INFO: rcu detected stall in task_numa_work (2)

Status: upstream: reported C repro on 2025/01/04 04:47
Subsystems: mm bpf
[Documentation on labels]
Reported-by: syzbot+06d48cbf3e767907cec2@syzkaller.appspotmail.com
First crash: 873d, last: 5d17h
Cause bisection: failed (error log, bisect log)
  
Fix bisection: failed (error log, bisect log)
  
▶ ▼ ✨ AI Jobs (9)
ID Workflow Result Correct Bug Created Started Finished Revision
0b09b208 assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/10/09 01:49 2026/10/09 01:49 2026/10/09 02:36 723be09b
5f2c553e assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/09/09 01:43 2026/09/09 01:43 2026/09/09 02:07 243b72f1
60f56a23 assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/08/09 12:56 2026/08/09 12:56 2026/08/09 13:23 5d63f80b
691a48b9 assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/07/08 01:07 2026/07/08 01:07 2026/07/08 01:30 93f57954
0691197b assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/06/22 01:02 2026/06/22 01:02 2026/06/22 01:21 43bfcdb0
e43de075 assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/06/14 00:48 2026/06/14 00:48 2026/06/14 01:12 4f06757f
16ae16dc assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/06/09 15:34 2026/06/09 15:34 2026/06/09 15:57 c36c07f6
239e5c60 assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/06/02 08:56 2026/06/02 08:56 2026/06/02 09:24 1095583b
1fb2db51 assessment-security 💥 INFO: rcu detected stall in task_numa_work (2) 2026/05/23 23:09 2026/05/23 23:09 2026/05/23 23:35 c69befb3
▶ ▼ Discussions (5)
Title Replies (including bot) Last reply
[syzbot] Monthly bpf report (Jul 2026) 0 (1) 2026/07/23 04:32
[syzbot] Monthly bpf report (Jun 2026) 0 (1) 2026/06/22 04:32
[syzbot] Monthly bpf report (May 2026) 0 (1) 2026/05/18 04:32
[syzbot] Monthly bpf report (Feb 2026) 0 (1) 2026/02/06 14:30
[syzbot] [mm?] INFO: rcu detected stall in task_numa_work (2) 0 (1) 2025/01/04 04:47
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream INFO: rcu detected stall in task_numa_work mm 1 2 1142d 1144d 0/29 auto-obsoleted due to no activity on 2023/11/28 14:56
linux-6.1 INFO: rcu detected stall in task_numa_work 1 1 863d 863d 0/3 auto-obsoleted due to no activity on 2024/09/12 14:33
linux-4.19 BUG: soft lockup in task_numa_work 1 1 1778d 1778d 0/1 auto-closed as invalid on 2022/04/01 16:00
▶ ▼ Last patch testing requests (9)
Created Duration User Patch Repo Result
2026/09/19 08:21 49m retest repro net-next no crash job log log
2026/07/05 07:46 56m retest repro net-next log
2026/04/22 07:11 49m retest repro net-next report log
2026/02/11 06:29 32m retest repro net-next report log
2026/02/11 06:24 21m retest repro net-next report log
2025/12/03 05:24 59m retest repro net-next report log
2025/09/23 23:39 25m retest repro net-next report log
2025/07/15 22:47 21m retest repro net-next report log
2025/01/16 00:14 21m retest repro net-next report log
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2025/05/06 10:23 12h04m bisect fix net-next error job log
2025/03/24 01:15 3h15m bisect fix net-next OK (0) job log log
2025/02/19 22:41 3h31m bisect fix net-next OK (0) job log log

Sample crash report:
bridge0: received packet on veth1_to_bridge with own address as source address (addr:92:b6:f8:b3:1f:67, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:92:b6:f8:b3:1f:67, vlan:0)
bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1c, vlan:0)
bridge0: received packet on veth1_to_bridge with own address as source address (addr:92:b6:f8:b3:1f:67, vlan:0)
rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	Tasks blocked on level-0 rcu_node (CPUs 0-1): P7243/1:b..l P5598/1:b..l P5708/1:b..l P7136/1:b..l P5584/1:b..l
