INFO: rcu detected stall in packet_release (2)

Status: closed as invalid on 2026/09/11 15:35
Subsystems: kasan net mm
Labels: prio:high
[Documentation on labels]
First crash: 85d, last: 47d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
6e276923 assessment-security DenialOfService: ✅ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ✅ UserNamespace: ✅ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ INFO: rcu detected stall in packet_release (2) 2026/06/30 20:31 2026/06/30 20:31 2026/06/30 21:10 93f57954
▶ ▼ Similar bugs (1)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in packet_release net 1 syz, C unreliable 1 927d 850d 25/29 fixed on 2024/06/11 03:41
▶ ▼ Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/07/14 20:37 29m retest repro upstream log

Sample crash report:
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P7088/1:b..l P7072/1:b..l
rcu: 	(detected by 1, t=10502 jiffies, g=21245, q=22 ncpus=2)
task:syz-executor321 state:R  running task     stack:26440 pid:7072  tgid:7071  ppid:5677   task_flags:0x40054c flags:0x00080001
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x125c/0x6730 kernel/sched/core.c:7234
 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7556
 irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x205/0xa00 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x370 kernel/locking/lockdep.c:5872
Code: 05 fb 06 2f 12 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 46 52 f7 0e 0f 82 ac 02 00 00 8b 35 ee 85 f7 0e 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 9d 06 2f 12 0f 85 ec 02 00 00 48 83 c4
RSP: 0018:ffffc90006337270 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8df333b0 RDI: ffffffff8c1e8f80
RBP: ffffffff8e7e5ec0 R08: 00000000d14c1201 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000000 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:300 [inline]
 rcu_read_lock include/linux/rcupdate.h:840 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1183 [inline]
 unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 slab_free mm/slub.c:6405 [inline]
 kfree+0x22b/0x6c0 mm/slub.c:6720
 skb_kfree_head net/core/skbuff.c:1077 [inline]
 skb_free_head+0xb9/0x160 net/core/skbuff.c:1089
 skb_release_data+0x6c5/0x8e0 net/core/skbuff.c:1116
 skb_release_all net/core/skbuff.c:1191 [inline]
 __kfree_skb net/core/skbuff.c:1205 [inline]
 sk_skb_reason_drop+0x102/0x1b0 net/core/skbuff.c:1244
 kfree_skb_reason include/linux/skbuff.h:1323 [inline]
 __skb_queue_purge_reason include/linux/skbuff.h:3441 [inline]
 skb_queue_purge_reason+0x2aa/0x420 net/core/skbuff.c:4021
 skb_queue_purge include/linux/skbuff.h:3454 [inline]
 packet_release+0x833/0xda0 net/packet/af_packet.c:3184
 __sock_release+0xb3/0x260 net/socket.c:710
 sock_close+0x1c/0x30 net/socket.c:1501
 __fput+0x3ff/0xb50 fs/file_table.c:512
 task_work_run+0x150/0x240 kernel/task_work.c:233
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0x951/0x2ae0 kernel/exit.c:1004
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1147
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3038
 arch_do_signal_or_restart+0x91/0x7a0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x139/0x6f0 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]
 do_syscall_64+0x652/0x840 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f00d57e1959
RSP: 002b:00007f00d57b21d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f00d588cb48 RCX: 00007f00d57e1959
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f00d588cb48
RBP: 00007f00d588cb40 R08: 37203a6b63617473 R09: 37203a6b63617473
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f00d585d4a0
R13: 0000200000000040 R14: 0000200000000000 R15: 0064657373657270
 </TASK>
task:modprobe        state:R  running task     stack:25176 pid:7088  tgid:7088  ppid:134    task_flags:0x40000c flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x125c/0x6730 kernel/sched/core.c:7234
 preempt_schedule_irq+0x50/0x90 kernel/sched/core.c:7556
 irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x205/0xa00 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:its_return_thunk+0x0/0x10 arch/x86/lib/retpoline.S:417
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc <c3> cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 0b a9 d7 f5 cc
RSP: 0018:ffffc90006427628 EFLAGS: 00000286
RAX: 0000000000000001 RBX: 0000000000000001 RCX: ffffffff821a21bf
RDX: 0000000000000000 RSI: ffffffff8c1e8f00 RDI: ffffffff8e20f920
RBP: 00007fe16f9b2600 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffffffff81f30580
R13: ffffc90006427748 R14: 0000000000000000 R15: ffff88802eb0dd00
 rcu_read_unlock include/linux/rcupdate.h:869 [inline]
 is_bpf_text_address+0x123/0x1a0 kernel/bpf/core.c:749
 kernel_text_address kernel/extable.c:125 [inline]
 kernel_text_address+0x8d/0x100 kernel/extable.c:94
 __kernel_text_address+0xd/0x30 kernel/extable.c:79
 unwind_get_return_address+0x59/0xa0 arch/x86/kernel/unwind_orc.c:385
