rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: 	1-...!: (1 ticks this GP) idle=ed44/1/0x4000000000000000 softirq=40264/40264 fqs=0
rcu: 	(detected by 0, t=10502 jiffies, g=41429, q=464 ncpus=2)
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 10102 Comm: syz.6.709 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:__sanitizer_cov_trace_const_cmp4+0x82/0x90 kernel/kcov.c:315
Code: 8d 52 28 4d 39 ca 77 22 89 ff 89 f6 49 ff c0 4c 89 01 48 c7 44 11 08 05 00 00 00 48 89 7c 11 10 48 89 74 11 18 48 89 44 11 20 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 8b 04 24
RSP: 0018:ffffc900001f0d38 EFLAGS: 00000006
RAX: ffffffff8175b5ae RBX: 0000000000000001 RCX: 0000000000010000
RDX: ffff88805cca8000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc900001f0e90 R08: ffff888024d27357 R09: 0000000000000000
R10: ffff888024d27340 R11: ffffed10049a4e6b R12: ffff888024d27340
R13: dffffc0000000000 R14: 188ed450d8000000 R15: ffff8880b8f2b800
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000014a0 CR3: 000000000cb30000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 __run_hrtimer kernel/time/hrtimer.c:1716 [inline]
 __hrtimer_run_queues+0x27e/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_interrupt+0x3c9/0x9c0 kernel/time/hrtimer.c:1876
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__nr_to_section include/linux/mmzone.h:1849 [inline]
RIP: 0010:__pfn_to_section include/linux/mmzone.h:1957 [inline]
RIP: 0010:lookup_page_ext mm/page_ext.c:237 [inline]
RIP: 0010:page_ext_get+0x137/0x2b0 mm/page_ext.c:509
Code: ef 96 e8 dc 31 f5 ff 48 8b 05 c5 8b 07 15 48 85 c0 74 42 4c 89 f1 48 c1 e9 16 4c 8d 3c c8 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 <74> 08 4c 89 ff e8 af 31 f5 ff 4d 8b 3f 4d 85 ff 74 20 4d 89 f5 49
RSP: 0018:ffffc9000550f428 EFLAGS: 00000246
RAX: 1ffff11047ffde00 RBX: ffffffff81e7cbe2 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000065ffa RDI: 00000003ffffffff
RBP: 0000000000000001 R08: dffffc0000000000 R09: 1ffffffff21b28a0
R10: dffffc0000000000 R11: fffffbfff21b28a1 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0000000000065ffa R15: ffff88823ffef000
 page_table_check_clear+0x4a/0x6a0 mm/page_table_check.c:74
 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline]
 zap_pte_range mm/memory.c:1429 [inline]
 zap_pmd_range mm/memory.c:1571 [inline]
 zap_pud_range mm/memory.c:1600 [inline]
 zap_p4d_range mm/memory.c:1621 [inline]
 unmap_page_range+0x1ad1/0x2fe0 mm/memory.c:1642
 unmap_vmas+0x25e/0x3a0 mm/memory.c:1732
 exit_mmap+0x200/0xb50 mm/mmap.c:3302
 __mmput+0x118/0x3c0 kernel/fork.c:1355
 exit_mm+0x1da/0x2c0 kernel/exit.c:569
 do_exit+0x88e/0x23c0 kernel/exit.c:870
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 get_signal+0x12fc/0x1400 kernel/signal.c:2902
 arch_do_signal_or_restart+0x9c/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f403ab8f749
Code: Unable to access opcode bytes at 0x7f403ab8f71f.