rcu: 	(detected by 0, t=10722 jiffies, g=22937, q=1355 ncpus=2)
task:syz-executor    state:R  running task     stack:22696 pid:5584  tgid:5584  ppid:5583   task_flags:0x400100 flags:0x00080800
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:7606
 irqentry_exit_to_kernel_mode_preempt include/linux/irq-entry-common.h:468 [inline]
 irqentry_exit_to_kernel_mode include/linux/irq-entry-common.h:539 [inline]
 irqentry_exit+0x205/0xa10 kernel/entry/common.c:167
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:lock_acquire+0x5e/0x380 kernel/locking/lockdep.c:5947
Code: 05 cf 2e a6 13 83 f8 07 0f 87 da 00 00 00 48 0f a3 05 de f6 5d 10 0f 82 c9 02 00 00 8b 35 7e 28 5e 10 85 f6 0f 85 c7 00 00 00 <48> 8b 44 24 30 65 48 2b 05 6d 2e a6 13 0f 85 09 03 00 00 48 83 c4
RSP: 0018:ffffc9000325f710 EFLAGS: 00000206
RAX: 0000000000000046 RBX: 0000000000000000 RCX: 0000000000000200
RDX: 0000000000000000 RSI: ffffffff8e3bd310 RDI: ffffffff8c625580
RBP: ffffffff8fdec5a0 R08: 000000006004d454 R09: 0000000000000007
R10: 0000000000000200 R11: 0000000000000001 R12: 0000000000000002
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 rcu_read_lock include/linux/rcupdate.h:849 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
 arch_stack_walk+0x94/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 save_stack+0x162/0x1e0 mm/page_owner.c:183
 __reset_page_owner+0x84/0x190 mm/page_owner.c:338
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_kmalloc+0x8a/0xb0 mm/kasan/common.c:417
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 task_numa_work+0xfcf/0x1980 kernel/sched/fair.c:4450
 task_work_run+0x150/0x240 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:70 [inline]
 exit_to_user_mode_loop+0x1d8/0x700 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f43d0159357
RSP: 002b:00007ffdeb642240 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: 0000000000029c28 RBX: 0000555590bb5540 RCX: 00007f43d0159357
RDX: 0000000000029c28 RSI: 00007f43cbfd63d8 RDI: 0000000000000003
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000029c28
R13: 0000555590bce4b0 R14: 00007ffdeb642820 R15: 00007f43cbfd63d8
 </TASK>
task:syz.2.340       state:R  running task     stack:23256 pid:7136  tgid:7136  ppid:5609   task_flags:0x40064c flags:0x00080001
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 preempt_schedule_common+0x3c/0xb0 kernel/sched/core.c:7463
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __raw_spin_unlock include/linux/spinlock_api_smp.h:201 [inline]
 _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:213
 spin_unlock include/linux/spinlock.h:401 [inline]
 zap_pte_range mm/memory.c:2095 [inline]
 zap_pmd_range mm/memory.c:2151 [inline]
 zap_pud_range mm/memory.c:2179 [inline]
 zap_p4d_range mm/memory.c:2200 [inline]
 __zap_vma_range+0x16b0/0x48e0 mm/memory.c:2240
 unmap_vmas+0x299/0x5f0 mm/memory.c:2309
 exit_mmap+0x1ef/0xa00 mm/mmap.c:1315
 __mmput+0x12a/0x410 kernel/fork.c:1193
 mmput+0x67/0x80 kernel/fork.c:1216
 exit_mm kernel/exit.c:592 [inline]
 do_exit+0x83b/0x2a50 kernel/exit.c:974
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1129
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3112
 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:101 [inline]
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 irqentry_exit_to_user_mode_prepare include/linux/irq-entry-common.h:244 [inline]
 irqentry_exit_to_user_mode include/linux/irq-entry-common.h:315 [inline]
 irqentry_exit+0x402/0xa10 kernel/entry/common.c:165
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595
