vlan_get_protocol_and_depth include/linux/if_vlan.h:658 [inline]
skb_network_protocol+0x51d/0x770 net/core/dev.c:3379
RIP: 37a1c780:0x0
Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6.
RSP: 841681e0:ffffc90001377448 EFLAGS: 00000000
==================================================================
BUG: KASAN: out-of-bounds in __show_regs+0x46/0x500 arch/x86/kernel/process_64.c:76
Read of size 8 at addr ffffc90001377398 by task rcub/0/15
CPU: 0 PID: 15 Comm: rcub/0 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0xf1/0x140 mm/kasan/report.c:444
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
__show_regs+0x46/0x500 arch/x86/kernel/process_64.c:76
show_regs_if_on_stack arch/x86/kernel/dumpstack.c:173 [inline]
show_trace_log_lvl+0x2f6/0x410 arch/x86/kernel/dumpstack.c:300
show_stack+0x37/0x40 arch/x86/kernel/dumpstack.c:320
sched_show_task+0x38c/0x550 kernel/sched/core.c:8824
rcu_print_detail_task_stall_rnp kernel/rcu/tree_stall.h:233 [inline]
print_other_cpu_stall+0xcc1/0x1010 kernel/rcu/tree_stall.h:573
check_cpu_stall kernel/rcu/tree_stall.h:745 [inline]
rcu_pending kernel/rcu/tree.c:3972 [inline]
rcu_sched_clock_irq+0x8b2/0x12c0 kernel/rcu/tree.c:2619
update_process_times+0x198/0x200 kernel/time/timer.c:1824
tick_sched_handle kernel/time/tick-sched.c:257 [inline]
tick_sched_timer+0x17c/0x240 kernel/time/tick-sched.c:1478
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x3b9/0x9f0 kernel/time/hrtimer.c:1753
hrtimer_interrupt+0x3c7/0x8c0 kernel/time/hrtimer.c:1815
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0xfa/0x3e0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:rtmutex_spin_on_owner kernel/locking/rtmutex.c:1426 [inline]
RIP: 0010:rt_mutex_slowlock_block+0x2ef/0x5e0 kernel/locking/rtmutex.c:1560
Code: ff ff 48 89 55 b8 48 c1 ea 03 48 89 95 58 ff ff ff eb 10 48 8b 02 48 83 e0 fe 49 39 c7 0f 85 46 01 00 00 48 8b 85 50 ff ff ff <42> 0f b6 04 28 84 c0 0f 85 ee 00 00 00 48 8b 45 b0 83 38 00 0f 84
RSP: 0000:ffffc900000f7bf8 EFLAGS: 00000246
RAX: 1ffff1103e804006 RBX: ffffffff867a93f8 RCX: ffffffff84b34da6
RDX: ffffffff867a9410 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc900000f7cb0 R08: ffff8881002f8007 R09: 1ffff1102005f000
R10: dffffc0000000000 R11: ffffed102005f001 R12: ffffc900000f7d00
R13: dffffc0000000000 R14: ffff8881002f8000 R15: ffff8881f4020000
__rt_mutex_slowlock kernel/locking/rtmutex.c:1629 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1662 [inline]
rt_mutex_slowlock+0x186/0x2d0 kernel/locking/rtmutex.c:1691
__rt_mutex_lock kernel/locking/rtmutex.c:1703 [inline]
__rt_mutex_lock_common kernel/locking/rtmutex_api.c:30 [inline]
rt_mutex_lock+0x113/0x1c0 kernel/locking/rtmutex_api.c:66
rcu_boost kernel/rcu/tree_plugin.h:1066 [inline]
rcu_boost_kthread+0x239/0x650 kernel/rcu/tree_plugin.h:1091
kthread+0x411/0x500 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
Memory state around the buggy address:
ffffc90001377280: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 f8 f2 01 f2
ffffc90001377300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90001377380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffffc90001377400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90001377480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
ORIG_RAX: 0000000000000000
RAX: 0000004000000004 RBX: ffffffff84165ab9 RCX: ffff8881356a08c0
RDX: ffffc90001377f10 RSI: ffffc90001377338 RDI: ffffffff84ae040c
RBP: ffffc900013773b8 R08: ffff888135527ad8 R09: 625d979483480100
R10: 1ffff11026aa9ade R11: 1ffff11026aa9ae3 R12: 0000000000000000
R13: ffffffff812c5686 R14: ffffc900013772d8 R15: ffffc90001377370
rcu: rcu_preempt kthread starved for 633 jiffies! g161025 f0x2 RCU_GP_WAIT_FQS(5) ->state=0x0 ->cpu=0
rcu: Unless rcu_preempt kthread gets sufficient CPU time, OOM is now expected behavior.