 arch_stack_walk+0xa6/0xf0 arch/x86/kernel/stacktrace.c:26
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2e5/0x6c0 mm/slub.c:5515
 _kmalloc_noprof include/linux/slab.h:969 [inline]
 slab_free_hook mm/slub.c:2657 [inline]
 slab_free mm/slub.c:6405 [inline]
 kmem_cache_free+0x412/0x6b0 mm/slub.c:6532
 tear_down_vmas+0x2a5/0x600 mm/mmap.c:1262
 exit_mmap+0x469/0xa00 mm/mmap.c:1320
 __mmput+0x12a/0x410 kernel/fork.c:1182
 mmput+0x67/0x80 kernel/fork.c:1205
 exit_mm kernel/exit.c:610 [inline]
 do_exit+0x8b1/0x2ae0 kernel/exit.c:992
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1147
 __do_sys_exit_group kernel/exit.c:1158 [inline]
 __se_sys_exit_group kernel/exit.c:1156 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1156
 x64_sys_call+0x102c/0x1530 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x840 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe16f9b26c5
RSP: 002b:00007ffef44a0b08 EFLAGS: 00000206 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007fe16fab3fe8 RCX: 00007fe16f9b26c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000001
RBP: 0000000000000001 R08: 00007ffef44a0a98 R09: 0000000000000000
R10: 00007ffef44a0930 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000001 R14: 00007fe16fab2680 R15: 00007fe16fab4000
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10597 jiffies! g21245 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=5889
rcu: rcu_preempt kthread starved for 10598 jiffies! g21245 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:28984 pid:16    tgid:16    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5510 [inline]
 __schedule+0x125c/0x6730 kernel/sched/core.c:7234
 __schedule_loop kernel/sched/core.c:7311 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7326
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1a9/0x900 kernel/rcu/tree.c:2123
 rcu_gp_kthread+0x179/0x230 kernel/rcu/tree.c:2325
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 1 UID: 0 PID: 7086 Comm: syz-executor321 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:pv_native_safe_halt+0xf/0x20 arch/x86/kernel/paravirt.c:64
Code: d6 86 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d c3 57 11 00 fb f4 <e9> bc 48 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
RSP: 0018:ffffc900064077b8 EFLAGS: 00000242
RAX: 000000000000b7dc RBX: 0000000000000003 RCX: 0000000000000004
RDX: 0000000000000000 RSI: ffffffff8df5902e RDI: ffffffff8c1e8f80
RBP: ffff888079894310 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003
R13: 0000000000000003 R14: ffff8880b853c600 R15: 0000000000000000
FS:  00007f00d57b26c0(0000) GS:ffff8881243e7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000001000 CR3: 000000007f488000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 arch_safe_halt arch/x86/include/asm/paravirt.h:62 [inline]
 kvm_wait arch/x86/kernel/kvm.c:1096 [inline]
 kvm_wait+0x124/0x160 arch/x86/kernel/kvm.c:1078
 pv_wait arch/x86/include/asm/paravirt-spinlock.h:83 [inline]
 pv_wait_head_or_lock kernel/locking/qspinlock_paravirt.h:466 [inline]
 __pv_queued_spin_lock_slowpath+0x4b0/0xc00 kernel/locking/qspinlock.c:325
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:35 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/paravirt-spinlock.h:66 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x1e0/0x260 kernel/locking/spinlock_debug.c:116
 spin_lock_bh include/linux/spinlock.h:348 [inline]
 lock_sock_nested+0x5f/0xf0 net/core/sock.c:3844
 lock_sock include/net/sock.h:1713 [inline]
 tipc_sendstream+0x41/0x70 net/tipc/socket.c:1549
 sock_sendmsg_nosec net/socket.c:775 [inline]
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0xa4d/0xbe0 net/socket.c:2684
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2738
 __sys_sendmmsg+0x20c/0x440 net/socket.c:2827
 __do_sys_sendmmsg net/socket.c:2854 [inline]
 __se_sys_sendmmsg net/socket.c:2851 [inline]
 __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2851
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x840 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f00d57e1959
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f00d57b21d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f00d588cb48 RCX: 00007f00d57e1959
RDX: 00000000000009a6 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f00d588cb40 R08: 37203a6b63617473 R09: 37203a6b63617473
R10: 000000000000000a R11: 0000000000000246 R12: 00007f00d585d4a0
R13: 0000200000000040 R14: 0000200000000000 R15: 0064657373657270
 </TASK>

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/30 20:31 upstream dc59e4fea9d8 e5173a01 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto INFO: rcu detected stall in packet_release
2026/08/07 22:58 upstream 364465ab19de e4ef95d6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in packet_release
* Struck through repros no longer work on HEAD.