RIP: 0033:0x7f90c539e1e1
RSP: 002b:fffffffffffffe70 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f90c5626090 RCX: 00007f90c539e1d9
RDX: 0000000000000000 RSI: fffffffffffffe70 RDI: 0000000000008000
RBP: 00007f90c5435888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007f90c5626128 R14: 00007f90c5626090 R15: 00007ffd82efffd8
 </TASK>
task:kworker/0:6     state:R  running task     stack:22216 pid:5708  tgid:5708  ppid:2      task_flags:0x4208060 flags:0x00080000
Workqueue: events_power_efficient gc_worker
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 preempt_schedule_common+0x3c/0xb0 kernel/sched/core.c:7463
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __local_bh_enable_ip+0x106/0x120 kernel/softirq.c:480
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 nf_ct_delete_from_lists net/netfilter/nf_conntrack_core.c:647 [inline]
 nf_ct_delete+0x261/0x650 net/netfilter/nf_conntrack_core.c:697
 nf_ct_kill include/net/netfilter/nf_conntrack.h:236 [inline]
 nf_ct_gc_expired.part.0+0x17e/0x200 net/netfilter/nf_conntrack_core.c:742
 nf_ct_gc_expired net/netfilter/nf_conntrack_core.c:735 [inline]
 gc_worker+0xc1f/0x1a10 net/netfilter/nf_conntrack_core.c:1562
 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
 process_scheduled_works kernel/workqueue.c:3479 [inline]
 worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
task:syz-executor    state:R  running task     stack:23496 pid:5598  tgid:5598  ppid:1      task_flags:0x40054c flags:0x00080003
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 preempt_schedule_common+0x3c/0xb0 kernel/sched/core.c:7463
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __raw_read_unlock include/linux/rwlock_api_smp.h:256 [inline]
 _raw_read_unlock+0x3e/0x50 kernel/locking/spinlock.c:295
 zap_pid_ns_processes+0x259/0x6a0 kernel/pid_namespace.c:233
 find_child_reaper kernel/exit.c:634 [inline]
 forget_original_parent kernel/exit.c:718 [inline]
 exit_notify kernel/exit.c:755 [inline]
 do_exit+0x2300/0x2a50 kernel/exit.c:998
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1129
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3112
 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x139/0x700 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fc28b15ea0e
RSP: 002b:00007ffe03480a88 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: fffffffffffffe00 RBX: 000055555e1ff500 RCX: 00007fc28b15ea0e
RDX: 0000000040000000 RSI: 00007ffe03480b2c RDI: ffffffffffffffff
RBP: 00007ffe03480b2c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000000004c
R13: 000055555e212a10 R14: 000000000002e0f4 R15: 00007ffe03480b80
 </TASK>
task:syz.2.375       state:R  running task     stack:23800 pid:7243  tgid:7242  ppid:5609   task_flags:0x400040 flags:0x00080002
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 preempt_schedule_common+0x3c/0xb0 kernel/sched/core.c:7463
 preempt_schedule_thunk+0x16/0x40 arch/x86/entry/thunk.S:12
 __local_bh_enable_ip+0x106/0x120 kernel/softirq.c:480
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 ipt_do_table+0xd5c/0x1b00 net/ipv4/netfilter/ip_tables.c:357
 ipt_mangle_out net/ipv4/netfilter/iptable_mangle.c:53 [inline]
 iptable_mangle_hook+0x1c9/0x4b0 net/ipv4/netfilter/iptable_mangle.c:79
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xbf/0x220 net/netfilter/core.c:619
 nf_hook include/linux/netfilter.h:280 [inline]
 __ip_local_out+0x541/0xb80 net/ipv4/ip_output.c:120
 ip_local_out net/ipv4/ip_output.c:129 [inline]
 ip_send_skb+0x4a/0x2a0 net/ipv4/ip_output.c:1515
 udp_send_skb+0xa38/0xfc0 net/ipv4/udp.c:1183
 udp_sendmsg+0x1760/0x2710 net/ipv4/udp.c:1465
