syzbot

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 GPs behind) idle=8a04/1/0x4000000000000000 softirq=19687/19688 fqs=6
rcu: 	(detected by 0, t=10502 jiffies, g=15173, q=402 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 UID: 0 PID: 7503 Comm: syz.3.615 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:hlock_class+0x0/0x130 kernel/locking/lockdep.c:225
Code: df e8 c4 40 87 00 e9 af fe ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 <48> b8 00 00 00 00 00 fc ff df 53 48 89 fb 48 83 c7 20 48 89 fa 48
RSP: 0018:ffffc90000a18b30 EFLAGS: 00000006
RAX: 0000000000000003 RBX: 0000000000000000 RCX: ffffffff81966d32
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888027dbafd0
RBP: 0000000000000040 R08: 0000000000000000 R09: fffffbfff2dd85c6
R10: ffffffff96ec2e37 R11: 0000000000000005 R12: ffff888027dbaff1
R13: ffff888027dba440 R14: 0000000000000003 R15: ffff888027dbaff8
FS:  00007fa62c6106c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2f91aff8 CR3: 000000005d9fe000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <NMI>
 </NMI>
 <IRQ>
 __lock_acquire+0x13a6/0x3c40 kernel/locking/lockdep.c:5224
 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5851
 __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline]
 _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:351 [inline]
 advance_sched+0xd8/0xc60 net/sched/sch_taprio.c:924
 __run_hrtimer kernel/time/hrtimer.c:1801 [inline]
 __hrtimer_run_queues+0x20a/0xae0 kernel/time/hrtimer.c:1865
 hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1927
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:lock_is_held_type+0x107/0x150 kernel/locking/lockdep.c:5928
Code: 00 00 b8 ff ff ff ff 65 0f c1 05 3c 55 ab 74 83 f8 01 75 2d 9c 58 f6 c4 02 75 43 48 f7 04 24 00 02 00 00 74 01 fb 48 83 c4 08 <44> 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 45 31 ed eb
RSP: 0018:ffffc90003f2f5a0 EFLAGS: 00000296
RAX: 0000000000000046 RBX: ffff888027dbaf80 RCX: 0000000000000001
RDX: 0000000000000000 RSI: ffffffff8b6cefa0 RDI: ffffffff8bd35600
RBP: ffffffff8e1bcc80 R08: 0000000000000000 R09: fffffbfff2dd8598
R10: ffffffff96ec2cc7 R11: 0000000000000004 R12: ffff888027dba440
R13: 0000000000000001 R14: 00000000ffffffff R15: 0000000000000002
 obj_cgroup_memcg+0x62/0xa0 include/linux/memcontrol.h:361
 folio_memcg include/linux/memcontrol.h:429 [inline]
 folio_memcg include/linux/memcontrol.h:426 [inline]
 __lruvec_stat_mod_folio+0x21f/0x370 mm/memcontrol.c:800
 __folio_mod_stat mm/rmap.c:1301 [inline]
 __folio_add_file_rmap mm/rmap.c:1490 [inline]
 folio_add_file_rmap_ptes+0x180/0x310 mm/rmap.c:1511
 insert_page_into_pte_locked.isra.0+0x358/0x6f0 mm/memory.c:2153
 insert_page_in_batch_locked mm/memory.c:2187 [inline]
 insert_pages mm/memory.c:2228 [inline]
 vm_insert_pages+0x42f/0xac0 mm/memory.c:2279
 io_region_mmap io_uring/memmap.c:313 [inline]
 io_uring_mmap+0x447/0x670 io_uring/memmap.c:339
 call_mmap include/linux/fs.h:2245 [inline]
 mmap_file mm/internal.h:124 [inline]
 __mmap_new_file_vma mm/vma.c:2292 [inline]
 __mmap_new_vma mm/vma.c:2356 [inline]
 __mmap_region+0x181f/0x2760 mm/vma.c:2457
 mmap_region+0x32b/0x3f0 mm/vma.c:2535
 do_mmap+0xd8d/0x11b0 mm/mmap.c:561
 vm_mmap_pgoff+0x203/0x3a0 mm/util.c:575
 ksys_mmap_pgoff+0x32c/0x5c0 mm/mmap.c:607
 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:89 [inline]