RSP: 002b:00007f403ba320e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f403ade5fa8 RCX: 00007f403ab8f749
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f403ade5fa8
RBP: 00007f403ade5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f403ade6038 R14: 00007ffc9c22e380 R15: 00007ffc9c22e468
 </TASK>
rcu: rcu_preempt kthread timer wakeup didn't happen for 10501 jiffies! g41429 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402
rcu: 	Possible timer handling issue on cpu=1 timer-softirq=19265
rcu: rcu_preempt kthread starved for 10502 jiffies! g41429 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
rcu: 	Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt     state:I stack:27752 pid:17    ppid:2      flags:0x00004000
Call Trace:
 <TASK>
 context_switch kernel/sched/core.c:5380 [inline]
 __schedule+0x14d2/0x44d0 kernel/sched/core.c:6699
 schedule+0xbd/0x170 kernel/sched/core.c:6773
 schedule_timeout+0x160/0x280 kernel/time/timer.c:2168
 rcu_gp_fqs_loop+0x302/0x1560 kernel/rcu/tree.c:1667
 rcu_gp_kthread+0x99/0x380 kernel/rcu/tree.c:1866
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
 </TASK>
rcu: Stack dump where RCU GP kthread last ran:
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 10102 Comm: syz.6.709 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
RIP: 0010:hlock_class kernel/locking/lockdep.c:228 [inline]
RIP: 0010:check_wait_context kernel/locking/lockdep.c:4774 [inline]
RIP: 0010:__lock_acquire+0x619/0x7c80 kernel/locking/lockdep.c:5087
Code: 07 89 c3 81 e3 ff 1f 00 00 c1 e8 03 25 f8 03 00 00 48 8d b8 00 45 d9 90 be 08 00 00 00 e8 0f fc 75 00 48 0f a3 1d 97 40 72 0f <73> 1a 48 69 c3 d0 00 00 00 48 8d 98 c0 c3 6f 90 49 b8 00 00 00 00
RSP: 0018:ffffc900001f08c0 EFLAGS: 00000057
RAX: 0000000000000001 RBX: 0000000000000021 RCX: ffffffff81670461
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff90d94500
RBP: ffffc900001f0b08 R08: ffffffff90d94507 R09: 1ffffffff21b28a0
R10: dffffc0000000000 R11: fffffbfff21b28a1 R12: ffff88805cca8ac4
R13: ffff88805cca8000 R14: 0000000000000002 R15: ffff88805cca8ba0
FS:  0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00002000000014a0 CR3: 000000000cb30000 CR4: 00000000003506e0
Call Trace:
 <IRQ>
 lock_acquire+0x197/0x410 kernel/locking/lockdep.c:5754
 rcu_lock_acquire include/linux/rcupdate.h:334 [inline]
 rcu_read_lock include/linux/rcupdate.h:786 [inline]
 advance_sched+0xa15/0xc80 net/sched/sch_taprio.c:1001
 __run_hrtimer kernel/time/hrtimer.c:1750 [inline]
 __hrtimer_run_queues+0x51e/0xc40 kernel/time/hrtimer.c:1814
 hrtimer_interrupt+0x3c9/0x9c0 kernel/time/hrtimer.c:1876
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__nr_to_section include/linux/mmzone.h:1849 [inline]
RIP: 0010:__pfn_to_section include/linux/mmzone.h:1957 [inline]
RIP: 0010:lookup_page_ext mm/page_ext.c:237 [inline]
RIP: 0010:page_ext_get+0x137/0x2b0 mm/page_ext.c:509
Code: ef 96 e8 dc 31 f5 ff 48 8b 05 c5 8b 07 15 48 85 c0 74 42 4c 89 f1 48 c1 e9 16 4c 8d 3c c8 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 <74> 08 4c 89 ff e8 af 31 f5 ff 4d 8b 3f 4d 85 ff 74 20 4d 89 f5 49
RSP: 0018:ffffc9000550f428 EFLAGS: 00000246
RAX: 1ffff11047ffde00 RBX: ffffffff81e7cbe2 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000065ffa RDI: 00000003ffffffff
RBP: 0000000000000001 R08: dffffc0000000000 R09: 1ffffffff21b28a0
R10: dffffc0000000000 R11: fffffbfff21b28a1 R12: dffffc0000000000
R13: dffffc0000000000 R14: 0000000000065ffa R15: ffff88823ffef000
 page_table_check_clear+0x4a/0x6a0 mm/page_table_check.c:74
 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline]
 zap_pte_range mm/memory.c:1429 [inline]
 zap_pmd_range mm/memory.c:1571 [inline]
 zap_pud_range mm/memory.c:1600 [inline]
 zap_p4d_range mm/memory.c:1621 [inline]
 unmap_page_range+0x1ad1/0x2fe0 mm/memory.c:1642
 unmap_vmas+0x25e/0x3a0 mm/memory.c:1732
 exit_mmap+0x200/0xb50 mm/mmap.c:3302
 __mmput+0x118/0x3c0 kernel/fork.c:1355
 exit_mm+0x1da/0x2c0 kernel/exit.c:569
 do_exit+0x88e/0x23c0 kernel/exit.c:870
 do_group_exit+0x21b/0x2d0 kernel/exit.c:1024
 get_signal+0x12fc/0x1400 kernel/signal.c:2902
 arch_do_signal_or_restart+0x9c/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
 exit_to_user_mode_prepare+0xf6/0x180 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f403ab8f749
Code: Unable to access opcode bytes at 0x7f403ab8f71f.
RSP: 002b:00007f403ba320e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f403ade5fa8 RCX: 00007f403ab8f749
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f403ade5fa8
RBP: 00007f403ade5fa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f403ade6038 R14: 00007ffc9c22e380 R15: 00007ffc9c22e468
 </TASK>