rcu: RCU grace-period kthread stack dump:
task:rcu_preempt state:R running task stack:28640 pid: 14 ppid: 2 flags:0x00004000
Call Trace:
context_switch kernel/sched/core.c:5178 [inline]
__schedule+0xb6e/0x14c0 kernel/sched/core.c:6538
schedule+0x11e/0x1e0 kernel/sched/core.c:6621
schedule_timeout+0x159/0x340 kernel/time/timer.c:1920
rcu_gp_fqs_loop+0x2ae/0xf80 kernel/rcu/tree.c:1972
rcu_gp_kthread+0x9b/0x360 kernel/rcu/tree.c:2145
kthread+0x411/0x500 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
rcu: Stack dump where RCU GP kthread last ran:
NMI backtrace for cpu 0
CPU: 0 PID: 15 Comm: rcub/0 Tainted: G B W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:88
dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
dump_stack+0x15/0x20 lib/dump_stack.c:113
nmi_cpu_backtrace+0x2af/0x2c0 lib/nmi_backtrace.c:111
nmi_trigger_cpumask_backtrace+0x138/0x240 lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x10/0x20 arch/x86/kernel/apic/hw_nmi.c:39
trigger_single_cpu_backtrace include/linux/nmi.h:166 [inline]
rcu_check_gp_kthread_starvation+0x1e0/0x260 kernel/rcu/tree_stall.h:487
print_other_cpu_stall+0xe33/0x1010 kernel/rcu/tree_stall.h:592
check_cpu_stall kernel/rcu/tree_stall.h:745 [inline]
rcu_pending kernel/rcu/tree.c:3972 [inline]
rcu_sched_clock_irq+0x8b2/0x12c0 kernel/rcu/tree.c:2619
update_process_times+0x198/0x200 kernel/time/timer.c:1824
tick_sched_handle kernel/time/tick-sched.c:257 [inline]
tick_sched_timer+0x17c/0x240 kernel/time/tick-sched.c:1478
__run_hrtimer kernel/time/hrtimer.c:1689 [inline]
__hrtimer_run_queues+0x3b9/0x9f0 kernel/time/hrtimer.c:1753
hrtimer_interrupt+0x3c7/0x8c0 kernel/time/hrtimer.c:1815
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1097 [inline]
__sysvec_apic_timer_interrupt+0xfa/0x3e0 arch/x86/kernel/apic/apic.c:1114
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:rtmutex_spin_on_owner kernel/locking/rtmutex.c:1426 [inline]
RIP: 0010:rt_mutex_slowlock_block+0x2ef/0x5e0 kernel/locking/rtmutex.c:1560
Code: ff ff 48 89 55 b8 48 c1 ea 03 48 89 95 58 ff ff ff eb 10 48 8b 02 48 83 e0 fe 49 39 c7 0f 85 46 01 00 00 48 8b 85 50 ff ff ff <42> 0f b6 04 28 84 c0 0f 85 ee 00 00 00 48 8b 45 b0 83 38 00 0f 84
RSP: 0000:ffffc900000f7bf8 EFLAGS: 00000246
RAX: 1ffff1103e804006 RBX: ffffffff867a93f8 RCX: ffffffff84b34da6
RDX: ffffffff867a9410 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffc900000f7cb0 R08: ffff8881002f8007 R09: 1ffff1102005f000
R10: dffffc0000000000 R11: ffffed102005f001 R12: ffffc900000f7d00
R13: dffffc0000000000 R14: ffff8881002f8000 R15: ffff8881f4020000
__rt_mutex_slowlock kernel/locking/rtmutex.c:1629 [inline]
__rt_mutex_slowlock_locked kernel/locking/rtmutex.c:1662 [inline]
rt_mutex_slowlock+0x186/0x2d0 kernel/locking/rtmutex.c:1691
__rt_mutex_lock kernel/locking/rtmutex.c:1703 [inline]
__rt_mutex_lock_common kernel/locking/rtmutex_api.c:30 [inline]
rt_mutex_lock+0x113/0x1c0 kernel/locking/rtmutex_api.c:66
rcu_boost kernel/rcu/tree_plugin.h:1066 [inline]
rcu_boost_kthread+0x239/0x650 kernel/rcu/tree_plugin.h:1091
kthread+0x411/0x500 kernel/kthread.c:337
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
----------------
Code disassembly (best guess), 1 bytes skipped:
0: ff 48 89 decl -0x77(%rax)
3: 55 push %rbp
4: b8 48 c1 ea 03 mov $0x3eac148,%eax
9: 48 89 95 58 ff ff ff mov %rdx,-0xa8(%rbp)
10: eb 10 jmp 0x22
12: 48 8b 02 mov (%rdx),%rax
15: 48 83 e0 fe and $0xfffffffffffffffe,%rax
19: 49 39 c7 cmp %rax,%r15
1c: 0f 85 46 01 00 00 jne 0x168
22: 48 8b 85 50 ff ff ff mov -0xb0(%rbp),%rax
* 29: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 ee 00 00 00 jne 0x124
36: 48 8b 45 b0 mov -0x50(%rbp),%rax
3a: 83 38 00 cmpl $0x0,(%rax)
3d: 0f .byte 0xf
3e: 84 .byte 0x84