 inet_sendmsg+0x105/0x140 net/ipv4/af_inet.c:865
 sock_sendmsg_nosec net/socket.c:800 [inline]
 __sock_sendmsg net/socket.c:815 [inline]
 ____sys_sendmsg+0x9c9/0xbe0 net/socket.c:2713
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2767
 __sys_sendmmsg+0x20c/0x440 net/socket.c:2856
 __do_sys_sendmmsg net/socket.c:2883 [inline]
 __se_sys_sendmmsg net/socket.c:2880 [inline]
 __x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2880
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f90c539e1d9
RSP: 002b:00007f90c6336028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007f90c5625fa0 RCX: 00007f90c539e1d9
RDX: 000000000800001d RSI: 0000200000000500 RDI: 0000000000000004
RBP: 00007f90c5435888 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f90c5626038 R14: 00007f90c5625fa0 R15: 00007ffd82efffd8
 </TASK>
rcu: rcu_preempt kthread starved for 2501 jiffies! g22937 f0x0 RCU_GP_WAIT_FQS(5) ->state=R ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27832 pid:17    tgid:17    ppid:2      task_flags:0x208040 flags:0x00080000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5533 [inline]
 __schedule+0x1259/0x6920 kernel/sched/core.c:7284
 __schedule_loop kernel/sched/core.c:7361 [inline]
 schedule+0xdd/0x2c0 kernel/sched/core.c:7376
 schedule_timeout+0x127/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1a9/0x8f0 kernel/rcu/tree.c:2122
 rcu_gp_kthread+0x17a/0x220 kernel/rcu/tree.c:2330
 kthread+0x373/0x450 kernel/kthread.c:436
 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 7230 Comm: syz.3.371 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:task_irq_context kernel/locking/lockdep.c:4726 [inline]
RIP: 0010:__lock_acquire+0x2b8/0x1f40 kernel/locking/lockdep.c:5224
Code: 8d 84 24 b0 0b 00 00 48 89 44 24 08 48 8b 44 24 08 89 ea 66 81 e2 ff 1f 48 8d 1c 08 0f b7 43 20 4c 89 7b 10 66 25 00 e0 09 d0 <31> d2 66 89 43 20 48 8b 84 24 b0 00 00 00 48 89 43 08 48 8b 04 24
RSP: 0018:ffffc90000a17998 EFLAGS: 00000002
RAX: 0000000000002007 RBX: ffff88802ff8d7a0 RCX: 00000000000000f0
RDX: 0000000000000007 RSI: ffff88802ff8d778 RDI: ffffffff8fdec5a0
RBP: 0000000000000007 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000006 R11: 0000000000000001 R12: ffff88802ff8cb00
R13: 0000000000000002 R14: 0000000000000000 R15: ffffffff8fdec5a0
FS:  0000000000000000(0000) GS:ffff888122a46000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b326faff8 CR3: 000000007dd85000 CR4: 00000000003526f0
Call Trace:
 <IRQ>
 lock_acquire kernel/locking/lockdep.c:5942 [inline]
 lock_acquire+0x1d1/0x380 kernel/locking/lockdep.c:5899
 rcu_lock_acquire include/linux/rcupdate.h:309 [inline]
 rcu_read_lock include/linux/rcupdate.h:849 [inline]
 class_rcu_constructor include/linux/rcupdate.h:1216 [inline]
 unwind_next_frame+0xd1/0x2090 arch/x86/kernel/unwind_orc.c:495
 __unwind_start+0x3cd/0x7e0 arch/x86/kernel/unwind_orc.c:787
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0x73/0xf0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:264 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:296
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6509 [inline]
 kmem_cache_free+0x127/0x6c0 mm/slub.c:6636
 kfree_skbmem+0x19a/0x210 net/core/skbuff.c:1145
 __kfree_skb net/core/skbuff.c:1212 [inline]
 sk_skb_reason_drop+0x10f/0x1b0 net/core/skbuff.c:1250
 kfree_skb_reason include/linux/skbuff.h:1323 [inline]
 kfree_skb include/linux/skbuff.h:1332 [inline]
 ip6_mc_input+0x8b6/0x1050 net/ipv6/ip6_input.c:639
 dst_input include/net/dst.h:481 [inline]
 ip6_rcv_finish+0x294/0x300 net/ipv6/ip6_input.c:119
 ip_sabotage_in+0x21e/0x290 net/bridge/br_netfilter_hooks.c:988
