net/ipv6/ndisc.c:511
 ndisc_send_rs+0x129/0x670 net/ipv6/ndisc.c:721
 addrconf_rs_timer+0x407/0x840 net/ipv6/addrconf.c:4061
 call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1793
 expire_timers kernel/time/timer.c:1844 [inline]
 __run_timers+0x6e8/0x930 kernel/time/timer.c:2418
 __run_timer_base kernel/time/timer.c:2430 [inline]
 __run_timer_base kernel/time/timer.c:2422 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2439
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2449
 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561
 __do_softirq kernel/softirq.c:595 [inline]
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:662
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:csd_lock_wait kernel/smp.c:340 [inline]
RIP: 0010:smp_call_function_many_cond+0x458/0x1300 kernel/smp.c:884
Code: 0c 00 85 ed 74 4d 48 b8 00 00 00 00 00 fc ff df 4d 89 f4 4c 89 f5 49 c1 ec 03 83 e5 07 49 01 c4 83 c5 03 e8 ba 0e 0c 00 f3 90 <41> 0f b6 04 24 40 38 c5 7c 08 84 c0 0f 85 a7 0c 00 00 8b 43 08 31
RSP: 0018:ffffc9000c70f998 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff8880b86469c0 RCX: ffffffff818e071c
RDX: ffff888031bf8000 RSI: ffffffff818e06f6 RDI: 0000000000000005
RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000006 R12: ffffed10170c8d39
R13: 0000000000000001 R14: ffff8880b86469c8 R15: ffff8880b873fe40
 on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1051
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:2114 [inline]
 text_poke_bp_batch+0x22b/0x760 arch/x86/kernel/alternative.c:2324
 text_poke_flush arch/x86/kernel/alternative.c:2515 [inline]
 text_poke_flush arch/x86/kernel/alternative.c:2512 [inline]
 text_poke_finish+0x30/0x40 arch/x86/kernel/alternative.c:2522
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 jump_label_update+0x1d7/0x400 kernel/jump_label.c:920
 static_key_enable_cpuslocked+0x1b7/0x270 kernel/jump_label.c:210
 static_key_enable+0x1a/0x20 kernel/jump_label.c:223
 toggle_allocation_gate mm/kfence/core.c:849 [inline]
 toggle_allocation_gate+0xfc/0x260 mm/kfence/core.c:841
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229
 process_scheduled_works kernel/workqueue.c:3310 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
sched: DL replenish lagged too much