 __se_sys_mmap arch/x86/kernel/sys_x86_64.c:82 [inline]
 __x64_sys_mmap+0x125/0x190 arch/x86/kernel/sys_x86_64.c:82
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa62b78d1a3
Code: f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 89 ca 41 f7 c1 ff 0f 00 00 75 14 b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 25 c3 0f 1f 40 00 48 c7 c0 a8 ff ff ff 64 c7
RSP: 002b:00007fa62c60ffc8 EFLAGS: 00000246 ORIG_RAX: 0000000000000009
RAX: ffffffffffffffda RBX: 00007fa62b9a5fa0 RCX: 00007fa62b78d1a3
RDX: 0000000000000003 RSI: 0000000000100000 RDI: 0000000000000000
RBP: 0000400000000400 R08: 0000000000000004 R09: 0000000010000000
R10: 0000000000008001 R11: 0000000000000246 R12: 0000000000000004
R13: 00004000000003c0 R14: 00000000000034f1 R15: 0000400000001480
 </TASK>
rcu: rcu_preempt kthread starved for 10490 jiffies! g15173 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:R  running task     stack:27552 pid:17    tgid:17    ppid:2      task_flags:0x208040 flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5378 [inline]
 __schedule+0xf43/0x5890 kernel/sched/core.c:6765
 __schedule_loop kernel/sched/core.c:6842 [inline]
 schedule+0xe7/0x350 kernel/sched/core.c:6857
 schedule_timeout+0x124/0x280 kernel/time/sleep_timeout.c:99
 rcu_gp_fqs_loop+0x1eb/0xb00 kernel/rcu/tree.c:2024
 rcu_gp_kthread+0x271/0x380 kernel/rcu/tree.c:2226
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
CPU: 0 UID: 0 PID: 6933 Comm: kworker/u8:15 Not tainted 6.14.0-rc3-syzkaller-00267-gff202c5028a1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: events_unbound toggle_allocation_gate
RIP: 0010:csd_lock_wait kernel/smp.c:340 [inline]
RIP: 0010:smp_call_function_many_cond+0x4c6/0x12c0 kernel/smp.c:885
Code: 0c 00 85 ed 74 4d 48 b8 00 00 00 00 00 fc ff df 4d 89 fc 4c 89 fd 49 c1 ec 03 83 e5 07 49 01 c4 83 c5 03 e8 7c 0e 0c 00 f3 90 <41> 0f b6 04 24 40 38 c5 7c 08 84 c0 0f 85 e8 0b 00 00 8b 43 08 31
RSP: 0018:ffffc90003417928 EFLAGS: 00000293
RAX: 0000000000000000 RBX: ffff8880b8744a80 RCX: ffffffff81add08a
RDX: ffff888027ed2440 RSI: ffffffff81add064 RDI: 0000000000000005
RBP: 0000000000000003 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000006 R12: ffffed10170e8951
R13: 0000000000000001 R14: ffff8880b863fe80 R15: ffff8880b8744a88
FS:  0000000000000000(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005555912ba5c8 CR3: 000000000df80000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 </IRQ>
 <TASK>
 on_each_cpu_cond_mask+0x40/0x90 kernel/smp.c:1052
 on_each_cpu include/linux/smp.h:71 [inline]
 text_poke_sync arch/x86/kernel/alternative.c:2118 [inline]
 text_poke_bp_batch+0x22b/0x760 arch/x86/kernel/alternative.c:2328
 text_poke_flush arch/x86/kernel/alternative.c:2519 [inline]
 text_poke_flush arch/x86/kernel/alternative.c:2516 [inline]
 text_poke_finish+0x30/0x40 arch/x86/kernel/alternative.c:2526
 arch_jump_label_transform_apply+0x1c/0x30 arch/x86/kernel/jump_label.c:146
 jump_label_update+0x1d7/0x400 kernel/jump_label.c:920
 static_key_enable_cpuslocked+0x1b7/0x270 kernel/jump_label.c:210
 static_key_enable+0x1a/0x20 kernel/jump_label.c:223
 toggle_allocation_gate mm/kfence/core.c:850 [inline]
 toggle_allocation_gate+0xfc/0x260 mm/kfence/core.c:842
 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
 process_scheduled_works kernel/workqueue.c:3317 [inline]
 worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
 kthread+0x3af/0x750 kernel/kthread.c:464
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
 </TASK>