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_slow+0xbf/0x220 net/netfilter/core.c:619
 nf_hook.constprop.0+0x2a6/0x750 include/linux/netfilter.h:280
 NF_HOOK include/linux/netfilter.h:323 [inline]
 ipv6_rcv+0xa4/0x3d0 net/ipv6/ip6_input.c:351
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:6297
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6410
 netif_receive_skb_internal net/core/dev.c:6496 [inline]
 netif_receive_skb+0x139/0x7d0 net/core/dev.c:6555
 NF_HOOK include/linux/netfilter.h:325 [inline]
 NF_HOOK include/linux/netfilter.h:319 [inline]
 br_pass_frame_up+0x346/0x490 net/bridge/br_input.c:70
 br_handle_frame_finish+0xa6b/0x1f70 net/bridge/br_input.c:235
 br_nf_hook_thresh+0x30d/0x420 net/bridge/br_netfilter_hooks.c:1165
 br_nf_pre_routing_finish_ipv6+0x659/0xdd0 net/bridge/br_netfilter_ipv6.c:153
 NF_HOOK include/linux/netfilter.h:325 [inline]
 br_nf_pre_routing_ipv6+0x39c/0x8b0 net/bridge/br_netfilter_ipv6.c:183
 br_nf_pre_routing+0x90f/0x1560 net/bridge/br_netfilter_hooks.c:513
 nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
 nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
 br_handle_frame+0xd59/0x1670 net/bridge/br_input.c:451
 __netif_receive_skb_core.constprop.0+0x6c5/0x3530 net/core/dev.c:6184
 __netif_receive_skb_one_core+0xb0/0x1e0 net/core/dev.c:6295
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6410
 process_backlog+0x487/0x1600 net/core/dev.c:6761
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7830
 napi_poll net/core/dev.c:7893 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:8050
 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
 __do_softirq kernel/softirq.c:679 [inline]
 invoke_softirq kernel/softirq.c:519 [inline]
 __irq_exit_rcu+0x16a/0x210 kernel/softirq.c:758
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:775
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:37 [inline]
RIP: 0010:check_kcov_mode kernel/kcov.c:179 [inline]
RIP: 0010:write_comp_data+0x0/0xa0 kernel/kcov.c:242
Code: 6d fd ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <65> 48 8b 05 30 61 81 13 49 89 f8 49 89 d2 49 89 f1 65 48 8b 3d 0f
RSP: 0018:ffffc900049574c8 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffffea000197ca00 RCX: ffffffff826bd78a
RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000005
RBP: ffffea000197ca00 R08: 0000000000000006 R09: 0000000000065f28
R10: 000000000000c00c R11: 0000000000000001 R12: 0000000000000001
R13: ffff888074c70c80 R14: 0000000000065f28 R15: ffffea000197ca30
 __folio_rmap_sanity_checks include/linux/rmap.h:349 [inline]
 __folio_remove_rmap mm/rmap.c:1794 [inline]
 folio_remove_rmap_ptes+0xea/0xdd0 mm/rmap.c:1910
 zap_present_folio_ptes mm/memory.c:1803 [inline]
 zap_present_ptes mm/memory.c:1861 [inline]
 do_zap_pte_range mm/memory.c:1963 [inline]
 zap_pte_range mm/memory.c:2065 [inline]
 zap_pmd_range mm/memory.c:2151 [inline]
 zap_pud_range mm/memory.c:2179 [inline]
 zap_p4d_range mm/memory.c:2200 [inline]
 __zap_vma_range+0x1fe7/0x48e0 mm/memory.c:2240
 unmap_vmas+0x299/0x5f0 mm/memory.c:2309
 exit_mmap+0x1ef/0xa00 mm/mmap.c:1315
 __mmput+0x12a/0x410 kernel/fork.c:1193
 mmput+0x67/0x80 kernel/fork.c:1216
 exit_mm kernel/exit.c:592 [inline]
 do_exit+0x83b/0x2a50 kernel/exit.c:974
 do_group_exit+0xd5/0x2a0 kernel/exit.c:1129
 get_signal+0x1ec7/0x21e0 kernel/signal.c:3112
 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
 exit_to_user_mode_loop+0x139/0x700 kernel/entry/common.c:101
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline]
 do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f652059e1d9
Code: Unable to access opcode bytes at 0x7f652059e1af.
RSP: 002b:00007f652140a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f6520826188 RCX: 00007f652059e1d9
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f6520826188
RBP: 00007f6520826180 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6520826218 R14: 00007ffd6c55ce50 R15: 00007ffd6c55cf38
 </TASK>
net_ratelimit: 6394 callbacks suppressed

Crashes (29):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/10/10 20:27 upstream 3857c2fe5449 4f92358f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in task_numa_work
2026/01/27 17:54 upstream fcb70a56f4d8 9a514c2f .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in task_numa_work
2025/11/05 17:34 upstream 1c353dc8d962 a6c9c731 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root INFO: rcu detected stall in task_numa_work
2025/10/11 09:36 upstream 0739473694c4 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-qemu-gce-upstream-auto INFO: rcu detected stall in task_numa_work
2025/08/02 18:30 upstream 038d61fd6422 7368264b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: rcu detected stall in task_numa_work
2025/06/01 03:09 upstream 4cb6c8af8591 3d2f584d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: rcu detected stall in task_numa_work
2025/01/19 14:02 upstream fda5e3f28400 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: rcu detected stall in task_numa_work
2025/01/18 22:46 upstream fda5e3f28400 f2cb035c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: rcu detected stall in task_numa_work
2025/01/01 22:22 upstream 56e6a3499e14 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: rcu detected stall in task_numa_work
2024/12/27 20:21 upstream d6ef8b40d075 d3ccff63 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: rcu detected stall in task_numa_work
2024/10/27 16:51 upstream 850925a8133c 65e8686b .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: rcu detected stall in task_numa_work
2024/10/21 23:45 upstream 42f7652d3eb5 a93682b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce INFO: rcu detected stall in task_numa_work
2024/08/31 20:00 upstream 1934261d8974 1eda0d14 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: rcu detected stall in task_numa_work
2024/06/24 04:29 upstream 7c16f0a4ed1c edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root INFO: rcu detected stall in task_numa_work
2024/06/23 13:45 upstream 5f583a3162ff edc5149a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: rcu detected stall in task_numa_work
2024/05/26 12:03 upstream c13320499ba0 a10a183e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root INFO: rcu detected stall in task_numa_work
2026/05/20 18:14 net dc416e32baae 62fb93a2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: rcu detected stall in task_numa_work
2026/03/12 12:24 net 87f7dff3ec75 4efadf07 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: rcu detected stall in task_numa_work
2024/11/21 06:22 net 66418447d27b 4b25d554 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce INFO: rcu detected stall in task_numa_work
2026/07/22 23:27 net-next 24d0af194bcc 881ce5c2 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: rcu detected stall in task_numa_work
2026/06/20 12:31 net-next b85966adbf5d 43bfcdb0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: rcu detected stall in task_numa_work
2026/05/31 21:53 net-next 841559836550 6b4a8443 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: rcu detected stall in task_numa_work
2026/05/17 22:52 net-next 627ac78f2741 de5aae85 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: rcu detected stall in task_numa_work
2024/12/31 04:27 net-next 9268abe611b0 d3ccff63 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: rcu detected stall in task_numa_work
2024/12/20 12:42 net-next b73e56f16250 1d58202c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: rcu detected stall in task_numa_work
2024/12/18 16:17 net-next c1bad69f8baf 1432fc84 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: rcu detected stall in task_numa_work
2024/12/06 18:25 net-next 51db5c894300 9ac0fdc6 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce INFO: rcu detected stall in task_numa_work
2025/10/18 14:58 linux-next 93f3bab4310d 1c8c8cd8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: rcu detected stall in task_numa_work
2024/09/30 05:51 linux-next cea5425829f7 ba29ff75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root INFO: rcu detected stall in task_numa_work
* Struck through repros no longer work on HEAD.